Report Finds Google Supervisors Knew About Wi-Fi Data Harvesting

bonch writes "According to the FCC report, Google's collection of Street View data was not the unauthorized act of a rogue engineer, as Google had portrayed it, but an authorized program known to supervisors and at least seven other engineers. The original proposal contradicts Google's claim that there was no intent to gather payload data: 'We are logging user traffic along with sufficient data to precisely triangulate their position at a given time, along with information about what they were doing.'"

Comments

Is there a source to the article?

[DaScribbler]

Is there a source to what is claimed in the article? I followed the links and find nothing to substantiate. Even the NYTimes links just references their own articles.

Re:Is there a source to the article?

[icebike]

I downloaded it the other day. Its available on Scribd. Its telling that this NYT hack fails to give the source link, and the more you read it the clearer it becomes that nobody really knew what Engineer Doe was up to, and even he didn't find any convincing use for the data.

Re:Is there a source to the article?

[symbolset]

Sure. The anonymous cowards in the comments here. They have no ulterior motive, no sir.

Re:Is there a source to the article?

[AHuxley]

http://www.smh.com.au/technology/technology-news/google-aware-of-data-scoop-20120429-1xsxx.html#ixzz1tTGWZTQK
With a 4.5MB pdf. All the blog/press/gov timeline in its full glory.

Re:Is there a source to the article?

[sourcerror]

"Last month, Google acknowledged it had mistakenly collected data over public Wi-Fi networks in more than 30 countries."

http://www.huffingtonpost.com/2010/06/08/google-privacy-slammed-ov_n_604084.html

http://money.cnn.com/2010/05/27/news/companies/google_privacy_fortune.fortune/index.htm

Re:Is there a source to the article?

[Anonymous Coward]

For the lazy: top of page 11 is the relevant section

There are rules, even unspoken

[Anonymous Coward]

Just cos you can, doesn't mean you should.

Re:There are rules, even unspoken

[SecurityGuy]

If you're talking about using encryption rather than broadcasting everything you do to everyone on your block, I disagree. You can, and you should.

Sorry, this is really a non issue for me. Google went around and did the equivalent of listening while people shouted from their rooftops. If you don't want people knowing what you're saying, don't shout it from your rooftop. The same goes for spewing unencrypted traffic across your neighborhood.

Re:There are rules, even unspoken

[LordLucless]

Consider what you're saying. It's like condoning someone who breaks

Wrong. There were no locks for them to break

and enters

Wrong. People were transmitting their information into the street, Google didn't have to enter anything

Want to try again with another analogy?

Re:There are rules, even unspoken

[LordLucless]

Oooh, let me try. It's like two people having sex in their street-facing bedroom without closing the curtains, and complaining when a passerby sees them.

Re:There are rules, even unspoken

[sixtyeight]

Want to try again with another analogy?

Thank you, no.

The wifi data was half-in, half-out of their private homes. It was meant to be used by them, in their homes, and technology had to be specifically modified and sent out in order to intercept it. There's the basis of a reasonable expectation of a right to privacy right there. For someone to obtain that data, they have to go out of their way to nab it. If Google itself had condoned it, there would be little difference between that and seeking to obtain Zero-Day exploits to commercial systems - with the exception that these are private individuals, not mere corporations.

With all the hullabaloo from the MPAA and RIAA about ownership rights to for-profit data, we have at least as much right to our data as private citizens. Otherwise there's no point to having a government, if it doesn't uphold our rights.

Re:There are rules, even unspoken

[sixtyeight]

You're right of course.

Sending out vans en masse to peoples' neighborhoods with equipment and software that's specifically designed to pluck wifi traffic out of the airwaves is no different from strolling down the sidewalk and happening to glance into someone's window. Why, just the other day I was on my way home, glanced over, and idly picked up several packets of someone's e-mail and a bit of their usenet traffic before I could think to look away. How silly of me.

Re:There are rules, even unspoken

[LordLucless]

The wifi data was half-in, half-out of their private homes

No, it was out. The Google car never entered their property, and yet was able to capture that information in its entirety. It was wholly out of their home.

It was meant to be used by them, in their homes

They might have intended for it to only be in use in their home, but they never took the simple necessary technological measure to make it so (encrypting it) which is not a difficult thing to do with a home-use wi-fi router, even for a novice. It just requires them to read the manual.

and technology had to be specifically modified and sent out in order to intercept it

No, no it didn't. One of the details in this case is that Google basically just used an off-the-shelf piece of software to dump all publicly available information. They caught that data because they didn't customize it.

If Google itself had condoned it, there would be little difference between that and seeking to obtain Zero-Day exploits to commercial systems - with the exception that these are private individuals, not mere corporations.

And the fact that there was no security to actually exploit.

With all the hullabaloo from the MPAA and RIAA about ownership rights to for-profit data, we have at least as much right to our data as private citizens

You do. So bloody well tick the little box that says "WEP". Note that's not going to protect you against even the most inept hacker, as its known broken, but Google wouldn't have read your data.

Otherwise there's no point to having a government, if it doesn't uphold our rights.

See, I don't really see the "right to run wi-fi without reading the manual" as worthy of government protection.

Re:There are rules, even unspoken

[LordLucless]

If you had a laptop with you, you probably did.

Re:There are rules, even unspoken

[sixtyeight]

Yes, when do we go after Microsoft for leaving that packet sniffing option on as a default installation option?

Re:There are rules, even unspoken

[SecurityGuy]

Consider what you're saying. It's like condoning someone who breaks and enters into peoples' houses and goes reading through their papers and personal effects, and saying the problem is that they didn't have a secure enough vault in their home.

No, that's not remotely what I'm saying, and your Matthew Shepard comparison is wildly off base.

If you have unencrypted WiFi, you are broadcasting, quite literally, whatever you're doing. All I'm saying is if you're out in public, people can take your picture. You might not like it, but they can. If you yell at your wife on the front porch or in the house if you're loud enough, the neighbors can hear you. I'm not saying you need to encrypt everything, or that you need a vault. I'm saying don't broadcast to the world if you don't want the world to hear you.

I'm very much pro-privacy, but if you want your privacy (as I do), you can't put the burden on the entire rest of the world to preserve it for you. We railed against the DMCA because it criminalized circumventing even useless protection measures, but somehow when they're OUR useless protection measures, it's different? No, it's not. What I'm saying is that if you don't want your papers and personal effects gone through, don't leave them lying in the street for people to pick up and read.

Re:There are rules, even unspoken

[sixtyeight]

The wifi data was half-in, half-out of their private homes

No, it was out. The Google car never entered their property, and yet was able to capture that information in its entirety. It was wholly out of their home.

No, it was half-in, half-out. By that I mean it was being used in their homes, and "leaked" out because that's what airwaves do. Which isn't typically a big deal, since one hardly expects people to be sitting outside trying to pick it up. That's why this story is such a big deal; this time, someone was. I realize that it [purportedly] was unintentional, which is the only exonerating factor.

You argue that no, the exonerating factor was that Google should have been allowed to do this intentionally if it so desired. That the onus is on the private citizens to encrypt everything just in case someone is out there actively trying to sniff their data. Which is a distinct difference in mentality.

It was meant to be used by them, in their homes

They might have intended for it to only be in use in their home, but they never took the simple necessary technological measure to make it so (encrypting it) which is not a difficult thing to do with a home-use wi-fi router, even for a novice. It just requires them to read the manual.

There's nothing technologically complicated about using a handgun either, and using one could certainly save you from a violent mugging. Whenever you leave your home, there is also a slight chance that it will rain no matter what the weather report says. You might get slammed by a car as you cross the street, therefore you should never leave the house without a pair of clean underwear on, in case you have an unanticipated ambulance ride to the hospital to worry about. And you might run into some tourists from Spain who don't speak English while you're out. Therefore, you should never leave the house without a loaded handgun, a large umbrella, a pair of clean underwear on, and a Spanish-to-English translation dictionary. Otherwise, it's your own damn fault.

and technology had to be specifically modified and sent out in order to intercept it

No, no it didn't. One of the details in this case is that Google basically just used an off-the-shelf piece of software to dump all publicly available information. They caught that data because they didn't customize it.

They were using Kismet, so you're technically correct.

My point, however, remains. Kismet does not come standard, you have to purposely install it - usually to sniff another person's otherwise-private network traffic. If Google's sniffing had been deliberate, my point is that they would have been in the wrong for so doing. You seem to be adopting the position that no, that's perfectly alright, the citizenry had no reasonable expectation of a right to privacy there. That packet sniffing, as deliberate as it usually has to be, is just as easy to do and probably as someone glancing in your window. And that is wrong.

If Google itself had condoned it, there would be little difference between that and seeking to obtain Zero-Day exploits to commercial systems - with the exception that these are private individuals, not mere corporations.

And the fact that there was no security to actually exploit.

I think you missed my point there. I know this is Slashdot, but when I mentioned Zero-Days I was getting at legal exploits, not literal technological ones. Stuff without a lot of case precedent about it yet, such as intercepted wifi data, which Google - if they had done it deliberately, and happily this appears not to be the case - would have been able to take advantage of. In other words, using the fact that technology innovates faster than case precedent is established, to take advantage of people.

Re:There are rules, even unspoken

[SecurityGuy]

...packet sniffing, as deliberate as it usually has to be, is just as easy to do and probably as someone glancing in your window. And that is wrong.

How easy it is to do depends very much on who you are. My problem with things like this is it actually encourages bad security. If we go around telling people that it's ok to just demand the world turn around when they do the digital equivalent of walking down the street naked, are they really better off than if we tell them "Hey, there's this check box you can set on your router that makes it all but impossible for people to snoop on you. If you don't check it, ANYBODY who bothers to try will see everything you do."?

It's all well and good to have laws about this stuff. We COULD enact a law making sniffing unencrypted WiFi illegal. IMO, it's far far better to just encrypt the damn thing and be done with it than hope when someone does capture your traffic, that you'll find out. Realistically, unless it's a high profile case like this, you'll never know.

Re:There are rules, even unspoken

[sixtyeight]

Consider what you're saying. It's like condoning someone who breaks and enters into peoples' houses and goes reading through their papers and personal effects, and saying the problem is that they didn't have a secure enough vault in their home.

No, that's not remotely what I'm saying, and your Matthew Shepard comparison is wildly off base.

You're saying that the onus on people if they don't want others to take advantage of them is to hide all their vulnerable points. And I'm saying that's the sign of a lawless anarchy where people aren't presumed to have rights.

If you have unencrypted WiFi, you are broadcasting, quite literally, whatever you're doing. All I'm saying is if you're out in public, people can take your picture. You might not like it, but they can.

A very apt parallel. Under American Common Law, your likeness - as well as your signature - is your private property. People can no more snap you without your consent without being liable for violating your property rights than they can take an image of your signature and print it onto whatever they like. American Common Law remains in effect, but has been forgotten amid a heap of baseless legislation that lacks the authority to actually be law. People in the U.S. have forgotten their system, in favor of a johnny-come-lately. As one result, basic concepts and premises of law ("maxims") have been lost to them, and we get news stories in which some new situation brought about by new technology makes it all seem like an open question again. It's not.

If you yell at your wife on the front porch or in the house if you're loud enough, the neighbors can hear you.

And they now have lasers that can be pointed at windows and pick up conversations based on how the glass vibrates. The laser and the person using them are both located outside the house, so according to your reasoning it's perfectly fine as well. So, be sure to pick up some air pumps made for aquariums at the pet store and tape them to your windows, or it's your fault for being lax on the data security.

If my neighbors are installing surveillance equipment in order to overhear me shouting at my wife, and they couldn't overhear it any other way, they're not going to last as my neighbors for long.

I'm not saying you need to encrypt everything, or that you need a vault. I'm saying don't broadcast to the world if you don't want the world to hear you.

I'm very much pro-privacy, but if you want your privacy (as I do), you can't put the burden on the entire rest of the world to preserve it for you.

I'm typing this reply from my laptop, in a public location. As I type, there is cash in my wallet as we speak. Just sitting there. For anybody to pick up and take! Mind you, they'd need to have developed certain skills in order to do so. But they could do it! And it sounds like according to your reasoning, if they did it would be my fault because I expected the rest of the world not to deliberately attempt to pick my pocket. Whereas I'm more in favor of the traditional Middle Eastern response to people who are caught pickpocketing, in order to discourage it.

