Google: We inadvertently collected personal data sent over open WiFi networks

Google today admitted that for more than 3 years, it inadvertently collected bits of private data people sent over unencrypted wireless networks. The confession comes a month after European regulators began asking Google what data Google collects as its camera-laden Street View cars cruise city and neighborhood streets, and what the search giant does with that data.

Two weeks ago, Google tried to address the questions and criticism in a blog post. It admitted to collecting certain kinds of data around the world that identify Wi-Fi networks in order to help improve its mapping products. But the company explicitly said it did not collect or store so-called "payload data" - the actual information being transmitted by users over unprotected networks.
But Google is now saying, in a late-night-Friday European-time confession that is sure to infuriate regulators and privacy advocates, that its previous claims were wrong.

Google Says It Inadvertently Collected Personal Data (NYT) WiFi data collection: An update (Official Google Blog)

Boing Boing editor/partner and tech culture journalist Xeni Jardin hosts and produces Boing Boing's in-flight TV channel on Virgin America airlines (#10 on the dial), and writes about living with breast cancer. Diagnosed in 2011. @xeni on Twitter. email: xeni@boingboing.net.

MORE: privacy

More at Boing Boing

Ants and Stars: Bruce Sterling and Jasmina Tesanovic visit the Sardinia Radio Telescope in Italy

The Snowden Principle

foobar

If you don’t secure your wireless you have no more expectation of privacy than if the neighbours (or Google) can hear you shouting.

You, me, and anyone else nearby with a laptop get copies of your transmitted data, which we would normally let fall into the bit bucket. Google is doing the same, just with an accidentally long lived bit bucket.
Anonymous

Actually there *is* an expectation of privacy.

The fact that home WiFi networks are difficult to set up, and the industry standard is to wrecklessly configure them in an “open” mode, says nothing about what the home user “expected”. They plug it in, got their laptop to talk to the printer in the other room, and assumed it was all fine.

(When you plug in a lamp, what do you expect? It *could* burn your house down, but you *expect* to get some light.)

This is an *industry* problem, a loophole that Google choose to exploit.

“Don’t be evil” my ass.
- Anonymous
  
  Would you be pissed off if someone on the street had their path illuminated a bit for them by your lamp though?
Apreche

Imagine if your telephone was still on a party line. You know that the neighbors might be listening. You don’t say things you don’t want them to know, or you speak in code.

Let’s say you have a microphone in your house, and it broadcasts everything it picks up over FM radio. Everyone nearby can listen to the noises in your house.

So you have this computer, with a radio, and you set it up to broadcast your information, unencrypted, to everyone in the surrounding area. You connect it by a wire, and it broadcasts the unencrypted information to everyone on the same line.

There’s no expectation of privacy in these cases. if you don’t protect yourself, you can’t really complain. No sympathy for the technologically inept. Ignorance is no excuse. Get with the times. The Internet is the wild west, come packing heat.
Anonymous

If you don’t secure your wireless you have no more expectation of privacy than if the neighbours (or Google) can hear you shouting.

This is no different than saying if you don’t encrypt and onion router your web traffic, you have no expectation of privacy if someone at your ISP decides to stalk you. Or saying if you use a cordless phone you have no expectation of privacy, since any encryption is easily breakable and the bits are just floating out there. Data being technically accessible does not remove responsibility for the person who goes surreptitiously accesses it.
- foobar
  
  Or saying if you use a cordless phone you have no expectation of privacy, since any encryption is easily breakable and the bits are just floating out there. Data being technically accessible does not remove responsibility for the person who goes surreptitiously accesses it.
  
  That’s exactly it; they didn’t surreptitiously access it, the accidentally heard it, because was shouted. If you use any encryption, even ineffective, you have at least some expectation of privacy, but Google didn’t crack anything.
Anonymous

No expectation of privacy? Really?
GraemeM

This is just Google bashing. War driving has been going on for years and we are still inundated with experts telling us to secure our Wi-Fi.

Unsecured Wi-Fi is the same as broadcasting HAM or CB, anybody with the right equipment can eavesdrop and we all know they do.

ISP’s spying on internal traffic is NOT the same, they are governed by rules, regulations and duties of care.

Given what we are told by the IT press nowadays, the majority of traffic will be Facebook drivel, downloads of Iron Man 2 in HD or my sons games in Halo 3. Hardly seems worth it.
Anonymous

Seriously, people. The fact that Google is out there sniffing this data and collecting and storing it is nuts. I can’t believe that we just don’t care anymore (at least in the U.S.). If the government were doing it, people would be going ballistic. But Google says “Oops! We’re sorry.” So it’s ok. I hope they get a good spanking by the Europeans.
baph

I inadvertently your privacy.
Anonymous

Google business plan circa 1994, v. 0.01:
1) Stop wardriving.
2) Use newfound free time to program hella good search algorithm.
3) Make oodles of money from site surrounding hella good search algorithm.
4) Use oodles of money to pay other people to wardrive for us, _big_ time.
Anonymous

Compare this to BP, which underplayed its problems by underestimating the amount of oil etc, and then their CEO tried blaming everyone else.

This is ridiculous. BP owned up to their responsibility within days. It took Google *three frickin’ years*. During those years, it was placing the blame on the complainant claiming they were paranoid.

