Google: We have collected information sent over the WiFi via StreetView

By EDRi · May 19, 2010

This article is also available in:
Deutsch: [Google: Wir haben über Street View Informationen von WLAN-Netzen gesammelt | http://www.unwatched.org/node/1932]

Google admitted that the previous information on the data they have gathered
with their Street View service was wrong and this included “samples of
payload data from open (i.e. non-password-protected) WiFi networks.”

The information comes after several letters were sent to Google by the Data
Protection Authorities on the information the company had gathered in their
StreetView service. As reported in the previous EDRi-gram, the initial
answer from Google posted on 27 April acknowledged that the Google’s Street
View cars gather information only in three categories: photos of the
street, WiFi network information, and 3D building imagery.

However, a new answer published on 14 May 2010, confirmed that the initial
information was incomplete and they also collected “payload data
(information sent over the network)”.

Google claims that this was done by mistake and the data was never used in
any Google products. They have also indicated that only fragments of payload
data were gathered because: the cars are on the move, someone would need to
be using the network as a car passed by and the in-car WiFi equipment
automatically changes channels roughly five times a second.

The blog post published by Alan Eustace, Senior VP, Engineering & Research
announced that Google wanted to delete the data as soon as possible and that
they had decided to stop collecting WiFi network data entirely with their
Street View cars.

According to an update on 17 May 2010, following a request of the Irish Data
Protection Authority, Google announced that the “all data identified as
being from Ireland was deleted over the weekend in the presence of an
independent third party.”

The decision was challenged also by an open letter of the Privacy
International (PI) that considers the instruction to delete the date “is
based on advice that is ill-informed and irresponsible, as the action may be
unlawful. We urge Google to politely ignore these instructions and, instead,
securely store the data with a trusted third party pending further
investigation.” PI has also announced that it will seek a prosecution for
unlawful interception under the UK’s Regulation of Investigatory Powers Act,
noting that “in those circumstances there would be no question of destroying
the data.”

This latest privacy issue can only support the arguments of the public
letter sent some months ago by several privacy Commissioners from Canada,
France, Germany, Ireland, Israel, Italy, the Netherlands, New Zealand, Spain
and the UK. The letter called on Google to collect and process the minimum
amount of personal information required for a service, to be clear about how
it would be used and to ensure that privacy settings were default and easy
to use.

As PI has recently replied to the public blog post: “This latest incident
was not caused by a mistake; it was caused by a failure of process that cuts
across the entire company. In the absence of a systemic change in product
development and deployment procedures the latest incident will be just one
in a continuing litany of transgressions on personal privacy.”

Google said Street View cars had been collecting WiFi data in Australia,
Austria, Belgium, Brazil, Britain, Canada, the Czech Republic, Denmark,
Finland, France, Germany, Greece, Hong Kong, Hungary, Ireland, Italy, Japan,
Luxembourg, Macau, Mexico, the Netherlands, New Zealand, Norway, Poland,
Portugal, Romania, Singapore, South Africa, South Korea, Spain, Sweden,
Switzerland, Taiwan and the United States.

The latest statements of Google chief Eric Schmidt tried to downplay the
current privacy concerns over Google Street View Service. Mr Schmidt said at
the company’s annual Zeitgeist conference UK : “Who was harmed? Name the
person”, considering that it was “highly unlikely” that any of the collected
information was “useful” and that there appeared to “have been no use of
that data.”

WiFi data collection: An update (14.05.2010)
http://googleblog.blogspot.com/2010/05/wifi-data-collection-update.html

An open letter to EU privacy commissioners regarding deletion of Google WiFi
data (18.05.2010)
http://bit.ly/cb0p6S

Google chief Eric Schmidt downplays wi-fi privacy row (18.05.2010)
http://news.bbc.co.uk/2/hi/technology/10122339.stm

Google and privacy: What crisis? (19.05.2010)
http://www.bbc.co.uk/blogs/thereporters/rorycellanjones/2010/05/google_and_privacy_what_crisis.html

EDRi-gram: UK and Germany question the data collected by Google Street View
(5.05.2010)
http://www.edri.org/edrigram/number8.9/google-street-view-wifi-germany-uk