We railed against the DMCA because it criminalized circumventing even useless protection measures, but somehow when they're OUR useless protection measures, it's different? No, it's not.

Of course it's no different, if you're arguing the issue in the context they've handed you.

The actual difference is that before things like the DMCA, before a lot of this corrupt baseless legislation got passed, there were no victimless crimes in this country! You weren't hauled in before a magistrate and tried in a chancery court for offenses "against the state". You were brought to court when there was an injured party: you had either detrimented their right to life, liberty or propert

Re:There are rules, even unspoken

[LordLucless]

No, it was half-in, half-out. By that I mean it was being used in their homes, and "leaked" out because that's what airwaves do. Which isn't typically a big deal, since one hardly expects people to be sitting outside trying to pick it up.

Yes. In other words, you need to consider more than just the most common case. You also need to consider edge cases, and the potential damage versus the likelihood versus the difficulty to mitigate. In this case, the edge case is likely - anyone with a laptop could do it, and have been known to (see wardriving), the damage is potentially severe - especially if you do stupid stuff like sending sensitive data in the clear over email, and the difficulty to mitigate is trivial.

There's nothing technologically complicated about using a handgun either, and using one could certainly save you from a violent mugging.

No. However, securing your router doesn't inflict bodily harm on a human being, require special licensing, or open you to the possibility of charges arising from its use (yet). Are you sure you're not BadAnalogyGuy in drag? Having a gun is a complex piece of mitigation, involving training and licensing, and may not even be effective, as presence of a firearm might prevent, or it might provoke escalation. Better mitigation would simply be not to go to dangerous areas at night. Not foolproof, but it reduces the chances of occurrence down to the point where I've never been mugged in my life.

Whenever you leave your home, there is also a slight chance that it will rain no matter what the weather report says.

Which is why I keep an umbrella in the car.

You might get slammed by a car as you cross the street, therefore you should never leave the house without a pair of clean underwear on, in case you have an unanticipated ambulance ride to the hospital to worry about

And that's at a level of severity I really don't worry about. For various values of "clean" anyway.

And you might run into some tourists from Spain who don't speak English while you're out.

Again, level of severity is negligible. Why do I care if I can speak to the tourists or not?

Therefore, you should never leave the house without a loaded handgun, a large umbrella, a pair of clean underwear on, and a Spanish-to-English translation dictionary. Otherwise, it's your own damn fault.

Well, if you get caught in the rain without an umbrella, yes, it is your own damn fault. What do you want, the government to outlaw rain?

My point, however, remains. Kismet does not come standard, you have to purposely install it - usually to sniff another person's otherwise-private network traffic.

Your threshold for "modification" seems to be unrealistically low - considering that would mean my grandma's computer with Open Office on it would be considered "specially modified technology".

And a wireless router does not come standard either. You need to purposely install it, usually to transmit information. If you wish to restrict the information it transmits, it behoves you to configure it so it operates in a way that you see fit. If you do not have the time or the capacity to read a simple instruction manual, then you should hire someone who does. The 12 year old kid down the street charges reasonable rates I hear. If you don't understand the device you installed, nor had an informed person configure it for you, then yes, you were negligent and the fact that you didn't know that you were shouting your information for all to hear merely emphasizes that point.

You seem to be adopting the position that no, that's perfectly alright, the citizenry had no reasonable expectation of a right to privacy there. That packet sniffing, as deliberate as it usually has to be, is just as easy to do and probably as someone glancing in your window.

Re:There are rules, even unspoken

[LordLucless]

Why would we?

Re:There are rules, even unspoken

[sixtyeight]

...packet sniffing, as deliberate as it usually has to be, is just as easy to do and probably as someone glancing in your window. And that is wrong.

How easy it is to do depends very much on who you are. My problem with things like this is it actually encourages bad security. If we go around telling people that it's ok to just demand the world turn around when they do the digital equivalent of walking down the street naked, are they really better off than if we tell them "Hey, there's this check box you can set on your router that makes it all but impossible for people to snoop on you. If you don't check it, ANYBODY who bothers to try will see everything you do."?

I can appreciate that. It's a very noble sentiment, and I feel it myself.

What I have to keep in check, though, is that a desire to shape public policy - even in this case for something like technological education - does not enable myself or anyone else to remake the law in ways that violates someone's rights. The desire to reshape society for what often started out as noble goals as you've described, is now often misused when politicians play on emotions to gain public support for further erosion and inroads into the legal structure and the political assessment about what rights we have. Two hundred years of this stuff has caused the the average person to misremember the basis of the political and legal structure that prior generations of citizens had designed. And this is all to the temporary benefit of politicians in power. So I'm careful to keep my ideas of "what's right for people" from coloring my determinations about their rights, and must refer to what had originally been put in place. Common sense dictates that, legally, personal data is private and since you can't get at it without trying you have every reason to expect privacy.

We both know that's not true technologically, but from a legal standpoint it could work. There are any number of things which could be done technologically, that are against the law. Since the laws were designed to uphold rights, this should probably be one of them - and my understanding of American Common Law is that it probably already is. Common Law doesn't rely on a lot of legislation being passed, but on the operation of basic rights in a common sense manner.

It's all well and good to have laws about this stuff. We COULD enact a law making sniffing unencrypted WiFi illegal. IMO, it's far far better to just encrypt the damn thing and be done with it than hope when someone does capture your traffic, that you'll find out. Realistically, unless it's a high profile case like this, you'll never know.

You're talking about passing legislation specifically forbidding it. I think it probably makes sense, to deter people from packet sniffing personal data. Yes, from a technological standpoint people should probably be encrypting anyway. And if the cost-to-benefit ratio prompts them to do that, they will. The law, however, isn't supposed to tamper with the cost-to-benefit ratios of people who aren't violating the rights of others, just to prompt them into one choice or another. That would violate freedom as well, and today it happens frequently when politicians attempt to set public policies. They're not supposed to. The law is there to preserve rights, and by making a determination about whether rights to personal data privacy are guaranteed or not, the law would be doing its job.

I think it's already done this, but clarifying it would be good if there's public disagreement about that point.

Re:There are rules, even unspoken

[SecurityGuy]

Under American Common Law, your likeness - as well as your signature - is your private property. People can no more snap you without your consent without being liable for violating your property rights than they can take an image of your signature and print it onto whatever they like.

Cite, please. It's my understanding that if you're in public, people absolutely can take your picture and do not need your consent. If you're correct, I'd like an explanation how paparazzi aren't all in jail.

American Common Law remains in effect, but has been forgotten amid a heap of baseless legislation that lacks the authority to actually be law.

Perhaps we're getting to the core of the issue. You're arguing from a base where law isn't actually law. I can't follow you there.

And they now have lasers that can be pointed at windows and pick up conversations based on how the glass vibrates,

Yes, and infrared cameras that see through your walls. I suppose that's what muddies the waters. It comes down to the "reasonable person" test. IIRC, it's been decided (in court) that reasonable people do get protection from being spied on via IR cameras. I think it's reasonable to assume there's not a laser microphone pointed at your windows, too. I just don't feel that unencrypted wifi streaming out of your house deserves the same protection when it's trivial to encrypt it. I don't think we should have to IR shield our houses. I don't think we should have noise generators on our windows. I do think we should encrypt our wifi.

I understand your point. And if the data on those papers requires certain software to read and decode, that is a form of encryption

No, it's a form of encoding. If you're going to claim that as encryption, I can as reasonably claim that this is a private conversation between me and you, and that anyone else reading it has violated my rights because I encrypted it in ASCII or Unicode, or whatever prior to uploading it. It's not MY fault everyone else's computer is capable of decrypting it.

Re:There are rules, even unspoken

[sixtyeight]

No, it was half-in, half-out. By that I mean it was being used in their homes, and "leaked" out because that's what airwaves do. Which isn't typically a big deal, since one hardly expects people to be sitting outside trying to pick it up.

Yes. In other words, you need to consider more than just the most common case. You also need to consider edge cases, and the potential damage versus the likelihood versus the difficulty to mitigate. In this case, the edge case is likely - anyone with a laptop could do it, and have been known to (see wardriving), the damage is potentially severe - especially if you do stupid stuff like sending sensitive data in the clear over email, and the difficulty to mitigate is trivial.

No. You're discussing technological feasibility - and how complex it would be to implement, as well as risk-reward ratios. Which completely fails to address the matter in terms of rights in law. You do this several times throughout your response.

There's nothing technologically complicated about using a handgun either, and using one could certainly save you from a violent mugging.

No. However, securing your router doesn't inflict bodily harm on a human being, require special licensing, or open you to the possibility of charges arising from its use (yet). Are you sure you're not BadAnalogyGuy in drag? Having a gun is a complex piece of mitigation, involving training and licensing, and may not even be effective, as presence of a firearm might prevent, or it might provoke escalation. Better mitigation would simply be not to go to dangerous areas at night. Not foolproof, but it reduces the chances of occurrence down to the point where I've never been mugged in my life.

...such as here...

Whenever you leave your home, there is also a slight chance that it will rain no matter what the weather report says.

Which is why I keep an umbrella in the car.

You might get slammed by a car as you cross the street, therefore you should never leave the house without a pair of clean underwear on, in case you have an unanticipated ambulance ride to the hospital to worry about

And that's at a level of severity I really don't worry about. For various values of "clean" anyway.

And you might run into some tourists from Spain who don't speak English while you're out.

Again, level of severity is negligible. Why do I care if I can speak to the tourists or not?

Therefore, you should never leave the house without a loaded handgun, a large umbrella, a pair of clean underwear on, and a Spanish-to-English translation dictionary. Otherwise, it's your own damn fault.

Well, if you get caught in the rain without an umbrella, yes, it is your own damn fault. What do you want, the government to outlaw rain?

No. I'm demonstrating the impracticality of having a government refuse to acknowledge your rights, and leave you to fend for yourself in every eventuality.

My point, however, remains. Kismet does not come standard, you have to purposely install it - usually to sniff another person's otherwise-private network traffic.

Your threshold for "modification" seems to be unrealistically low - considering that would mean my grandma's computer with Open Office on it would be considered "specially modified technology".

If your grandmother can pick up my wifi data with Open Office, please do arrange a meeting with her for me.

Part of my point was that someone would have to modify the technology or use the software in order to pick up someone else's personal wifi data, thus legally establishing intent. If you demonstrate intent to nab someone's papers, or in this case wifi data, you've demonstrated an intent to violate t

Re:There are rules, even unspoken

[sixtyeight]

Under American Common Law, your likeness - as well as your signature - is your private property. People can no more snap you without your consent without being liable for violating your property rights than they can take an image of your signature and print it onto whatever they like.

Cite, please. It's my understanding that if you're in public, people absolutely can take your picture and do not need your consent. If you're correct, I'd like an explanation how paparazzi aren't all in jail.

Common practice within the Union about a century ago; I came across it years ago in research and no longer have the historical reference, unfortunately. I did find cites just now, though.

As to the paparazzi, part of it would most likely be that the country's forgotten that by now, or that as public figures celebrities are presumed to be accessible in that regard. I'm honestly not sure how much of which. It would be kind of interesting for celebs to copyright their likeness in this day and age though, and then sue tabloids for distributing without permission.

American Common Law remains in effect, but has been forgotten amid a heap of baseless legislation that lacks the authority to actually be law.

Perhaps we're getting to the core of the issue. You're arguing from a base where law isn't actually law. I can't follow you there.

Yes and no. It's the venue of law the Constitution was written in, and the American variant of Common Law remains the law of the land. However, it is prevalently ignored today by the majority of citizens, who have not heard of it. Yet.

And they now have lasers that can be pointed at windows and pick up conversations based on how the glass vibrates,

Yes, and infrared cameras that see through your walls. I suppose that's what muddies the waters. It comes down to the "reasonable person" test. IIRC, it's been decided (in court) that reasonable people do get protection from being spied on via IR cameras. I think it's reasonable to assume there's not a laser microphone pointed at your windows, too. I just don't feel that unencrypted wifi streaming out of your house deserves the same protection when it's trivial to encrypt it. I don't think we should have to IR shield our houses. I don't think we should have noise generators on our windows. I do think we should encrypt our wifi.

