Google defends Street View Wi-Fi data collection

[goldmonkey]

Google defends Street View Wi-Fi data collection
http://www.v3.co.uk/v3/news/2262161/google-defends-collection-wi

Search firm claims cars gathering network information are legal
Dan Worth, V3.co.uk 28 Apr 2010

Google has been forced to defend itself once again over its controversial Street View service, after it emerged that its cars also collect data on Wi-Fi networks and Media Access Control (MAC) addresses.

German federal data protection commissioner Peter Schaar was quoted in German newspaper Spiegel last week as saying he was "horrified" to discover the practice, and said that it was being carried out "without the knowledge of third parties".

However, Peter Fleischer, global privacy counsel for Google, countered this in a blog post, saying that the firm does not believe that collecting Wi-Fi network information is illegal.

"This is all publicly broadcast information accessible to anyone with a Wi-Fi enabled device. Companies like Skyhook have been collecting this data for longer than Google, as well as organisations like the German Fraunhofer Institute," he wrote.

Fleischer went on to say that the collection of this information does not enable Google to identify individuals.

"MAC addresses are a simple hardware ID assigned by the manufacturer. And SSIDs are often just the name of the router manufacturer or ISP with numbers and letters added. We do not collect any information about householders," he said.

Fleischer explained that Google had not revealed the practice because it does not consider it necessary to do so, but conceded that it should have made its activities clearer.

"Given that [the data] was unrelated to Street View, is accessible to any Wi-Fi enabled device and that other companies already collect it, we did not think it was necessary. However, it's clear with hindsight that greater transparency would have been better," he said.

Fleischer also explained how the technology works, and said that the data will help to improve Google's location services.

"A commercially available radio antenna is attached to the top of the car and this receives publicly broadcast Wi-Fi radio signals within range of the vehicle," he wrote.

"The equipment within the car operates passively, receiving signals broadcast to it but not actively seeking or initiating a communication with the access point. The data we collect will be used to improve Google's geo-location services."

Google has found itself under increasing fire from several angles in recent weeks. American consumer rights body Consumer Watchdog called for the firm to be broken up to stop its perceived monopoly in the industry, and the firm's Book Search project is on hold after the US Department of Justice said it was concerned it may breach anti-trust laws.

[Ponce]

Wowwwwwwwwwwwww I didn't know that, as far as I am concern they stole my signal.......to me that's like stealing my passport info as I walk past them.

[goldmonkey]

WiFi data collection: An update
5/14/2010 01:44:00 PM
http://googleblog.blogspot.com/2010/05/wifi-data-collection-update.html

http://techme.me/=YFg

Nine days ago the data protection authority (DPA) in Hamburg, Germany asked to audit the WiFi data that our Street View cars collect for use in location-based products like Google Maps for mobile, which enables people to find local restaurants or get directions. His request prompted us to re-examine everything we have been collecting, and during our review we discovered that a statement made in a blog post on April 27 was incorrect.

In that blog post, and in a technical note sent to data protection authorities the same day, we said that while Google did collect publicly broadcast SSID information (the WiFi network name) and MAC addresses (the unique number given to a device like a WiFi router) using Street View cars, we did not collect payload data (information sent over the network). But it’s now clear that we have been mistakenly collecting samples of payload data from open (i.e. non-password-protected) WiFi networks, even though we never used that data in any Google products.

However, we will typically have collected only fragments of payload data because: our cars are on the move; someone would need to be using the network as a car passed by; and our in-car WiFi equipment automatically changes channels roughly five times a second. In addition, we did not collect information traveling over secure, password-protected WiFi networks.

So how did this happen? Quite simply, it was a mistake. In 2006 an engineer working on an experimental WiFi project wrote a piece of code that sampled all categories of publicly broadcast WiFi data. A year later, when our mobile team started a project to collect basic WiFi network data like SSID information and MAC addresses using Google’s Street View cars, they included that code in their software—although the project leaders did not want, and had no intention of using, payload data.

As soon as we became aware of this problem, we grounded our Street View cars and segregated the data on our network, which we then disconnected to make it inaccessible. We want to delete this data as soon as possible, and are currently reaching out to regulators in the relevant countries about how to quickly dispose of it.

Maintaining people’s trust is crucial to everything we do, and in this case we fell short. So we will be:

* Asking a third party to review the software at issue, how it worked and what data it gathered, as well as to confirm that we deleted the data appropriately; and
* Internally reviewing our procedures to ensure that our controls are sufficiently robust to address these kinds of problems in the future.

In addition, given the concerns raised, we have decided that it’s best to stop our Street View cars collecting WiFi network data entirely.

This incident highlights just how publicly accessible open, non-password-protected WiFi networks are today. Earlier this year, we encrypted Gmail for all our users, and next week we will start offering an encrypted version of Google Search. For other services users can check that pages are encrypted by looking to see whether the URL begins with “https”, rather than just “http”; browsers will generally show a lock icon when the connection is secure. For more information about how to password-protect your network, read this.

The engineering team at Google works hard to earn your trust—and we are acutely aware that we failed badly here. We are profoundly sorry for this error and are determined to learn all the lessons we can from our mistake.

Posted by Alan Eustace, Senior VP, Engineering & Research