Marty O’B, I didn’t ask Google to sniff my packets nor did anyone else. It is already decided law that what ever wavelengths emanate from your home are considered yours and only you get to choose what to do with it. Google broke the law and they should pay. Good for the Germans.
- Stooge
  
  What has a US Supreme Court opinion on Fourth Amendment rights got to do with this? When did Google become the US government and when did Germany become part of the US?
solitaire

i really, do not care that google was doing this. open wifi spots are effectively public (i run my wireless open knowing so).
but in other news:
“…next week we will start offering an encrypted version of Google Search.”
zomg YES! can’t wait for https://www.google.com
Ugly Canuck

I overhear conversations, that is, pieces of conversations, whenever I am in crowded places.
But I NEVER record them.
Nor do EVER I repeat them.
But the people speaking to each other in the restaurant, or bus, or waiting room, or bank, still have an expectation that their discussions are private, and won’t be recorded, and if recorded, then not further used IN ANY WAY, other than to erase the tapes: even if they notice me passing by. NO CONSENT was given by them, and implying such consent is not justified…
Secure or not, I have an expectation of privacy when I’m connected via my ISP, wi-fi or no.
Well-founded, such an expectation may not be.
So freaking what?
It ALWAYS takes some work, some active steps, to overhear my Wi-fi, or shoulder-surf my internet browsing: so which vanishes first? My privacy, or my expectation of it?
And why should a Court care, that my privacy may be easily violated: this does not vitiate my expectation, nor does it entitle the Court to ignore it, to say: “These people have proven you have no privacy, and I must follow their lead, regardless of your reasonable expectations of privacy”.

Google ought to just erase all the data inadvertently collected, and then pay a fine.
- iamcantaloupe
  
  “But the people speaking to each other in the restaurant, or bus, or waiting room, or bank, still have an expectation that their discussions are private, and won’t be recorded, and if recorded, then not further used IN ANY WAY, other than to erase the tapes: even if they notice me passing by. NO CONSENT was given by them, and implying such consent is not justified…”
  
  What about all those people who randomly end up in YouTube videos in public places? While you may expect to have some privacy, the fact is you have no right to it in a public place – that is the definition of public.
  
  What Google did is analogous to a personal sound project I did in high school. I walked around with a microcassette recorder for about a month and would sporadically record a few seconds of conversation/noise/whatever, then rewind or fast forward to somewhere else in the tape. In the end, I had a garbled collage of sonic information from all around the city, none of which I had the express right to collect, but did so in public.
  
  Except Google didn’t upload it to the internet for free because it sounded cool. And they erased it. And did it by accident. And went through measures to make sure it didn’t happen again.
  - Ugly Canuck
    
    And they did all of those laudable things, because they recognize that people have a reasonable expectation of privacy, when it comes to such things, regardless of the fact that for some technically adept people equipped with the right technology, it is very simple to violate such privacy.
    No damage done – just as in your personal example.
- Stooge
  
  Ugly Canuck, would you care to claim that you have never used a telephone or recording device while within earshot of others without previously explicitly seeking their consent?
juki

Google owned up which is what every company should be doing when they blunder. That it was an oversight or error… seriously people. This is not something to be taken lightly. A company that is so exacting in their work should not be making these types of oversights.

If I leave my door unlocked, is not a crime when an unauthorized visitor takes off with contents of my home?

We all need to wake up and hold the companies accountable for their actions and hold them to the same standards we expect form each other.
- Marty O’B
  
  “If I leave my door unlocked, is not a crime when an unauthorized visitor takes off with contents of my home?”
  
  This is a strawman argument. In the case of open wifi, it’s more like:
  
  If I leave my door unlocked AND
  someone knocks on my door AND
  asks for permission to come inside AND
  I say Yes AND
  he monitors everything I do & say AND
  records what he wants, and then leaves.
  
  is it OK?
- Stooge
  
  If I leave my door unlocked, is not a crime when an unauthorized visitor takes off with contents of my home?
  
  No. If you leave your sofa out in the street, is it a crime if someone sits on it?
dross1260

I’m out of tin foil.
Anonymous

Of course I don’t like what they did, but obviously they seem to work hard to rectify this “mistake” and come clean.

Though I can’t say I’m all comfortable with Google having so much data on me, but to choose between no internet at all, or the lesser of two evils (facebook/Google) I’d go with Google.
Anonymous

I guess that whole “Do no evil” thing is pretty much out the window now, and way to issue a Friday night press release so hopefully no one will notice, very classy!
Anonymous

They’re doing the right thing by (1) admitting the error existed, (2) accepting responsibility, and (3) acknowledging that it was wrong.

Compare this to BP, which underplayed its problems by underestimating the amount of oil etc, and then their CEO tried blaming everyone else.

Google has fucked up in the past– partnering with China, the Buzz opt-in, etc. But the difference with other companies like Facebook’s “dumb fuck” Zuckerberg is when they fuck up, they fix it, and with the exception of China, it doesn’t seem to be intentional.
- tsdguy
  
  Exactly – why Anon this? Google made a mistake, explained EXACTLY how and why it made the mistake, involved third parties to verify and mitigate the error and STOPPED the process until they get an idea if and when they will continue.
  
  Hmm. Unless they are totally lying? Nah.
bobhughes

If google didn’t receive “payload data” then what difference does it make whether the WiFi’s were secured or not?
Anonymous

I don’t see whats wrong with driving around on public roads and collecting info that is broadcast to your vehicle with no encryption.