And there we disagree. Or rather, I don't think we should be considered to be obliged to encrypt our wifi in order to secure our right to privacy on it. But I do like how well you've summarized the matter.

I understand your point. And if the data on those papers requires certain software to read and decode, that is a form of encryption

No, it's a form of encoding. If you're going to claim that as encryption, I can as reasonably claim that this is a private conversation between me and you, and that anyone else reading it has violated my rights because I encrypted it in ASCII or Unicode, or whatever prior to uploading it. It's not MY fault everyone else's computer is capable of decrypting it.

Impressive! I honestly don't have a response to that one right now. I'll have to think about that one for a while. Thanks for the new (to me at least) point. Very refreshing to encounter.

Re:There are rules, even unspoken

[LordLucless]

No. You're discussing technological feasibility - and how complex it would be to implement, as well as risk-reward ratios. Which completely fails to address the matter in terms of rights in law.

You're discussing "adding" a new right. That is, that people have the right to broadcast their information and demand that people not read it. This is not currently a right, as TFA states. You are looking to expand government protection into a new area. I'm providing reasons why that protection is unnecessary. Those reasons are technical, and risk related, as well as moral - that is, making individuals take responsibility for their own dissemination of their data.

If your grandmother can pick up my wifi data with Open Office, please do arrange a meeting with her for me

Hell, my grandma can do that with a base install of windows, if you don't secure your wi-fi.

True, but irrelevant. We're not discussing how using wifi routers violates someone else's rights.

Yes, you are. You're discussing how to restrict my right to access information that a wi-fi router transmits into public space.

If you demonstrate intent to nab someone's papers, or in this case wifi data, you've demonstrated an intent to violate their rights and act on it.

And my point was that by installing a router and configuring it to broadcast unencrypted data, you've demonstrated an intent to share that data.

Another dodge. You maintain that in using open wifi routers, one has relinquished any right to expectations of privacy. And that is bunk.

Why is that bunk? In using a public park, you relinquish any expectations of privacy. In using public transport, you relinquish any expectation of privacy. The very definition of public is that is distinct from private.

Yet you neglect that the same argument would be absurd for either, which was my point.

No, you were making a ridiculous analogy between two things that are not analogous.

At this point, you're visibly sabotaging the conversation.

No, I'm mocking you. I'm doing so in an attempt to dissuade you from making ridiculous and emotionality-laden comparisons to mass butchery any more.

Re:There are rules, even unspoken

[sixtyeight]

No, it's a form of encoding. If you're going to claim that as encryption, I can as reasonably claim that this is a private conversation between me and you, and that anyone else reading it has violated my rights because I encrypted it in ASCII or Unicode, or whatever prior to uploading it. It's not MY fault everyone else's computer is capable of decrypting it.

I think the distinction there would probably have to be intent, and basis.

By intent, I mean that there's a difference between engaging in a forum discussion, and deliberately attempting to intercept someone's comm traffic via their wifi signals. That's a close enough approximation to the guaranteed Fourth Amendment right of citizens to be secure in their papers (whether those papers are in the home, out outside of it) for me to equate them. Others may interpret that differently.

When I say basis, I mean that Google for example is a corporation with a stated basis of operation. While it's true that a lot of what I post could be searched for around the internet and compiled in a central database (Facebook does it), nothing authorizes Facebook to monitor citizens by doing this. They work for the Information Awareness Office, which compiles that information on citizens for the federal government's uses. Again, nothing authorizes the federal government to do that to its citizens, so there's a problem of it not being within its stated basis. Here, Google appeared to do it unintentionally and that would be a little different.

To intentionally violate someone's rights, there obviously must be intent and it must be acted upon. This is a distinction made in law, and it's a different way to distill the situation than the technological basis that most of the rest of Slashdot is using for this discussion. Still, I think it has the ability to get to the nitty-gritty about what expectations we have or don't have with other parties better than the technological perspective, without getting into direct morality which can rapidly get pretty nebulous indeed.

Re:There are rules, even unspoken

[jaymemaurice]

Making sniffing of wifi illegal is a complete lack of understanding on how the technology works. It is unlicensed spectrum and any bit pattern your wireless device emits will be recieved by every reciever on the same band. At what level is "sniffing" sniffing?!

I suspect that this case will follow the same path as using a scanner to tape and record radio conversations... an act in itself which is not illegal.

Re:There are rules, even unspoken

[Anonymous Coward]

I think that there is a major difference between bumping into occasional pieces of paper in the street that someone dropped, and happening to notice their contents, and going around and systematically scrubbing the neighborhood for everything you can learn about every household. The application of induction does not work well for privacy issues: ("if an isolated incident is OK, then systematic and pervasive acts of the same kind are OK"). Taking occasional photos that include me when I am in public, OK; taking video of me, not OK. Being behind me in line in a store and seeing what I place on the checkout, OK. Following me into every shop and writing down what I look at and buy, not OK.

Differences of degree and intent really are applicable here.

Re:There are rules, even unspoken

[sixtyeight]

At this point, you're visibly sabotaging the conversation.

No, I'm mocking you. I'm doing so in an attempt to dissuade you from making ridiculous and emotionality-laden comparisons to mass butchery any more.

You've done all three in this instance, and so you will only have dialogues with people who tolerate that. Ta.

Re:There are rules, even unspoken

[jaymemaurice]

You do realize every wifi radio recieves every bit on the same frequency of every in range device regardless of if it is encrypted or on the same SSID. The fact that it's not presented to YOU is because some engineer decided it was irrelivant is a symantec. If you send it, every device on the same frequency recieves it. If it does anything with your pattern of bits is up to the device. This is physics.

The fact that the bits you transmitted form a discernable pattern using known standard which has personal importance to you is no reason that you should expect such data to be private... I mean it's not like they tuned their recievers to a frequency you are of some expectation to have rights over. Their recievers (however they are programmed to recieve) have equal right to the band your wifi is transmitting on.

Re:There are rules, even unspoken

[Anonymous Coward]

Sorry, this is really a non issue for me. Google went around and recorded what people shouted from their rooftops.

There, fixed that for you.

Re:There are rules, even unspoken

[LordLucless]

And I'll only have dialogues with people who don't think that requiring people to secure their router is equivalent to allowing murder gangs to roam the streets unopposed. From we're I sit, it's all plus.

Re:There are rules, even unspoken

[gnasher719]

If you had a laptop with you, you probably did.

Your laptop will immediately discard any data from an unsecured and unencrypted network that it is not connected to.

Re:There are rules, even unspoken

[LordLucless]

If my eyes see two ugly people having sex, believe me, they're going to be discarding hell for leather too.

Re:There are rules, even unspoken

[squiggleslash]

Look, I think you're missing the point.

What Google did was evil, plain and simple. Innocent people who were just using their Airports to connect together their Apple iPads were spied upon.. And they snooped on high quality businesses, the type that know that Oracle is the number one choice for high quality database management system.

Google harvested this information from innocent people, quite obviously, so that at some point in the future, Google's plan to sell human beings to advertisers as slaves could take place.

That's what we're talking about here. People with the number one tablet in the world, who are normally protected by its superior security model thanks to Apple's revolutionary App Store, being snooped on by a bunch of slave traders. Businesses, high quality businesses running high quality Oracle software, being spied upon.

There is nothing right here. In my view, Google should IMMEDIATELY be broken up. Android phone users should be rounded up and required to purchase one iPhone for every year they've possessed an Android phone. There is no lesser punishment that would be as deserving.

Thank you for reading this post. Also: iPad iPad iPad.

Re:There are rules, even unspoken

[squiggleslash]

You're saying that the onus on people if they don't want others to take advantage of them is to hide all their vulnerable points. And I'm saying that's the sign of a lawless anarchy where people aren't presumed to have rights.

Perhaps we need a sense of proportion in this discussion, because the above doesn't make sense either. Google didn't "take advantage of" anyone, not even in the version where Eric Schmidt himself was evilly rubbing his hands together and saying "Do it! RECORD EVERYTHING YOU CAN! HAHAHAHAHA!"

What Google did was record a lot of data. That data was destroyed when they found it wasn't what was needed for the mapping project Google ran. There is no suggestion that Google, at any point, intended to publish the data, or use it to harass anyone, or in any other way abuse the overload of information they added.

Now, you talk about rights. What rights are we talking about? The right to have privacy, or the right not to have data you're transmitting - deliberately or otherwise - recorded temporarily by a non-sentient device?

I say this because the two are not the same. The latter is not an abuse of privacy unless that information is actually published to one or more sentient beings in a way those sentient beings can interpret and process.

When we get all hot and bothered about electronic devices recording things, it's usually because we're concerned that they are going to be actively used to violate an individual's privacy. But that's not the case here. What people are getting upset about is the electronic side without the actual betrayal of privacy at the end of the process.

I understand it. But in the great scheme of things, recording information from people who appear not to be concerned about their privacy, temporarily, in a way that will never be published and probably never even be seen internally, strikes me as pretty inconsequential.

Re:There are rules, even unspoken

[Anonymous Coward]

I reiterate what I said in the other thread, life activity imply public presence, and nothing prevents other people to take note. This is NOT what google does. Google collects information.
One thing is saying hi to the neighbour you see getting out his door.
One thing is logging the time all the neighbourhood went out their door and put that into a database. It's for targeted ads is as lame an excuse as national security is for a dictatorship.

Re:There are rules, even unspoken

[sixtyeight]

The distinction is pretty important, and so long as it's not used as an argument to diminish rights it makes quite a bit of sense.

I agree that in a case of accidental nonsentient monitoring that isn't accessed, it's pretty inconsequential.

The natural concern is of course intentional, systematic monitoring, sentient or otherwise, that is or can be accessed effectively. And carefully evaluating who collected that data in the first place, and whether their motives for so doing were even valid and fair, is just a sensible part of data security approached from a societal, rather than a technological, means. Limiting the cases in which collecting the data in the first place is considered socially acceptable is a good place to begin in terms of limiting data loss.

This is because the difficulty occurs when personal data becomes retained by outside parties, because at that point it's pretty difficult for the original owner to establish with any certainty whether that data is accessible or not.

Case in point, when several of the CIA's laptops went missing a few years ago. They were concerned about the data when the laptops went missing, despite the fact that the information was almost certainly encrypted. It's a natural concern, when confidential data is retained by outside parties beyond the control and oversight of the initiating party. The CIA didn't stop to assess whether or not they supposed it could or would be successfully accessed before finding the incident a cause for concern; the mere possibility that it now could be, and they would have no way of knowing either way, was the problem.

There is very often a double-standard in evaluation that people make now, depending on whether the potentially damaged party is (a) a private citizen, or (2) a government agency or corporation. Somehow, there is typically a strong implied bias in the private citizen's disfavor there, and that should probably be noticed and assessed. The standard mentality seems to be that Joe Sixpack was negligent or mentally lacking for not better encrypting his data, and we're cautious to ask ourselves who it's really hurting anyway, but that if it happens to government agencies or corporations it's automatically considered a cause for concern because it represents a threat to state or trade secrets. And there is a disconcerting and counterintuitive propensity for that kind of thinking.

Re:There are rules, even unspoken

[Anonymous Coward]

Regarding your laser-pointer to window:

This is an active probing, and requires some form of active signal to be beamed from the recorder to the target, crossing over into private property. This (if it isn't) should be illegal, as it's tantamount to personally trespassing.

GSV cars did *NOT* have to even come close to touching the persons house. It may have sent out a "is anyone here?" type signal to trigger wifi access points to respond; this is, however, normal practice for any device with wifi (akin to someone knocking on your door).

To me, any time anyone broadcasts a signal using an antenna, it is their responsibility to make sure that there is reasonable protection on it. It's not illegal for you to submit credit card information to a website without HTTPS; it's up to the user to "guarantee" safety by looking for the HTTPS/padlock icon.

I hate it when I'm right.

[Tastecicles]

^^

Re:I hate it when I'm right.

[Anonymous Coward]

*golf clap*

Re:I hate it when I'm right.

[Anonymous Coward]

*golf clap*

Better than the std variety.

Re:Motto??

[Darkness404]

I'm not really sure whats so "evil" about this. Google was simply doing what anyone else could with a computer running Wireshark could do. This would be evil if Google:

1) Collaborated with the government to alert the government about potential "illegal" activities being conducted

Or

2) Made attempts to crack wi-fi encryption

What does it matter now?

