Google Admits Sniffing Private Info

In a blog post last Friday, Google admitted that since 2006 its Street View photography cars have also been collecting bits of private data from unencrypted private WiFi networks as the cars drive by. According to Google, the collection of private data in this way was unintentional, but it has landed them in hot water with the German data protection authorities whose inquiry prompted the discovery.

As a rule, European states have a greater regard for data protection and privacy issues than many jurisdictions in the Americas. So when a (presumably) American engineer working for Google thought it would be a good idea to collect just the network identification data of wireless networks that the Street View car passed by, apparently no one at Google saw anything objectionable in the idea. The problem was, the software that the engineer wrote also collected what is called "payload data"—that is, content of emails, websites being viewed, and whatever else goes over one's unencrypted wireless network. (Encrypted networks were not sniffed.) I can imagine that it was easier simply to grab and store all the data at once and then sort out the network ID stuff later, than it was to do it "on the fly" while the car was in motion. But this meant that everywhere the Street View cars went—and by now they've traveled probably millions of miles in most cities of the world—their hard drives were accumulating little pieces of private information that were exactly correlated with location and scenery. And presumably, as Google is a well-run engineering outfit, all this data was carefully collected and archived somewhere, even though no one seemed to realize that the private stuff was in there along with the network ID information.

Then along comes the data protection agent of Hamburg, Germany, who asks just exactly what are you collecting with that car? What is all this wireless stuff for? Let me see the hard drive. It's encrypted? Hum, well, tell me what's on it. And Google, in accordance with one of its founding precepts, namely, "Don't be evil," honestly checked and honestly found to its dismay that it had been collecting all this private stuff for the last four years, all over the world.

There is some good news and bad news here. The good news is, to all appearances this was a genuine error, not a sinister plot to collect blackmail data on people all over the world so as to increase Google's bottom line illegally. And when challenged by a duly constituted authority, Google personnel didn't lie, cover up, or illegally dispose of the data. Instead, they did the short-term hard thing, which was for Alan Eustace, the Senior VP of Engineering and Research, to post a blog admitting that an earlier post was in error, that Google did indeed inadvertently acquire and collect private data, and that they were going to do everything they can to amend the situation.

The bad news is, at least for Google, that their honesty has not mollified various European authorities to any great extent. The very collection of such data, even if you do nothing with it (as Google apparently has not) is illegal in Germany, and according to a New York Times report, officials are going to consult the European Commission to decide what penalties will be appropriate. The Street View feature itself has already been under attack there, and one German legislator has introduced a bill that would allow private citizens to request that their property not appear on Street View at all, with a hefty fine for Google for each incidence of non-compliance. This law would seriously compromise the usefulness of Street View, and it might be simpler for Google to just make Germany disappear altogether—so to speak.

This incident highlights the fact that a single engineer working on something that will be used in a large project should take the trouble to consider all the places the software or hardware might be used, not just some of them. Google has a reputation for putting huge resources behind innovative notions, and that's good, but with those resources come the responsibility of being more careful than is necessary if what you're working on involves only you and Joe, the neighbor down the street. I'm sure this lesson will be remembered and pounded into the heads of future engineers whose products are used in places that are more touchy about data security and privacy than, say, Austin, Texas.

It also shows the limitations of the idea of privacy in a globally interconnected age. Already, if you carry a cell phone in the U. S. and many other countries, your cellphone company "knows" where you are at least to within the accuracy of a cell (which can be any size from hundreds of feet wide to several miles), and soon there may be software and hardware on phones that will use GPS and other technologies to narrow that down to within a few yards. In general, we trust our phone companies not to use this information to our detriment, but so far, it is just a matter of trust, not law. And when it suits the law's purposes, as when a criminal is being tracked down, phone companies can be made to yield up that data. Any time you walk outside, satellite photography can almost make out your visage as you smile at the nice sunshiny day, not to mention the thousands of security cameras everywhere, and if you go inside and get on your computer, all kinds of folks can find out all kinds of things about you without your knowledge. In the U. S. we are perhaps more content with less of certain kinds of privacy than other countries are, in keeping with our long history of freedom.

Whether we will live to regret what may be viewed in the future as an excess of openness, or whether Europe will strangle data innovation with cumbersome laws that leave it increasingly without new services, only time will tell.

Sources: The New York Times article on Google's admission appeared in the May 14, 2010 online edition at http://www.nytimes.com/2010/05/16/technology/16google.html. Mr. Eustace's blog entry on the subject appears at http://googleblog.blogspot.com/2010/05/wifi-data-collection-update.html. And full disclosure: The website blogspot.com on which this blog appears is owned by Google.