Google Admits Streetview Cars Collected "Entire Emails, URLs and Passwords" | Hacker News Reader

Google Admits Streetview Cars Collected "Entire Emails, URLs and Passwords"

securityweek.com

24 pointsprivacyguru31 comments

FTA:

> their investigations revealed that some incredibly private information was harvested in some cases.

Well now, slow down. If someone transmits information into the public airspace in a public street, that data can no longer be referred to as private.

If Google had been breaking WEP while they drove along they would be violating people's "reasonable expectations" of their privacy. But there's no reasonable expectation of privacy if you're broadcasting radio signals that contain your passwords. That's just dumb.

Why were they collecting this information in the first place? I don't understand how they could just accidentally grab passwords.

Because the data is there. If you're collecting it without filtering, you don't have a choice.

I'm speculating, but I suppose value from this data can be anything from geographically locating ip-addresses to improve location based services to wireless-router manufacturer statistics.

They weren't specifically collecting this information. They were collecting packets that happened to come their way. Combine enough packets, and in some cases you'll find emails and URLs and password.

It's because they reused some code to grab the MAC addresses, which was also grabbing packets (which it shouldn't have).

Story says "Google collected the data as a result of code integrated into the software used to identify and map WiFi signals. Google says the code was developed in 2006 by an engineer working on an experimental WiFi project that sampled all categories of publicly broadcast WiFi data. That coded ended up on the systems that power the data collection of the Street View cars."

Cryptoz -- I agree, all public data once it is broadcasted. But as the article says "While the data was technically broadcasted to the public and anyone with the know-how and appropriate gear could collect the same information, it would be hard for anyone to collect such data on the massive scale that Google did." -- Google should have known better. Someone knew what data they were collecting.

And yes, people should have secured their wireless routers.

> it would be hard for anyone to collect such data on the massive scale that Google did

So collecting that information is only unethical when done on a large scale?

Not saying that, just that it's more of an issue when a company like Google does it. People go "war driving" all the time and that isn't a big deal - but when a company like Google does, it's a bigger deal. And Google probably isn't a threat with the data, but people need to just secure their networks! Maybe it's a good lesson and better in the long run actually!

> it's more of an issue when a company like Google does it

I don't know if it's more of an issue, but articles like this one make it more visible certainly.

I cannot say for the legal implications, but surely, just because you don't hide something does not mean anyone can do anything from it, if only from an ethical point of view. There are many situations where you would not want everyone to know some of your actions, even though you do no actively hide them. Something as simple as what you are watching on TV, or which way your kids go to school, etc...

I disagree actually. The thing is, open WiFi is the same thing as taking a radio transmitter and transmitting your passwords to the world outside.

It's not that people didn't go to the trouble of hiding it. It's that people are (essentially, figuratively) loudly shouting their secrets for the world to hear.

I don't understand how you can compare wifi usage and radion transmitting. With radio transmitting, you are actually, purposely broadcasting information. With unencrypted WIFI, it is just a technical consequence of using internet, but there is absolutely no intent of giving this information away.

If I were pushing this argument, it would mean it is ok to copy say a movie I am downloading from a pay-per-view website on the condition it is not encrypted. Which I think does not stand legally speaking, but IANAL.

> compare wifi usage and radion transmitting. (sic)

Well technically speaking, they are the same thing. Your WiFi router and your computer's WiFi card are both radio transmitters. If someone doesn't understand that, there's going to be a problem. But it's definitely not Google's problem.

As for your second point, taping video from the air on the VCR is fine. I'm sure it's fine digitally too.

I am well aware that technically those are the same. My point is that it does not matter because the intent is different.

With radio transmitting, you are actually, purposely broadcasting information. With unencrypted WIFI, it is just a technical consequence of using internet, but there is absolutely no intent of giving this information away.

I'm sorry, but that's blatantly incorrect. Using unencrypted wireless isn't a consequence of using the internet, considering you also have the options of either using a wired signal or setting up even basic encryption for wireless ones.

The fact that you didn't intend to broadcast this information is irrelevant. Consider this contrived scenario: a pair of criminals are in a house with the windows open, and they're discussing the details of a recent crime. Unbeknownst to them, there are a pair of cops walking by who overhear all the details. By your logic, these cops couldn't arrest these criminals because the criminals "didn't intend" to give this information away.

I definitely think that there need to be better defaults for people who don't know what they're getting into when they get a wireless router, or at least a warning on the box, but if they broadcast their data unencrypted, the fault is their own if someone intercepts it.

IANAL, but as far as I know intend is relevant in law.

http://en.wikipedia.org/wiki/Intention_in_English_law

That's not applicable here. This definition of intent refers to the criminals intent, not the victims. I was talking about the data owners intent to broadcast, not Googles intent to collect.