[Dyinobal]

What does this matter now at all? CISPA is going to get passed into law at this point. I could care less about Google being a bit sleazy with regards to user privacy at this point.

Re:What does it matter now?

[artor3]

Even leaving aside Obama's veto threat, the bill was voted against by 75% of the Democrats in the House. If it gets a similar percentage in the Senate, they can filibuster it without any GOP crossovers.

Your fatalism isn't doing anyone any good. Actually, that's not true, I'm sure the Republicans love it. When was the last time you called your congresscritters?

Re:What does it matter now?

[b4dc0d3r]

Why, I called them "Bastards" just this week. I call them something or other once a day and twice on Sunday.

By the time they read their mail, however, their lobbyist already got to them in person, and convinced them to vote the other way. And the vote happened.

I usually get a mail 4-6 weeks later explaining why their vote was the only option, in vagueries best left to poets and politicians.

Re:What does it matter now?

[ukemike]

Even leaving aside Obama's veto threat,

Obama threatened to veto the NDAA. It had the effect of calming the growing protest storm against the act. "No worries, Obama will save us. We can relax." When in fact his staff was negotiating the nastier more offensive version that he eventually signed.

Don't trust him. He falls somewhere between Reagan and Bush1 on the political spectrum and gets called a socialist for being so far to the left of the Republi-fascist party. Our country has gone mad.

Re:What does it matter now?

[Anonymous Coward]

Google is a Government/International organizational front company. They are part of the NSA spy network.

This is shocking... not

[Anonymous Coward]

Apple gets most of its money from hardware.

Microsoft gets most of its money from software licenses.

Amazon gets most of its money from people buying books and other stuff online.

Where does Google get most of its money from, to pay the salaries of over 30,000 employees as well as campuses around the world, data centers stocked with hundreds of thousands of servers, etc. It sells ads and search placement, yes, but that's not going to be enough unless it stays on top of the game of knowing how ads and search hits can be targeted to the right consumer at the right time. In other words, it needs to continually find new ways to invade the privacy of people who use its services for free.

Re:This is shocking... not

[Anonymous Coward]

The engineer used existing software that happened to grab and then keep all traffic instead of only the bit that they needed. They discussed it internally and decided to fix it... sometime.

Yes, they should have thought it through more, and not fixing it was lazy and thoughtless, but at the same time.... If you haven't done something similar then you aren't doing enough.

My reaction: meh. Any data you transmit over an unencrypted WiFi connection is available for anyone to gather so long as it's done passively. I can understand the concerns of a major data company like Google having access to this information but the solution is quite simple. Stop using unencrypted WiFi!

Here's the thing: almost all of the privacy violations that people actually reference in the articles about this issue are data (e-mails, login passwords, URL's, etc.) that are already being transmitted to ISP's (where ironically, there has been a lot of discussion about them being required to archive this data). ISP's have a far less fragmented and transient view of the data than a Google Street Car, and they know precisely where their customers live. The only possible privacy violation here is with data exchanged between systems within the LAN of the home, which is a very different kind of information, is generally not that useful when viewed as a few isolated packets, and which requires a degree of technical sophistication such that you'd really think the same people doing it would also know to encrypt their wireless networks, even if only with something as lame as WEP.

Re:Motto??

[Tastecicles]

Evil is a point of view.

  - Lestat

"Ohhh, I love to dance a little side-step..."

[X!0mbarg]

Looks like Google is trying the old "Teflon Soft-shoe" in an attempt to avoid charges, fines, and other 'business costs' associated with such snooping.
Glad to see the Engineer they blamed didn't just roll over and play dead on this, or it would have been Quite Bad in the long run.

So, where does that leave "War-Drivers" who specifically snoop out WiFi?

Re:"Ohhh, I love to dance a little side-step..."

[Tastecicles]

in the UK at least, they're already criminals (section 1 of the Computer Misuse Act 1990 makes it an offence to gather any data howsoever if unauthorised).

Re:"Ohhh, I love to dance a little side-step..."

[Anonymous Coward]

I have EMF sensitivity. I rock back and forward in the shower mumbling your SSID you insensitive clod!

Re:"Ohhh, I love to dance a little side-step..."

[Tastecicles]

I read "EMF" and started humming "Unbelievable". Bastard.

Re:"Ohhh, I love to dance a little side-step..."

[Anonymous Coward]

Whoa!

Re:"Ohhh, I love to dance a little side-step..."

[stephanruby]

in the UK at least, they're already criminals (section 1 of the Computer Misuse Act 1990 makes it an offence to gather any data howsoever if unauthorised).

So if I post a blog in the UK for everyone to see, but I don't explicitly authorize anyone to view it (the authorization is just implicit), then the Googlebot would be committing a crime by going through it and indexing it? Is that what you're saying?

Re:"Ohhh, I love to dance a little side-step..."

[Anonymous Coward]

No because when English law is idiotic (which it is) it isn't generally due to that kind of insane literalism. You put a blog online, you've published it. Any communication on an internal network requires authorisation to view. It also might fall foul of the RIPA; as an LEO I know that if I end up with someone's mobile phone I have to switch it off ASAP in case a text arrives. If one does and I see the preview I'm deemed to have intercepted it without a warrant which is obviously a big, big problem.

Re:"Ohhh, I love to dance a little side-step..."

[Anonymous Coward]

That law was superseded by the Data Protection Act of 1998. Also the UK government found nothing to charge Google with, so no they are not criminals. http://www.computerworld.com/s/article/9194619/UK_Google_Wi_Fi_collection_violated_data_protection_laws

Re:"Ohhh, I love to dance a little side-step..."

[gnasher719]

So if I post a blog in the UK for everyone to see, but I don't explicitly authorize anyone to view it (the authorization is just implicit), then the Googlebot would be committing a crime by going through it and indexing it? Is that what you're saying?

Implicit authorisation = authorisation. No authorisation = no authorisation. Simple, isn't it? You have authorisation to read this post. You have no authorisation to record this post being sent wirelessly from my computer to my router, or being transmitted from my router to my ISP, and so on.

Re:What people figured all along

[icebike]

It confirms no such thing. In fact the entire summary is out of touch with what was in the FCC report.
The entire thing is on line, you can read it for yourself. The FCC dropped the whole thing because there is no clear evidence that google violated any law.

GO READ THE FCC REPORT YOURSELF
instead of relying on a biased hack at the NYT to put their own spin on it.

There was never any intent do use this data, it was merely one engineer's pipe dream to do so.
And the fact that he MUCH LATER circulated memos that stated he was capturing freely available encrypted traffic to 7 people
does not mean they were actually aware of precisely what that meant.

Re:Bleedin Obvious

[cheater512]

Wifi signals can be captured from space? That would be awesome for the guys on the ISS.
If they wanted to read Slashdot they could just hop on one of the undoubtedly tens of thousands of unencrypted wifis below them at any given moment.

Mind you I can't get a connection from the road let alone 1km away.

Who the hell cares?

[elbonia]

Let's sum up the whole thing, "Google had not violated any laws". That's straight from the article and the FCC investigation report. Not one single law was broken, PERIOD. So how is this news? If the NYT really wants to do news about privacy rights why doesn't it put the bullshit CISPA on the front page instead of ignoring it.

Re:Who the hell cares?

[tapspace]

Let's sum up the whole thing, "Google had not violated any laws". That's straight from the article and the FCC investigation report. Not one single law was broken, PERIOD. So how is this news? If the NYT really wants to do news about privacy rights why doesn't it put the bullshit CISPA on the front page instead of ignoring it.

I find your attitude dangerous. We wouldn't have a concept of ethics if our laws made all corporations perfect citizens. We need outrage when companies act so blatantly unethical. It hurts me, because I don't want to live in the world we're building. This behavior was completely unacceptable, and the fact that this is currently the highest rated comment on Slashdot, of all places, means I might be a small minority. That scares the shit out of me.

Re:Who the hell cares?

[Anonymous Coward]

What, exactly, is wrong with receiving public broadcasts? Yes, they're public, unencrypted broadcasts in a shared band.

Re:Who the hell cares?

[Anonymous Coward]

As long as the law isn't broken, nobody should care about ethical issues? That's ridiculous.

It's news when big companies lie about their mistakes. This is about trust. Google wants you to trust them with your personal data, so this is a very relevant story.

Re:Who the hell cares?

[Overly Critical Guy]

Slashdotters may not care, but I guarantee your average computer user will care, and that's why it's news. People don't like it when companies drive vans around their neighborhoods collecting their passwords and such. It's a violation of trust and an issue of questionable ethics. Either Google is bad for approving of it, or they're bad for having such poor management structure and clueless engineering that they don't even notice it going on for two years.

To quote Mike Daisey: "Do you really think they didn't know?"

Replace Google with some popular foe. If Microsoft had done it, then would you care? What if it had been Facebook or Sony? Probably, you'd be ranting about the fact that a corporation can get away with a measly fine for something that would likely land you in jail for "hacking".

Re:Who the hell cares?

[bdabautcb]

You could, but what your saying would be illegal. There is a difference. I also just realized I am responding to bonch, so this post is worthless.

Re:Who the hell cares?

[Quince alPillan]

If you don't want your email and password to be harvested by anyone with a computer and a little bit of knowledge, then I suggest not putting your password out in plain text over an open wifi connection where it can be seen from the street, in public.

It's a bit like writing your password and email address in lemon juice on a sign in your front yard and then getting indignant when someone knows to read it when it's hot outside.

I don't know why people seem to be so paranoid that Google is some nefarious organization unless they have an agenda to push. They weren't specifically trying to gather email and passwords - they were trying to use the data (read: mac and IP addresses) to make the maps better.

Re:Who the hell cares?

[Anonymous Coward]

Window = WEP. Defeat it and you break the law.

Re:Who the hell cares?

[elbonia]

When I buy equipment whose purpose is to broadcast I cannot blame someone for listening. In the case of the window I am taking steps to make sure no one listens in and you are going out of your way with explicit equipment to override my intention. This violates a key tenant of the law, http://en.wikipedia.org/wiki/Expectation_of_privacy. A more accurate one would be this: You are outside outside on a public street and see that my wifi name is foobar. Do you really think I have the legal right to now ask for your arrest for violating my privacy.

Re:Who the hell cares?

[Anonymous Coward]

What did they do that's unethical? Explain it it detail rather than just making a statement with no supporting facts.

Re:Who the hell cares?

[Anonymous Coward]

Actually they did break laws in other countries. Many countries do not allow you to collect a persons private data even if they are morons when it comes to adequately protecting it. The mere act of accessing it is a violation.

Re:Who the hell cares?

[squiggleslash]

Honestly, if this was any other company, there would be more outrage in the comments.

No, there wouldn't. It's a non-issue. Google didn't spend all day installing a sensitive microphone to pick up the conversations of Mrs Edith Rosebud, 1298 Willoughby Avenue, New Hicksville, NC 65536. Instead a few Wifi packets were recorded by software that was actually trawling for MAC addresses, as a ugly-ass Google branded SUV drove up a street.

The funny thing is that actually what Google published from that SUV was far more likely to breach people's privacy, and that's NOT what we're talking about. Google's SUV is covered in cameras, and was taking pictures. If you were unfortunate enough to have a hole in your optical security - say, a window that can be seen into from the part of the street the SUV was driving through when it took the photo - your information is now published for the world to see.

The information Google collected that it could reasonably expect people to think was private never got seen by human beings. The other information - published for the world to see. On Slashdot, a den of supposedly tech savvy nerds, only Slashdot's anti-Google element, and Apple/Oracle shills, could possibly consider this a major scandal.

Re:Who the hell cares?

[Anonymous Coward]

Cool. I'm going to use a long range microphone to listen in on your personal conversations and put them up on the internet. Why are you broadcasting sounds when you don't want people to hear it?

Re:Who the hell cares?

[Anonymous Coward]

Except Google had plain old ears, not a long range microphone. And he didn't listen in on personal conversations, but on everything going around non-selectively. "So you say it's okay to slap mosquitos? Then you think it's okay for me to come over to your house and knife you in the butt!"

Re:Who the hell cares?

[Anonymous Coward]

The only thing that matters is what you do. Outrage isn't "doing" anything. Your rage is useless.

