Slashdot Mirror
Google Broke the Law, Say South Korean Police
bonch writes "South Korean police say Google was in violation of Internet privacy laws when its Street View service archived private information in more than 30 countries, including email and text messages. The country's Cyber Terror Response Center broke the encryption on hard drives raided from Google last August and confirmed that private information had been gathered, violating South Korea's telecommunications laws. Police are seeking the original author of the program, though they say it is likely to be a US citizen. Google said it stopped collecting the information as soon as it realized what was happening. 40 states in the US are demanding access to the information gathered by the mapping service in order to determine what was archived, which Google refused to hand over. 'We have been cooperating with the Korean Communications Commission and the police, and will continue to do so,' said a Google Korea spokesperson."
This isn't a defense of Google. It just seems that corporations are never called to task for deplorable behavior unless they forgot to grease the right wheels.
that all Giggle was doing was recording aspects of the electromagnetic spectrum that was hitting their equipment:
What's the limit to that?
Is it also OK to record faint sound waves emitted from a given StreetView address?
Is it also OK to record GSM cell phone transmissions (recently shown vulnerable to cracking)?
Is it also OK to set up a listening device to log the electromagnetic signature emitted by monitors and keyboards, and then associate that with a given StreetView address in your database?
Would it also be OK to use a high-power lens to record photons leaking beyond a window that you thought you had pulled the curtain on?
Would it also be OK to record infrared heat signatures of building occupants walking around or doing whatever?
And if a "normal" person (not a corporation with cute logo) did all this, wouldn't he be arrested for stalking?
I'm not a lawyer, but I play one on the Internet. Blog
“We succeeded in breaking the encryption behind the hard drives, and confirmed that it contained personal e-mails and text messages of people using the Wi-Fi networks,” said a [Korean] police official.
I was however assuming
1. that in such case Google would have been legally forced to provide the encryption key,
2. and anyway, that a HD encrypted by Google wouldn't be so (apparently) easy to break.
Slashdot, fix the reply notifications... You won't get away with it...
“We are looking to penalize whoever ordered and developed the program, but are unsure as of yet who that might be,” said a police official.
1. first whoever ordered and whoever developed are highly probable two different persons.Did both of them broke the SK law?
2. why they go after the "whoever ordered and developed" and not after "whoever used the tools"? Is it in SK customary to go after the person that manufactured the knife used in a stabbing?
3. the way I know, Google used some open-source components in putting the "tool" together. Is the original author of these components equally guilty?
Questions raise, answers kill. Raise questions to stay alive.
Hi. I'm a software engineer. A few months ago, I dumped a few million social security numbers to a log file. It sure is a good thing I turned off that logging before I switched projects.... Of course, it was turned on for five days until that happened, and nobody realized that SSNs were part of that log.
Life with data is difficult. Fields of "arbitrary data" are logged, sometimes publicly. There's nothing any reasonable person or company can do to stop it. The best they can hope for is that they've hired ethical people who will respect the limits of what they should and should not see.
s/\d{3}-\d{2}-\d{4}/SSN-SS-NSSN/g
You do not have a moral or legal right to do absolutely anything you want.
"We succeeded in breaking the encryption behind the hard drives"
Wait, what? All of the solutions I know of to encrypt hard drives at block or filesystem level are prety well implemented. You can't just brute force them. So either:
[1] What the hell is up with these bullshit terror-inspiring names anyway? It sounds like a bunch of kids getting together on the playground and trying to think of the most kick-ass name for their dodgeball team.
It was a pretty obvious accident, if you understood the technical explanation of what happened. The problem is, if you don't, it sounds like something that couldn't possibly be an accident. The crux of the matter is this:
They were gathering data on purpose. This was NOT the data they were trying to gather. They were trying to gather WiFi SSIDs for geolocation purposes. Unfortunately, the code was simply sloppy. It needed the first X bytes of the packet (which contain the SSID and ended up getting the first X+64. In other words, they weren't even capturing *entire* Payloads of packets -- only fragments of payloads. The data they were trying to gather is perfectly fair game and not at all a privacy issue. All devices do this to some extent, its how they find out what networks are around you and whether or not they're encrypted. You can't simply rely on the broadcast packets for that purpose.
If this was an accident, it was the result of the programmer doing a half-assed job. If it wasn't, however, then the programmer did a completely incompetent half-assed job. If he was *trying* to get this data, then he did it in probably the stupidest possible manner. The only logical conclusion to draw is that it was genuinely an accident.