First, you don't always have the options of using a wired signal (think web access in a coffee shop).

As for your example, it is indeed contrived: the criminals are doing something illegal at that moment, so most usual expectations as far as privacy goes become moot, especially w.r.t. law enforcement people.

I don't see how that's relevant at all: the key points is that you are doing something that is legal, may be looked at by anyone who has the skill to do so, but you do not indent this thing to be known. By your argument, anything that is not hidden can be looked at by anyone ? If you have a letter, or some private packages that you loose by accident, are you ok with anyone looking at it because you did not encrypt it or protect it well enough ?

In a coffee shop, you still have the option of not using the connection at all if it is unencrypted, and your OS should notify you that its unsafe (I know WinXP does this, though I don't have much experience with linux or osx). So, while you don't have the option of using a wired signal, you're still not forced to use an insecure connection.

As for the example, I think in the interest of making it more realistic, I lost a lot of the impact. Regardless, you sort of made my point for me. We're talking about the expectation of privacy, and the moment you start broadcasting your private information - whether shouting in public or sending out an unencrypted data signal - it can no longer be considered private.

As for your example, it depends entirely on the letter/package. Opening someone elses mail is a felony/indictable offence, so there is a reasonable expectation of privacy. AFAIK, while connecting to someone elses private connection might be illegal (war driving, etc.), I don't think that's what Google was doing. Please correct me if I'm wrong, but it seems to be that Google was just sniffing data in the air rather than making an actual connection to the network.

What Google seems to have done is more like reading a postcard. The data was clearly visible, you just needed to know how to read it. I don't think anyone could rationally say that postcards are a secure form of communication.

How do you define actual connection to the network in case of WiFi ? Why connecting vs "sniffing" would make a difference as far as privacy goes ? I don't understand why you make a difference between opening a letter and sniffing wifi network communication on an "ethical" POV.

I think it is reasonable to expect the same kind of privacy independently of the technical means for the communication channels between well intentioned people. Of course, you need encryption because people are not well intentioned, but not using it does not justify the wrong behavior.

I disagree. Just because I leave my shades open doesn't give you the right to stand in the street and take pictures of my family through the window. After all, I'm allowing the broadcast images of myself through electromagnetic radiation (visible light.)

The problem with this analogy is that Google had no intent of invading privacy. If you leave your shades open and someone starts taking pictures of the inside of your house, they are breaking your reasonable expectation of privacy. If someone happens to glance at and see the insides of your house for a split second, they are not necessarily invading your reasonable expectation of privacy.

I agree with you on Google's intent, but intent is only half the issue here. They didn't just happen to get a peek. They deliberately searched for private information and recorded everything they saw. Perhaps I'm being naive or living in the past, but it seems reasonable to expect that I won't be spied on in my home even if I'm somewhat lax in my security protocols.

But what about when that person is taking pictures of everyone's houses and posting those pictures online? They may not have been intending to invade your privacy, just show a picture of all the houses in the neighborhood.

There is a difference between the the million of little pieces of private information we leak every day and the collection and preservation of that data. Google is doing the right thing here and is going to delete this data and make sure they don't collect it again, but I think you are wrong to dismiss the collection of private data as unserious.

I'm not certain about this, but I'm pretty sure that in the US, you do have the right to take photos of people through the window, even when they're in their homes. Whatever is visible from the street (a public place) is fair game.

Having said that, I know there were some recent cases where this was brought in to question. I just don't know what the outcome was. Also, different countries obviously have varying views on this topic.

It's a pity that this is the digital privacy case that the media and politicians decided to run with.

There are legitimate unanswered questions about what privacy means in an increasingly networked world... but what to do with personal information broadcasted in the clear and recorded by accident is not one of them.

This quote is taken out of context. Google was not specifically collecting emails, URLs, and passwords. They were collecting packets. Collect enough packets, and you will wind up with emails, URLs, and passwords in the data.

From the article, from Alan Eustace's (Senior VP Research & Engineering) quote:

>It’s clear from those inspections that while most of the data is fragmentary, in some instances entire emails and URLs were captured, as well as passwords.

So, these people should be using secure wireless. If I have a loudspeaker playing my phone call into the air, I wouldn't complain that someone else heard it. If I taped a giant banner with my email into the side of my house, someone might take a photo.

If Google cracked my WEP key or something, that would be notable.

This makes Google a white-hat hacker that shows a security problem. I've just been to Spain and was able to connect to unencrypted wifi spots on almost every street-corner with my phone.

Reply on news.ycombinator.com