Re:Who the hell cares?

[psydeshow]

Let's sum up the whole thing, "Google had not violated any laws". That's straight from the article and the FCC investigation report. Not one single law was broken, PERIOD. So how is this news? If the NYT really wants to do news about privacy rights why doesn't it put the bullshit CISPA on the front page instead of ignoring it.

To be fair, the report accuses Google of potentially violating the Wiretap Act, but because Engineer Doe won't incriminate him- or herself there is no way to prove it.

Re:What people figured all along

[elbonia]

Probably never... he just read the report. Give reading a try, you might find that you like it.

Re:What people figured all along

[oakgrove]

So, telling the truth is shilling now? Take off the tin-foil nutball.

Re:What people figured all along

[icebike]

Full underacted text (other than the name of Engineer Doe, is available here.

It was clearly a tiny project that got little oversight, and less review. For the NYT to say it was "approved" is quite beyond the facts. Collecting wifi access point locations was approved. But Engineer Doe went off the reservation and did way more than that.

Re:What people figured all along

[Nerdfest]

I keep reading these accusations and assumptions and almost all of them seem to ignore that the open source software (Kismet?) that they used to grab data logs it all as a default, or at least that's what I've read. Is there even an option to strip the non identifying information out? (I'm actually asking, I don't know this package).

Cool Story

[Anonymous Coward]

Windows does this every time you open up your wireless network viewer. Capturing packets that were freely broadcast through the air for anyone to capture, whoopty-do, I'll keep using google.

Re:Cool Story

[Anonymous Coward]

Wow, really? Windows network viewer stores and indexes people's passwords and mail?

Windows network viewer, the ultimate hacker's tool. Who knew?

That still remains to be seen... apk

[Anonymous Coward]

See subject-line above: All I know, is what the 1st line of this tune states on this account (CISPA) & others like it -> http://www.youtube.com/watch?v=vfpgpf6QVnI&ob=av2n

* "You take a mortal man, & put him in control..."

(I hope President Obama has the "intestinal fortitude" to shut this CISPA thing down via VETO is all)

I mean, since it's much like many bills lately BEFORE it? It's got a LOT of "hidden in plain sight" b.s. packed into it...

(The REAL parts they want "in motion" are those... shows me 1 thing - the "powers-that-be" are reacting, & the only way they know how (more CONTROL))

APK

P.S.=> QUESTION: Is it ME, or is the world going a bit "nuts" lately around us? See - I've lived nearly 1/2 a century now, & have NEVER seen things as "out-of-kilter" on a hell of a lot of fronts as I have this past 1++ yr. now - makes me wonder, & worry (not so much for right now, but around December more than anything)... apk

Re:What people figured all along

[icebike]

Yes, he could have set a flag and not gathered any payload, just beacons and mac addresses. But Engineer Doe decided not to do this.

Kismet does not capture packet payloads when the encrypted flag is set on. There is a switch to turn off all payload capture.
Further, any SSL sessions would be captured in their encrypted state even when the router was un-encrypted. Nothing was able to
be gleaned in that data either. No bank passwords.

That they got any email addresses or content is amazing. I suppose a lot of people were using pop 3 in those days.

On the list of the 10 most popular target URLs that were able be extracted in a test run in Arizona was some Weather-Bug server.

Its Kismet.

[Anonymous Coward]

For those who don't know, the unmentioned program is Kismet So what if Google engineers knew about its capabilities to write pcap files? It's not an overwhelming amount of data for each Google car when compared to everything else it's collecting, and I wouldn't be surprised if it was simply left on, since I belive that's how kismet comes out of the box. The big point is Kismet also plots access point data in easily parsable formats along with signal strength, geographical coordinances, clients connected, other computers probing for certain networks unlike anything else out there so the choice for this software for wifi location collection was, without question the smartest choice. Its method of gathering data is instead of actively probing networks that respond (like Netstumbler) it instead listens silently in rfmon, or "monitor mode", and hops channels, decodes everything from layer 2, similar in principle to how a conventional radio scanner works. It can be configured to discard the pcap data, but privacy issues aside, when you're embarking on such a massively large and expensive project, I think it would suck if you later on really wished you had collected that data, especially if you find bugs and the program crashes in mysterious ways?

Re:Its Kismet.

[tftp]

It's not an overwhelming amount of data for each Google car when compared to everything else it's collecting, and I wouldn't be surprised if it was simply left on

If I were in charge of outfitting StreetView cars, I'd load them with everything I could possibly lay my hands on. It costs a lot of money to send a car on a route. So if the car is going it should capture everything that is capturable - as long as that is legal and hopefully ethical.

With this payload capture Google broke law in some countries and broke ethical norms everywhere. This is my own opinion, but that's all I need to stop using Google. My account there hasn't seen a login for at least a year.

Re:Its Kismet.

[Anonymous Coward]

With this payload capture Google broke law in some countries and broke ethical norms everywhere

Correct, but this is focusing on the United States specifically. What they are trying to say is that wardriving is illegal, which it isn't. It's not much different than sites like RadioReference that capture and archive radio communication.

Re:Its Kismet.

[tftp]

Yes. But, generally speaking, legality of such a thing is not a constant. As an example, it is illegal to walk up to a house at night and look into the window. However is it illegal to do the same using a powerful telescope, from a mile away? Is it illegal to do from 10 miles away? At what point does the viewing become legal? After all, the people inside the house brazenly "broadcast" their actions by means of light waves, a familiar defense of Google.

The law, as written, does not prohibit wardriving, and it does not prohibit collection of data that you can receive. I don't know if the law needs to be changed; probably not - we have too many laws already, and each new law has three new loopholes that are asking for more laws.

But it is obvious that you aren't supposed to be capturing someone else's WiFi data, especially if that data contains private information. If a polite person finds himself within an earshot of a clearly private conversation he will move away or make his presence known. Google not only hasn't done that; they intentionally recorded everything that they heard. To me it indicates that everyone who was involved with that decision has no moral checks and balances. All too common these days, unfortunately. Demise of God removed the last restraint from human minds, and not everyone chooses to use the newly found freedom wisely.

Re:Its Kismet.

[detritus.]

Yes. But, generally speaking, legality of such a thing is not a constant. As an example, it is illegal to walk up to a house at night and look into the window. However is it illegal to do the same using a powerful telescope, from a mile away? Is it illegal to do from 10 miles away? At what point does the viewing become legal?

You're implying they intended to eavesdrop. If they stayed motionless in an area for the express purpose of collecting data on the ground with the intent to collect information, then you have a point. Remember, these cars were always in motion snapping pictures. They were simply driving by and only heard small fractions of an overall conversation, and only on open access points with no security, without any facilitation of layer 6 or 7 encryption. It was a small minority of the overall traffic collected and only applied in certain circumstances and being at the right place at the right second. If they were collecting WiFi data from say, a blimp with a directional antenna then the eavesdropping range is increased exponentially and I can see your point. We're talking about stuff likely 50 feet away at best. Wifi radios in computers do not go very far, and only use as much power as needed to maintain a steady signal.

But it is obvious that you aren't supposed to be capturing someone else's WiFi data, especially if that data contains private information.

The whole premise of wardriving *is* capturing someone else's WiFi data and the entire design of Kismet relies on this, because it's the most efficient way to do it.

If I turn on my FRS or CB radio and can hear a conversation in plain english between other individuals in the vicinity, it's legal and ethical. In fact, I can even record it. Public wifi networks are no different - we've had warnings and dialogs on most OS'es for years indicating whether they are connecting to a non-encrypted and non-secure network.

If I turn on my wifi radio and can hear an unencrypted conversation with data flowing in plain text between two computers on the same network, it's now unethical?
This is 2.4ghz ISM, it's fully legal and open to the public. This isn't some off-limits network communication like cellular frequencies, this isn't cracking encryption or proprietary protocols intended to prevent eavesdropping, this stuff is in the clear.

Re:Its Kismet.

[Anonymous Coward]

What ethical norm did they break?

Re:Bleedin Obvious

[Anonymous Coward]

There is a wideband big ear over the planet, its not hard to pick up wifi and triangulate its position as a result. The difference between your WIFI receiver and a multi-billion dollar satellite network delivering data in real-time to a network of Artificially Intelligent supercomputers is minor but relevant. :)

Re:Motto??

[Anonymous Coward]

So, in your opinion, if ANY thing is possible for everyone to do, it's fine to do it?

Evolution vs. Lawsuits

[Anonymous Coward]

Funny how those doing the most to advance human civilization in terms of evolution and technological development must be pitted against those doing the least, namely, lawyers and bureaucrats...

The NYT didn't read the Fed report either...

[Jerry]

They spent a year and tens of thousands of dollars "investigating" Google and couldn't find any violations of the law, so the make a bogus claim that Google "didn't cooperate". Why should Google? What the Feds wanted was for Google to unilaterally admit to some crime.

Those who claim Google was "stealing data" have no clue as to how wifi's work and what it takes to collect data with a "Street View" van. Mostly they are victims of Apple's and Microsoft's anti-Google FUD campaign, since they both collect the same kinds of data.

Most wifis have a radius range of about 300 feet. Traveling at 25mph a van can pass through 600 feet in about 16 seconds. It takes several minutes to crack a WEP and even more for a WPA encrypted connection. The van won't have enough time to crack into secured access points. That leaves OPEN access points. How many packets could a van collect in 16 seconds for an 11Mb/S connection? About 10,600. A typical 1500 byte packet has a maximum of 842 bytes of payload, which would total to about 9 MB of data. That "data" will be HTML code, web page elements, LOTS of graphics and tons of trivia. It *might" contain pieces of someone's email. All from Joe and Sally Sixpack who don't have enough sense to, in affect, close their blinds when they undress for bed at night, or shout all of their telephone conversations, or leave their cars and houses unlocked and the windows down or open. So, what are folks to do when they pass by, plug their ears and close their eyes for 600 feet?

Besides, ESSIDs can and often do change without notice, so they mean nothing. MAC addresses would identify hardware and Google could connect a MAC to an IP address, but gathering that information is not illegal. Besides, names, telephone numbers and house addresses have been linked together in phone books for a100 years. I can record your license plate number and look up your name and address in our state auto registration database after paying a registration fee of $50. Ditto for your house records: year it was built, how many times it was sold and for how much, the amount of taxes you payed and what is due, even a floor plan.

IF you don't want someone eaves dropping in on your wifi traffic then use WPA and/or encrypt your email and connect only with https websites.

Re:The NYT didn't read the Fed report either...

[Overly Critical Guy]

They spent a year and tens of thousands of dollars "investigating" Google and couldn't find any violations of the law, so the make a bogus claim that Google "didn't cooperate". Why should Google? What the Feds wanted was for Google to unilaterally admit to some crime.

It wasn't a bogus claim. If you had read the article or followed this story at all in the last couple of years, you'd know that Google refused to turn over the data they had collected to investigators.

As for not breaking any laws, that's hardly the point. I guess the spin now is that anything goes as long as you technically don't break the law. Way to hold companies to an ethical standard, guys.

Re:The NYT didn't read the Fed report either...

[Anonymous Coward]

Except for the whole "turning over the data" without a court order would likely be a violation of privacy laws in most countries.

Re:The NYT didn't read the Fed report either...

[Anonymous Coward]

You're using logic and facts against a pro-corporate libertarian. That never works. The only thing that will make people like that happy is for the government to never investigate wrongdoing on the part of any profit-driven enterprise. Here's a clue for those types: the investigation might have taken less time and cost less had Google cooperated. OK, they didn't, which is their choice, but that doesn't make things magically go away.

On a related note: I get what wifi is and what its range is. Mine is encrypted as well as it can be. If, years ago, you had told me that a single company would have the resources and the inclination to literally drive into wifi range of most of the country I wouldn't have considered that a credible security threat. (Yes, mapping my MAC address to a location is a security threat. I don't especially care if people in wifi range of me know where I live. I care a great deal if Google does because I have never chosen to provide them that data and Google is not near me.). Now the best Google offers is I can change my SSID and they'll pretend to ignore my data that they'll still have? Fuck that. Changing SSIDs is a serious pain because my key is good, entering it on non-PC devices is annoying, and I have trusted visitors I've set up who would have to be reset as well. It would take months to cycle through everything based on the frequency of visits and such. So I either go through the work or put up with them having my location in their database. Thanks, Google.