1. Serious instances of unfounded slandering against various people, especially celebrities.but not restricted to them. The aim is to encourage people to behave responsibly on the internet by tieing what they post or upload back to the individual, beyond that the SK government doesn't give a rat's arse what you do online or which sites you go to.
Case in point being, to continue with your example, that Google (or more specifically Youtube) was required either to have a system to point back to the real-person or alternatively restrict the ability to post or upload potentially slanderous material. Google chose the latter and it's worthy of note that people can do everything else, eg. view videos.
Basically it's the side effect of having the highest rate of internet participation in the world
2. Many government functions that in real-life require authentication are fully online. This is probably beyond the experience of most people on slashdot, but you can do all sorts of personal activities online (eg. taxation, etc) and by definition you can't take people at their word when talking about those. Therefore real-name identification is required there also, particularly as there's rampant attempts at ID theft from china for various reasons.
Ironically your post is a perfect example of scenario 1, ie. malicious slandering by people hiding behind internet anonymity, in the manner in which you deliberately twist the SK's request and google's actions with unsubstantiated additions like:
- It's no secret that the South Korean government isn't overly fond of Google
Hardly, the government has only required that google comply with the laws that were created to address the previously listed comments. Beyond that Google has been free to operate as it sees fit
We're not talking about china and it's so-called golden shield (or shower to be more accurate).
- Google chose to block posts to YouTube from Korea
No, google chose to remove the functionality to post without an account liked to a real person. To quote from the article:
YouTube has decided to restrict its video upload and comment functions in South Korea.” It also stated, “Because there is no upload function, users won’t be required to confirm their identification.”
Note that viewing videos is not restricted at all and uploads/comments to sites that are linked to a real-person are unrestricted beyond the uploader being aware that they should be sociable in their behaviour.
I wouldn't be surprised if Google simply didn't feel it cost effective to create complex functionality that would be country specific (with all the possibilities that different countries would then start asking for their own items) so it was easier to simply remove rather than add.
- while encouraging those users to change their country preference to somewhere else
Where exactly did they say that?
It's fair to say that your post is a perfect example of what the law is designed to address, slanderers hiding behind anonymity to post all sorts of lies and half-truths. We'd all like to think that this type of people don't exist, but unfortunately some people only feel better by putting others down, one only has to look a
the fcc regs give everyone to right to receive all e/m on the public airwaves...
>>>And that's a strawman.
No it isn't. YOU'RE the guy who brought-up the recording of somebody's daughter ("upload video of your daughter on the toilet"), and I responded to that by saying, IF she's doing it in the front yard then yes a guy with a camera has every right to record it. There is no expectation of privacy in a public view.
Now INSIDE your house, then yes said "daughter" has a right to privacy. And I addressed that in a separate post: "A reasonable limit might be to disallow recording of any sound (or sight) that is not detectable by human ears/eyes."
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
I RTFA, and the "breaking the encryption" was a direct quote from the police. So it's not the reporters being stupid.
However, it's quite possibly the police lying to sound more badass.
It doesn't matter if I did or not (though I did), because in my company had contracts authorizing us to use the data however we wanted. I'm fairly sure we could run the SSNs across a 6-foot-tall marquee in the office and been legally clear, as long as no visitors were in the office.
All the logs were stored on encrypted volumes anyway, in known locations. Since the information never (because of preexisting security) left the company, no reporting was needed. Then there's the time where my team intentionally bypassed security layers to view other personal (protected) numbers, because we needed to see what they looked like to understand a production-only bug...
My point is that storing recorded information is ridiculously easy, and recording information is part of the job. Google was intending to collect basic wifi information (ESSID and channel, as I recall), and ended up storing a lot more than that (probably to try to only run the vans once). I've long since lost interest in the details of this case, but I'd assume Google vans just stored everything they received, and processed it later. That intermediate storage, never meant to be used or released to the public, would constitute "eavesdropping" under loosely-worded laws.
You do not have a moral or legal right to do absolutely anything you want.
If you are going to blast the signal to me I have every right to listen/decode/see what you are bombarding my property with 24/7.
I completely agree. And the answer to the GP's various questions is "Yes, it would be OK." It's up the the emitter to restrict emissions that he wants to remain private. That includes photons/vibrations/radio/heat.