Google Data Breach!

The Google data monster appetite has come under under fire recently. The rebuke has nothing to do with the useful, cuddly Google search engine we all love to use. Criticism has been targeted at the strange looking Google cars with the 360-degree camera which have been travelling the globe since early 2009 taking snaps of roads and buildings (to allow for a richer user experience of the Google Maps service) and snapshots from unencrypted Wi-Fi networks (non password protected Wi-Fi networks)!

Peaking into Wi-Fi networks is not the primary objective of these Google cars, it does however highlight how easy it can be for those who are intent on capturing unencrypted information (a blessing in disguise as a Google streetview car maybe?). Just like a satellite which has multiple projects on the go whilst orbiting an alien environment, the Google car was tasked with taking pictures and picking up information on the location of Wi-Fi networks to help Google improve their location based services (such as Google Maps for mobile phones).

But they have also managed to pick up some 600 gigabytes of payload data from Wi-Fi networks in 30 countries (this included snapshots of emails or websites being viewed). The volume of the Google data capture came to light when the Data Protection Authority (DPA) in Germany asked Google if it can audit the Wi-Fi data the Streetview cars had collected.

Upon analysing the Wi-Fi data to send to the DPA in Germany, Google became aware of the extra data collected and grounded its fleet of Streetview cars, Google said the problem dated back to 2006 when “an engineer working on an experimental Wi-Fi project wrote a piece of code that sampled all categories of publicly broadcast Wi-Fi data”. That code was included in the software the Streetview cars used, the Google engineers wanted to collect basic Wi-Fi network data like SSID information and MAC addresses to improve services.

Google said it plans to delete all the information as soon as it gains clearance from government authorities. The UK Information Commissioner has asked Google to delete information gathered on British citizens as soon as possible, whilst Australia’s digital economy minister has labelled Google ‘creepy’ for this breach in trust. According to the Google blog On Friday May 14th the Irish DPA asked Google to delete the payload data collected in error in Ireland. Google have confirmed that all data identified as being from Ireland was deleted in the presence of an independent third party.

It was a speedy response indeed from Google, but questions are being asked about this particular type of Google data breach, was it a breach of trust or just an accident waiting to happen – and Google have held their hands up.

• No Related Post