Re:The NYT didn't read the Fed report either...

[igb]

All from Joe and Sally Sixpack who don't have enough sense to, in affect, close their blinds when they undress for bed at night, or shout all of their telephone conversations, or leave their cars and houses unlocked and the windows down or open. So, what are folks to do when they pass by, plug their ears and close their eyes for 600 feet?

Real-world analogies are always suspect, but even if people are undressing with the curtains open, anyone who films them doing so does so at their legal peril in most jurisdictions. The people undressing with the curtains open may also be committing an offence ("indecent exposure" in UK law) but tu quoque isn't a defence.

The law regarding recording telephone conversations is more variable, but most jurisdictions have a "so long as one party consents" law, which in this case wouldn't be met. It doesn't matter, in UK law at least, whether the recording is done on the electrical or the acoustic side of the proceedings, and I'd be surprised if other legislation draws that distinction: recording phone calls with a sucker mic on the receiver is just as illegal as doing it electrically.

Engineers may like to believe that the burden of enforcing privacy lies with the subject, but law, and social mores, tend to make it an offence to overtly intrude on the privacy of even those unaware they are not maintaining it.

Re:The NYT didn't read the Fed report either...

[recoiledsnake]

Except that Google was saying it was not private data at all.. in which case it would be perfectly okay to turn over the date...

They can't have it both ways.

Re:The NYT didn't read the Fed report either...

[zenyu]

The law regarding recording telephone conversations is more variable, but most jurisdictions have a "so long as one party consents" law, which in this case wouldn't be met. It doesn't matter, in UK law at least, whether the recording is done on the electrical or the acoustic side of the proceedings, and I'd be surprised if other legislation draws that distinction: recording phone calls with a sucker mic on the receiver is just as illegal as doing it electrically.

This is the second time I've heard this about English law and it strikes me as extremely odd, and indeed I'd be very surprised if this applied in a general sense in other jurisdictions+. The packets being incidentally recorded were broadcast and the listener had no intention to listen to that broadcast. That is like shouting out your window or making a speech on Speaker's corner (the broadcaster) and someone walking down the street dictating a voicemail (google) incidentally captured your yelling as background on that recording. What purpose does it serve to make it illegal to listen in this case? Obviously the Queen's subjects aren't required to icepick their ears because someone might yell at them without first giving them permission to listen, why would the icepick in ear logic be applied here? You won't convince such a law is a good idea, but I'd like to understand what the rationale is.

+ I know it is applied in some specific sections of the electromagnetic spectrum in other countries when used for specific purposes, but the assumption is it is legal to listen except for some carved out exceptions where the harms have been weighed and ignorance has been deemed the lesser evil (these exemptions are in themselves controversial.)

Re:The NYT didn't read the Fed report either...

[Anonymous Coward]

The laws exist in the US as well. In the 80's when cordless phones were not capable of encrypting/obfuscating the signal, it was made illegal to intercept the conversation, because it was so easy to do. Should everyone who used one of those phones be considered an idiot and thus have no to right to privacy?

The law doesn't carve out pieces of the spectrum, but does make it illegal to eavesdrop on any electronic communications, regardless of whether privacy is technically enforced.

Re:Motto??

[Anonymous Coward]

Go choke to death on a hot pizza, faggot. Stuff a big slice of Domino's down your gullet and inhale until the life has drained out of you. You're a big stupid blubbery bitch and your penis smells like shrimp.

Re:What people figured all along

[Anonymous Coward]

Maybe it has changed recently but for a long time webmail services would only encrypt the password submission and nothing else. The actual content of emails would be transmitted in unencrypted plain text.

I know Google has turned on HTTPS for Gmail by default in the last couple of years, that's it.

Re:Motto??

[Darkness404]

What is evil for one person to do, it is evil for many to do. What is acceptable for many to do, it is acceptable for the one to do.

For example, if it is acceptable for your neighbor to look at unencrypted web traffic for research purposes (as in, not reading the contents of e-mails to gain something such as blackmail, financial gain, etc.) it should be acceptable for a corporation such as Google to do it so long as same procedures are applied (don't look through e-mails, don't degrade the network's performance).

Similarly, if something is unacceptable for an individual to do (murder, steal, etc.) is unacceptable for groups to do.

Re:What people figured all along

[icebike]

There is quite a difference between sending porn thru a hacked wifi (in reality probably a totally unsecured wifi) and listing to a couple seconds of unencrypted wifi traffic as you drive down the street.

You also have to remember that the FCC said there was no evidence that what Google did was illegal. So that pretty much puts the lie to your claim that Google got off because they were Google. They got off because it wasn't a violation of law. Hacking someones internet is a violation of law. So is theft of services.

They still lied

[rastoboy29]

Don't be fooled by "don't be evil".

gotta get over my google addiction, one of these days.

Re:What people figured all along

[sycodon]

How'd that go again?...Do No Evil or something like that?

Re:Motto??

[Spy Handler]

Engineer John Doe: From my point of view, the FCC is evil.

Sergey Brin: Well then you are lost!

Slashdotters don't

[Anonymous Coward]

Slashdotters don't care, because Google can do no wrong here. It's seriously the biggest collection of fanboyism on the web.

Sniffing wi-fi, hacking into other company's networks, violating the GPL by withholding source, making anti-net neutrality deals with Verizon...it's all okay because Google.

Re:What people figured all along

[poetmatt]

Biased hack at the NYT? How about the fact that it was submitted by Bonch, who has a clear bias against google? He's basically Florian Mueller with a different username.

Way to miss the point

[Overly Critical Guy]

I think you didn't even read the report. It explicitly states that there was intent to use the data. It was the whole point of the project according to the design document that management apparently approved without reading.

The seven engineers weren't just people he circulated memos to. They worked on the project--five tested it, another reviewed the code, and another helped in some unspecified way.

Let's be realistic here. It's extremely difficult to believe that seven engineers could work on a Street View project, managers could approve the proposal, yet not a single other soul in the company knew what was going on or intended to do anything with the data for the two years that the project ran.

Re:Way to miss the point

[Anonymous Coward]

Just give it up, Bonch, you anti-Google fucktard. Everybody knows it's you. Fucking no-life shill loser.

Re:Way to miss the point

[Anonymous Coward]

+5 INSIGHTFUL

Re:What people figured all along

[poetmatt]

Dude we know you're biased as shit. You submitted the article! Just give up and admit that you either have a clear bias or are paid by or affiliated with Microsoft, directly or indirectly.

However, the difference between Google and MS/Apple is that in MS/Apple's case it'd be a quiet settlement with no details.

With google, what happens? Straight up honesty. 100% un-redacted other than the user's names.

Re:Google = evil

[poetmatt]

Do you have any actual proof to cite, aside from the fact that the title of the article is 100% the opposite of what happened?

Speaking of reading the report

[Anonymous Coward]

The report that you want people to read says they intended to use the data "for other services". You're mad that the NY Times ran a story critical of Google, so you're calling the author a "biased hack" for no reason. It's posts like yours that give the Slashdot comments section the reputation for being extremely biased and myopic.

Just because the FCC dropped it for no law being broken doesn't mean Google didn't cause a serious violation of morality and trust.

Troubling

[icebraining]

I don't think this specific event was really all that bad.

What's really troubling, though, is the attitude towards the users' data. And it's not a single "rogue" guy; he talked to other people, even asking a member of the Search team if it could be useful - why didn't he or she report it? Are they really that numb towards protecting people's privacy? Consented data mining is one thing, but this was wardriving!

I'm still a Google fan - they make a bunch of things that I really like - but I think this just strengths my decision of giving up on Gmail and not joining G+ (besides the real name policy nonsense).

By the way, before you accuse me of nonsense like being a shill, I'd like to say that Google is still the only major tech company that I actually like. The others could all burn for all I care.

Re:Troubling

[Todd Knarr]

What's really troubling, though, is the attitude towards the users' data.

The attitude towards people's data troubles me, too. The attitude that people should be entitled to any expectation of privacy for data they broadcast over the equivalent of a loudspeaker, for instance. If you have any intention of the data being private, broadcasting it to anyone listening within a block's radius is the last thing you'd be doing. And if you had to do it, you'd use encryption to insure anyone hearing it wouldn't be able to understand it. If eg. you didn't want people seeing into your living room, you'd at least pull the curtains. If you took the activity out of the living room and onto the front porch, do you really have any call to complain when people watch from the sidewalk? No. So what exactly did Google do that was unreasonable, let alone particularly wrong?

Re:Troubling

[icebraining]

No.

I never said people should be entitled to any expectation of privacy for data they broadcast. What Google did was legal and should be legal.

But none of that excuses their attitude. We know people broadcast their data mostly because their ignorant about the system, and Google essentially took advantage of their ignorance, which is always a shitty thing to do regardless of whether you have the right to do it or not.

Should people protect their data? Yes. Are they to blame if it gets sniffed? Absolutely. But again, none of that excuses Google and their attitude; it's, in fact, completely irrelevant.

If you took the activity out of the living room and onto the front porch, do you really have any call to complain when people watch from the sidewalk? No.

No, the people don't have any call to complain. But I will still despise anyone who sits there watching just because they can.

Re:Troubling

[jkflying]

No, the people don't have any call to complain. But I will still despise anyone who sits there watching just because they can.

What about somebody who is just walking down the street? Do you despise them too? Google didn't stop and gather as much data as it could the moment it found an open wifi. It just recorded what was there, while it happened to be in the area, and kept on going. To me the analogy is not people who crowd around and watch, but somebody who happened to walk down the street at the time.

Just because there tends to be lots of people 'out on the porch', does that somehow make walking down the street dirty? Especially when looking for people on the porch wasn't even the main reason to be walking down the street in the first place?

Re:Troubling

[icebraining]

I disagree with that analogy; the guy walking down the street can't help if he sees something, just like Google couldn't avoid having the packets processed by Kismet in memory. But saving them to disk and analyzing them is akin to that guy then writing the intimate things he saw to paper, shared it with friends and thought "can I profit from this?".

Re:Troubling

[jkflying]

I think it's a bit more like remembering what was seen where, and when asked, "I'm hearing these people yelling each other, calling each other 0A:78:89:E4:7C:F2, do you have any clue where I am?", being able to say, "I'm pretty sure you're at the corner of Oak and Elm in Washington DC".

The actual contents of the wifi is never actually made available to people, it is not shared. The only thing which is shared is the location that the MAC address was 'heard'.

Re:Troubling

[icebraining]

So Google employees are not people?

Re:Troubling

[jkflying]

Strawman. If you're scared about company employees having access to this data, you should be even more scared about people going freelance with a Kismet setup and collecting it for themselves.

Re:Troubling

[icebraining]

How is this, in any way, a strawman?

If you're scared about company employees having access to this data, you should be even more scared about people going freelance with a Kismet setup and collecting it for themselves.

"There are worse people in the world" is not an excuse. If someone steals $1000 from you, should you give them a free pass because there are people who steal $100k?

Besides, this particular situation is a red herring. I'm talking about the company attitude towards user data in general, of which this was just an example.

My home connections are wired, so I don't need to "fear" a guy with Kismet. But a huge percentage of the websites out there - including Slashdot - have some kind of tracking code by Google, both via Anaytics and Ads. Many emails I send go to gmail accounts - sometimes, even without my knowledge, if the user or company is using Google Apps with their own domain.

There are hundreds or thousands of ways in which Google collects users' data - it's essentially their business model! - often without their knowledge and explicit consent. So it's important to know how much can they be trusted with it. And the answer seems to be "not much".

Re:Troubling

[jkflying]

Yay, you called me on it. I freely admit that your argument was not a strawman, and the freelance example was a bit of a red herring. However, it made you state your primary assumptions, which is possibly the root of this entire argument.

But a huge percentage of the websites out there - including Slashdot - have some kind of tracking code by Google, both via Anaytics and Ads. Many emails I send go to gmail accounts - sometimes, even without my knowledge, if the user or company is using Google Apps with their own domain.

There are hundreds or thousands of ways in which Google collects users' data - it's essentially their business model! - often without their knowledge and explicit consent. So it's important to know how much can they be trusted with it. And the answer seems to be "not much".

Just because they have demonstrated that they are highly capable of collecting data doesn't mean that they are doing anything bad with it. Sure, they give you more personalised ads, but they don't share any of that personalisation data with their advertising customers. You can't say that they're not trustworthy unless they give you an action which demonstrates it.

Collecting data doesn't make them untrustworthy. Doing something bad with that data does. If they gave the personal information of anybody who had the word 'anarchy' in their email to the FBI, then sure, I'd agree with you. If they sold lists of people who meet certain criteria to advertisers, I'd agree. But they don't, they keep all of the data internal. Simply having the capability of doing something evil doesn't make them evil, and unless they use the data for something bad, it is just data.

Re:Troubling

[icebraining]

Firstly, they did something: they analyzed and shared it internally between employees. That alone is bad enough: it wouldn't be the first time an employee used people's private data for his personal profit.

Secondly, considering the US government track record with demands to people's private data is enough to make just collection and storage wrong. I mean, read it from Google's own testimony: the current law is outdated and does not offer the appropriate protection, and governmental agencies make thousands of requests per year under that law.

Re:What people figured all along

[lister king of smeg]

go back to 4chan

Re:What people figured all along

[Anonymous Coward]

Lack of intent does not excuse one from breaking the law. Last year I had no intent to speed but when I did not see a posted speed on a rural road, I assumed the speed was 55mph even though it was only 45mph. The fact is, I broke the law and I had to pay the consequences. Google should be held accountable as well regardless of their intent.

New Google motto:

[Anonymous Coward]

"Go ahead, be evil. You've earned it!"

Maybe people will consider a different, better search engine that isn't REALLY in the business of searching through YOUR life for data that's worth money to THEM. Try Duck Duck GO, for example. Just remember, when you preen in front of a mirror, if someone is watching you back through that mirror, they get to see everything you see, and usually more. Using Google to search for things lets Google know what you are interested in searching for. Dumbasses. Even if Google pretends they're letting you be private, they know what you're searching for, no matter what mode you're searching in, especially if you're using ChromX (the OS or the browser) since your computer has to send them the search if you're using Google in any form, and your computer sends out its MAC address with your search, so the server it contacts on the internet knows to whom (on the net) to send the results.

So it comes as no surprise Google lied, or it harvested information, they're in the business of buying and selling your information. Why else do you think they have a bazillion dollars, and all these services are "FREE"? As Heinlein and many others often said, there's no such thing as a free lunch.

Google it if you don't believe me. :)

Re:What people figured all along

[Genda]

Do we need to start limiting which species get to post here???

Re:Motto??

[jdogalt]

Disclaimer: While I did work at Keyhole(what became GoogleEarth) for 1.75 years back in 2k3, and while my older brother is Google's VP-Engineering, Geo division, I have had no significant insider knowledge or discussions about this, or anything related to it, since I left that job. I also would probably be written off as a delusional paranoid schizophrenic by many, but I'll refrain from shilling half a dozen interesting tidbits about myself here. Anyway, my comment is this:

"This would be evil if Google:

1) Collaborated with the government to alert the government about potential "illegal" activities being conducted"

Now, I will mention that it is public knowledge that the CIA through it's venture capital investment arm 'In-Q-Tel' did more or less save Keyhole from going under during the hard times of 2003ish, a year or two before they were acquired by google.

I honestly can't see how people, even the author of the parent comment, can ignore that angle of the parent comment. Do you really, in any universe after the last decade, think the CIA wouldn't start scratching their heads regarding the possibilities of a dragnet of roving signals intelligence vehicles canvasing the nation, neigh, the world?? I mean, Really??. Do you really think that if they had done something illegal, or debatably unconstitutional on that scale, that they couldn't succeed in getting it brushed under the rug, under the cover that it was just a couple silly engineers stretching some bounds? Really? If so, enjoy your lack of paranoia. Ignorance is bliss.

-dmc

Re:What people figured all along

[TechCar]

Well, the report confirms what was in the summary and title of this story.

The amount of wrongful moderation towards bunch and anyone critical of Google in this story is quite astonishing. Actually, not just this story but in every story on Slashdot. I'm a big fan of Google's products, I use gmail and my Android phone every day (even develop for it), but even I think this is scary and completely unacceptable. Just because its Google it doesn't make it right. You shouldn't give them a free pass on privacy violating stuff like this just because they somewhat support open source (not that much actually). In fact, Google should be held to higher standards if you like them because of that. Did you know that Google is secretly backing CISPA? At least Microsoft and Apple do it in open. But of course that wouldn't be good for Google's image.

It's time to end this abuse of mod points towards anything negative about Google and think of their actions as their own. And boy have they changed over the past 5 years. But like with piracy, I think that many Slashdotters just like them because they give free stuff. It's not so much about the privacy. If you cared about privacy you wouldn't use hosted services anyway, but desktop apps like Office.

Re:Motto??

[Anonymous Coward]

This is the end for you, my master. (Unless I stupidly try to jump straight over you, then feel free to slice my legs off.)

Re:What people figured all along

[TheCouchPotatoFamine]

icebike, Tell us who you work for, and you represent, before you shit all over this thread any more!

Who honestly cares?

[Karmashock]

Was google harvesting unencrypted wifi traffic? Probably... so what? Who has unencrypted wifi? Even the local coffee shop that gives wifi away for free still encrypts their wifi. They just tell everyone the password.

The moral of the story is encrypt your wifi... also, zip up your fly before you go out in the morning... and bring an umbrella if it's raining.

You know... basic words to the wise... like don't go swimming in sewage. Did google spy on idiots? Probably. But who cares? What exactly are we trying to protect here? The right to be a moron? Encrypt your f'ing wifi.

And given that the FBI just effectively got the power to spy on us all through our ISPs, exactly how much of a fuss do you want to make about Google sniffing unlocked wifi access points?

We need to start encrypting everything now. Phone calls. Email.... possibly proxying everything through other countries. I mean, if you don't care if the government can or is reading your email then carry on. But don't complain when a company comes along and does not even a tenth as much. Just keep it in perspective.

Re:What people figured all along

[Anonymous Coward]

Go fuck yourself subscriberfag. It's so painfully obvious that you're a paid shill that no one's going to take you seriously anyway.

there was clear evidence

[dutchwhizzman]

There was clear evidence that Google violated laws. True, probably not USA laws, but they did the same in other countries where laws existed that made this illegal at the time.

Re:What people figured all along

[Anonymous Coward]

Google are pure evil. i mean come on, recording the names and locations of wifi addresses? That's downright evil.

Now bundling IE with your OS and saying it's impossible to remove, faking demonstrations of browser speed for the courts? These are much better IMHO.

WTF are you people smoking. I am keeping one eye on Google, but bust them for something that actually means something.

Based on demonstrated ethics and past performance, I would choose Google over Facebook and Microsoft.

Re:What people figured all along

[Anonymous Coward]

icebike, Tell us who you work for, and you represent, before you shit all over this thread any more!

Yes, we can't have facts and information cluttering up our moral outrage.

I mean, after all this was a supervisor who was aware! That's like, one step below chairman of the board, right?

Re:Google = evil

[Anonymous Coward]

Do not trust this company.

What does using unsecured wifi and blasting your private information all over the fucking public spectrum have to do with trusting Google?

Re:What people figured all along

[recoiledsnake]

Bonch is an Apple shill and MS hater.

Promotion of unauthorised network use.

[Anonymous Coward]

What Google wanted this information for was so that people in the area could be told about open WiFi networks and use them.

Google has no right to do that.

Just because a WiFi network is open/unencrypted does not mean someone has the right to use it.

Re:Motto??

[jaymemaurice]

The analogy of a peeping tom is more like a couple in a glass house made of one way mirrors and people looking, some taking pictures or videos, and some taking pictures or videos of an attraction next door. It is not like using a zoom lens or x-ray. Maybe the users did know they were in plain sight, maybe they didn't... but lets face it.. you have to be pretty ignorant with every device you use warning you insecure networks are insecure...

It is not illegal to listen to a radio scanner or even record... at least not that I am aware.

US Corporation Lies....

[Anonymous Coward]

More News at 11

Not the point

[peppepz]

Rogue engineer? Evil managers? Who cares who is the culprit in this particular case? The plausibility of both cases is just evidence of the real basic problem: a centralised database of public (or less public) information about every single individual in the planet should not exist in the first place.There's no problem if somebody comes under my house and snoops on my unencrypted wifi traffic. There's a problem if a single entity collects all unencrypted traffic from all the streets of the world. There's a huge problem if the same entity also collects all mac addresses, street addresses, personal names, phone numbers, web history of the same people, analyses all of them to dig for those people's problems, opinions, tastes, aspirations, and the only warranty of privacy they give is "hey, we promise that we won't ever misuse that data".

Re:What people figured all along

[Anonymous Coward]

It's yet another story posted by bonch. You should by now know that he is a notorious shill that is paid to post nonsense praising Apple and dragging Google through the mud.

Re:Motto??

[Anonymous Coward]

Hard to get your point. "Wireshark could do it, hence it isn't evil", eh?
Besides, neither me nor you can capture gazillion of bytes, google can. Neither me nor you can use it as part of our business, yet Google can.

The whole attempt to downplay this story stinks.

At least in Netherlands it wasn't quite "legal"

[Kartu]

"Google announced that WiFi data collected in the Netherlands will be deleted. This move is being made at the behest of the Dutch Data Protection Authority, who gave an order earlier this year that all WiFi data was to be deleted." http://tech.slashdot.org/story/12/04/29/2229225/report-finds-google-supervisors-knew-about-wi-fi-data-harvesting And one more thing, lets not mix "google claims it had no intent to use that data" and "google had no intent to use that data" please.

Re:At least in Netherlands it wasn't quite "legal"

[anared]

And only the data in Netherlands will be deleted... What about other places? Theyre gonna store it because it is useful for making more money?

Re:What people figured all along

[peppepz]

It was clearly a tiny project that got little oversight, and less review.

Where does the "clearly" adverb come from? Why do you consider gathering unencrypted wifi traffic from the streets of half world a "tiny project"? Do you condone the fact that, as you are saying, Google treated a project with massive privacy implications with "little oversight, and less review"?

For the NYT to say it was "approved" is quite beyond the facts. Collecting wifi access point locations was approved. But Engineer Doe went off the reservation and did way more than that.

There's no proof that the plan has been approved? Who cares: there's proof that the plan has been executed, because Google did store payloads. And they lied the first time they were asked by the EU if they were doing that. Then when they were caught, they "impeded and delayed" the investigations (direct quote from the FCC report). Engineer Doe refuses to testify, why should he, if he's sure he hasn't done anything illegal?

And finally, breaking the law "by mistake" (if we want to believe them) is still illegal.

Mother, Can I Trust Google?

[anared]

http://www.backgroundcheck.org/can-i-trust-google/

Re:What people figured all along

[Anonymous Coward]

You must be some extreme google fan boy or someone morally corrupted who profits from this ad broker, as you confuse legaleze lawyer talk with a 100% un-redacted report.

According to the reasoning in this topic, it would be super ok if double click here would point a camera at each house, registering when people enter and leave. Because it's legal to film from a public road.

Ad broker washed your brain in such a way you jump to defense in their aggressive anti-privacy operations with the goal to earn money with ads at the expense of your privacy. You're such a nice, cooperative expandable product!

Re:What people figured all along

[poetmatt]

Hi Bonch!

Re:What people figured all along

[FireFury03]

I think this is scary and completely unacceptable.

Why is it "completely unacceptable" to capture data that is being broadcast in the clear over public radio spectrum in a public space? If someone wants to protect their data, their router has the tools to do this, just as if you don't want people to see you standing in your house nude you close the damned curtains.

No, I'm not defending Google, I'm defending *everyone's* right to not be penalised for something that shouldn't be considered "unacceptable".

Re:What people figured all along

[Anonymous Coward]

It was clearly a tiny project that got little oversight, and less review.

Exactly. Clearly StreetView was the main project, not the location data. That's why there are places where there are StreetView photos, but no location data. BTW, I am authorized to offer you shares in the Google Moon Base.

Re:What people figured all along

[TechCar]

I am using WLAN in the place I live. The same one that many other residents use. It is password protected, but once you login, everyone is still broadcasting their data to me also. Is it ok for me to sniff that data too? In the same way, would it be ok for me to plug-in to your internet connection outside your house and sniff that data too? I mean, it's obviously your fault since you didn't use VPN. And, would it be OK for ISP's and VPN providers to sniff data that goes across them? After all, you're sending it to them yourself...

Re:What people figured all along

[Anonymous Coward]

why are you so hateful towards fellow humans?

Re:What people figured all along

[Anonymous Coward]

You fail at analogies, TechNY.

The question is exactly that you had to find and enter the password to sniff anything more than a snippet of encrypted data - that's all what Google would get in this case. It's like difference between Google's car snapping amongst thousands of pictures a shot of your house through open curtains while passing by and Google buying an apartment opposite to yours and setting up a camera to film you all the day. You seem to equate the two.

Oh, and about ISPs?.. That's not really relevant here, but they do that, to different degrees depending on ISPs, allowed/required by legislation levels and so on. You'd better get yourself a VPN and set it up yourself from zero.

P.S: Why did you already drop yesterday's account? It even had some positive karma from a jab at Android. And why don't you at least change naming theme, is being so unsubtle a requirement? It was a bit more of intrigue when you picked arbitrary names for your new accounts.

Re:What people figured all along

[FireFury03]

I am using WLAN in the place I live. The same one that many other residents use. It is password protected, but once you login, everyone is still broadcasting their data to me also. Is it ok for me to sniff that data too?

Yes, why not? If you are sending data in the clear to untrusted networks you're a complete idiot. Presumably that wifi is either a LAN where all the clients are trusted (so everyone trusts you not to do bad things with their data), or it is an internet connection, which is inherently an insecure network so anything passing over it is liable to be intercepted (often legally required to be intercepted and logged by third parties in some jurisdictions).

In the same way, would it be ok for me to plug-in to your internet connection outside your house and sniff that data too?

Yes and no. The internet is an insecure public network, so I have no real expectation for privacy. *However*, in the case of my hard-wired internet connection, I am not blasting data out into the public environment, so by tapping into it you are either tresspassing on my property (to connect to my network) or you are tresspassing on the telco's property (their copper cables), both of which are crimes.

I mean, it's obviously your fault since you didn't use VPN.

I don't need to use a VPN. Protocols I use that carry sensitive data are encrypted (e.g. ssh, https, imaps, etc). And yes, if I shoved some sensitive data in the clear over an insecure network I would only have myself to blame if someone intercepted it. (Note: if someone captured my credit card details and used them fraudulently then, whilst it would've been my fault that they got the credit card details, they are still breaking the law by using them, so I would expect them to be arrested. If they captured the details and didn't use them for anything illegal then that's just tough for me isn't it?)

And, would it be OK for ISP's and VPN providers to sniff data that goes across them?

Not sure what you mean by "VPN provider" since pretty much all sensible uses of VPN is between trusted networks (so you inherently trust the other party to not do anything bad with your data).

I would have a problem with ISPs profiling my traffic (e.g. Phorm), and I do have a real problem with legislation that forces ISPs to do this (the security services shouldn't be interested in what law abiding citizens are doing). However, as mentioned above, the traffic going through my ISP isn't being blasted out over public space. Importantly: This isn't what Google was doing - they were capturing a few packets from random in-progress connections while driving past. They would've been lucky to get any kind of useful data out of a fraction of a percent of the packets they caught, let alone tie it back to an individual and profile their browsing habits.

Re:What people figured all along

[KhabaLox]

Well, the report confirms what was in the summary and title of this story.

How so? Read the 3rd bullet point on page 22 of the report.

"The record also shows that Google's supervision of the Wi-Fi data collection project was minimal. In October 2006, Engineer Doe shared the software code and a "design document" explaining his plans with other members of the Street View project. The design document identified "Privacy Considerations" and recommended review by counsel, but that never occurred. Indeed, it appears that no one at the Company carefully reviewed the substance of Engineer Doe's software code or the design document."

Re:What people figured all along

[KhabaLox]

Full underacted text

I'll wait for the Shatner reading.

Re:What people figured all along

[Anonymous Coward]

Missing the point. Wireless device makers and ISPs who knowingly provided their unsuspecting customers with equipment that, by default, made the users vulnerable to snooping by ANYONE within range.

Collecting the data was irresponsible. Making clueless consumers vulnerable in this way SHOULD be criminal.

Hypothetical example:
If you stay in a hotel room with a one-way mirror, it's not the person who sees into your room who committed the crime. It's the hotel who committed the crime by renting you the room, knowing you could be spied on.

Re:What people figured all along

[KhabaLox]

With google, what happens? Straight up honesty. 100% un-redacted other than the user's names.

Shouldn't/Isn't the FCC report publicly available even if Google doesn't release it? I mean, we can give props to Google if they link to it from their blog or otherwise increase the visibility of the report, but it seems to me that the FCC report should be public regardless of what the investigatee wants or does.

Re:Bleedin Obvious

[Anonymous Coward]

Perhaps CIA?

Well let's see: Keyhole is saved from going broke by In-Q-Tel (CIA venture cap firm) by a large infusion of cash, and about a year and a half later Keyhole is purchased by Google- then Google Earth is born. A few years later, this group within Google launches a fleet of GPS-equipped, WiFi signal-gathering vehicles that canvas the entire fucking nation, and... "Woops! We're sorry! We really didn't mean to record packet data from nearly every WiFi router in the nation, it was a just a mistake of some foolish engineer, acting entirely on his own, without any oversight, in this highly visible, multi-million dollar, nation-wide project.

I mean, really- Everyone Knows that the CIA would never go off reservation to get access to information, it would violate the agency's ethical code. Their track record in regards to this type of behavior is pristine, no? This having been said, who the hell cares- we'll never know what really happened, who paid for it, and what happened to the data. But to deny that the CIA would not take advantage of something they've invested money in and in which they have contacts is naive.

Re:What people figured all along

[psydeshow]

I think this is scary and completely unacceptable.

Why is it "completely unacceptable" to capture data that is being broadcast in the clear over public radio spectrum in a public space?

It's not that they captured some broadcast data, anyone can do that. It's that they systematically drove around and captured A LOT of broadcast data and correlated it to location information, with the intent that it could be mined for business purposes in the future.

It's the same reason why the health code is very strict for restaurants but not for personal kitchens. If I don't cook something correctly, I could make my family sick. But if a restaurant doesn't cook something correctly it could make hundreds of people sick.

Scale matters when it comes to the consequences of your actions.

Wiretap Act

[psydeshow]

Consider the humble wiretap: telephone conversations are unencrypted communications over semi-public networks, and yet unsophisticated callers presume them to be private. So there is a body of law designed to protect the privacy of our phone calls.

Yes, the neighborhood utility guy could tap the lines and listen in. But no company or enforcement agency could do so on a large scale without causing a huge scandal.

As tech-minded people, we all know that what happens on unecrypted wi-fi (and plain-text internet connections) is subject to interception by war-drivers, ISPs, and government-operated listening posts. And so it's hard to have any sympathy for folks who used unencrypted wi-fi and got caught by Street View's packet capture. But that doesn't mean it should be legal for organizations or governments to listen in. Just because they can, doesn't mean they should.

From the report, we know that Google started doing this in 2008, which *is* pretty late in the game for unencrypted wi-fi. Nevertheless, there was a time (say 2003ish) when it was fashionable to have unencrypted wi-fi. Not only did this ease compatibility problems, it made it easy for friends, family, and other visitors to get online quickly. It was also seen as an altruistic way to give internet to the masses. This started changing in the middle of the decade, but for whatever reasons there were clearly still quite a few unencrypted networks for gslite to sniff in 2008-2010.

Re:What people figured all along

[dcbrianw]

I think it's interesting to draw the comparison between the Wi-Fi data harvesting to the News of the World --a Murdock owned news media outlet-- hacking controversy. The two aren't apples to apples comparisons, but at a basic level they both have the similarity of large companies accessing information for which they did not have authorization. Many have called for an outright boycott of Murdoch media, even in some cases a ban thereof. On the other hand, while we've seen a lot of criticism of Google's actions, we haven't seen the same volume of public outcry of boycotting Google or restricting the operations of Google enterprises. Most of the action discussed enters the realm of penalties and fines. I wonder if two forces are at play here. One, have too many become so dependent upon Google that they hesitate to support any action that would make Google services unavailable? Two, has intense dislike of Murchoch media reached a level where the application of a different standard is acceptable to many? Full disclosure, I'm a user of gmail and a viewer of Fox News, not exclusively thereof for either.

Re:What people figured all along

[kllrnohj]

Did you know that Google is secretly backing CISPA? At least Microsoft and Apple do it in open. But of course that wouldn't be good for Google's image.

Did you know that CISPA also isn't at all what most people here seem to think it is? All it does is let the government tell ISPs that it's detecting potential cyber security threats from a computer/network - the ISP isn't required to actually *DO* anything with that info, nor is it granting the government more monitoring than it already has. As Google is also a massive ISP them backing the ability for the govt to inform them of unusual traffic makes a lot of sense. The bill may have some problem areas that need to be addressed, but unlike SOPA/PIPA its intended goal is completely reasonable and logical.

Re:What people figured all along

[FireFury03]

It's not that they captured some broadcast data, anyone can do that. It's that they systematically drove around and captured A LOT of broadcast data and correlated it to location information, with the intent that it could be mined for business purposes in the future.

"A lot" divided by the number of households they drove passed == practically nothing from each household. Given that they drive around in the middle of the day, the vast majority of wifi networks are going to be almost entirely idle, so they probably won't get anything from them other than the beacon. The beacon packet basically contains the SSIDs of the network (which they use to identify an access point for their wifi geolocation system), and contains no other useful data. Occasionally (probably every one in a few thousand networks) they might pick up something like a UPnP broadcast packet, which might tell you the brand of a device on the network. On networks where someone is surfing the web (again, middle of the day, so not that many), they might pick up a couple of packets from the middle of a session - its pretty unlikley that these packets are going to have much useful data in them, maybe a *fragment* of an email or something, more likley just a lump of javascript or part of an image from some random web page. On networks where someone is torrenting data, they will get a lump of binary data from somewhere in the middle of that torrent, again, doesn't really seem that useful to anyone.

Then we combine the above fact that they would've captured very little data from the average network (even less of any use) with the fact that the vast majority of the networks are encrypted, and you can see that they probably captured very little of value. Even if this was intentional, it was probably capturing the traffic "because we can" rather than them actually expecting to be able to use it for anything.

Scale matters when it comes to the consequences of your actions.

Yes, but I can't see any consequence here. Anyone who thinks google got a serious amount of useful data from this exercise is deluded and doesn't understand (a) how little time the Google car would've stayed in range of each network, (b) how little traffic the average network would've produced in that length of time, and (c) how tiny the proportion of personal data vs. random useless crap is in the average stream of network traffic.

Re:Google = evil

[shiftless]

Nullifying this one example changes nothing. And how do you "prove" someone's evil, BTW? Trust Google at your own risk.

Re:What people figured all along

[LordLimecat]

I have always been doubtful when people commented about how bonch had all these shill accounts, and then I saw the Wozniak Win7 phone article, and there pops up TechCar, with a clever pro MS and anti-google post; and right here all of your detractors have been modded down.

Its eerily like you really are a shill with a stable of accounts with modpoints. I mean, how is it you manage to turn MS supporting CISPA openly into a good thing, and Google not stating support for CISPA into a bad thing? How is it elsewhere you manage to turn Google's Android into a success into them "being sneaky", while poor ole MS struggles with their noble Win7 phone OS?

If you want to shill, be honest about it, dont sockpuppet.

Re:What people figured all along

[LordLimecat]

I dont believe it IS broadcast at you. Unless Im mistaken, with any kind of wireless protection, the shared key is NOT the encryption key; rather each device negotiates its own key with the AP. You may have data flying at you, but its not data that you can read without cracking that key (which I believe you CAN do with the PSK..?).

In the same way, would it be ok for me to plug-in to your internet connection outside your house and sniff that data too?

No, because you have a reasonable expectation of privacy there. Its the difference between overhearing a shouted conversation with my neighbor, and setting up unidirectional microphones against the walls of my house and capturing a conversation with my family. One is legal, the other is very clearly a violation of wiretapping laws.