Leave only footprints: how Google's ethical ignorance gets it in trouble(arstechnica.com)
arstechnica.com
Leave only footprints: how Google's ethical ignorance gets it in trouble
http://arstechnica.com/gadgets/news/2012/05/googles-street-view-engineer-knew-data-collection-was-questionable.ars
9 comments
>"Then there is also the question of how much baby sitting / bureaucracy / micro management can a company like Google should/could afford."
This wasn't a small side project.
Streetview is a major initiative which required the sustained deployment of significant resources on a worldwide scale and an vast ongoing commitment to the bandwidth necessary to serve the data collected.
This wasn't a small side project.
Streetview is a major initiative which required the sustained deployment of significant resources on a worldwide scale and an vast ongoing commitment to the bandwidth necessary to serve the data collected.
Yes, but for any company with multiple major initiatives the smarter thing to do is to decentralize the decision making and let the individuals handle it at the initiative level. Otherwise you end up with heavy middle management that becomes hindrance and liability for the most part.
I think that Streetview didn't enforce too many strict guidelines as it was thought of as a low-risk, non-user-facing product.
[deleted]
I'm going to go ahead and play devil's advocate; I think concern over this is really overblown. There are two things about this case that I don't really get:
1. If you're blasting your data over an unencrypted wifi connection, do you have a reasonable expectation of privacy? This seems to be equivalent to someone screaming the contents of their email, and then getting angry at you for eavesdropping. Also, who the hell transfers that kind of data over anything but SSL?
2. What was Google trying to get out of these packets, besides wifi-GPS data? This seems like more of a simple overstep of collection than anything else. Do we seriously think that this data was collected maliciously? They already have the majority of people's data, what more would they be trying to get? After all of my DNS lookups, my GPS coordinates, my email, and my social connections, what more is there?
1. If you're blasting your data over an unencrypted wifi connection, do you have a reasonable expectation of privacy? This seems to be equivalent to someone screaming the contents of their email, and then getting angry at you for eavesdropping. Also, who the hell transfers that kind of data over anything but SSL?
2. What was Google trying to get out of these packets, besides wifi-GPS data? This seems like more of a simple overstep of collection than anything else. Do we seriously think that this data was collected maliciously? They already have the majority of people's data, what more would they be trying to get? After all of my DNS lookups, my GPS coordinates, my email, and my social connections, what more is there?
> If you're blasting your data over an unencrypted wifi connection, do you have a reasonable expectation of privacy? This seems to be equivalent to someone screaming the contents of their email, and then getting angry at you for eavesdropping.
Exactly. I agree with other commenters that Google is not to be trusted, but I think this article isn't even specific to Google--it's just another illustration that unencrypted Wifi is public, and anyone with half a clue should know that by now.
Exactly. I agree with other commenters that Google is not to be trusted, but I think this article isn't even specific to Google--it's just another illustration that unencrypted Wifi is public, and anyone with half a clue should know that by now.
> 1. If you're blasting your data over an unencrypted wifi connection, do you have a reasonable expectation of privacy?
Yes, you have a reasonable expectation of privacy. Connecting to someone's unsecured wifi is a criminal offence; scooping data from that connection maybe in some jurisdictions.
People may be stupid for not securing their wifi. But no-one at Google is stupid. They don't have that excuse.
> Do we seriously think that this data was collected maliciously?
Not being evil isn't a magic pass for being daft. Google should have known better. The engineer raised concerns, so at least one person knew it might have been a problem. Google has lived through years of people being concerned about privacy. How can they get something so simple so wrong?
Yes, you have a reasonable expectation of privacy. Connecting to someone's unsecured wifi is a criminal offence; scooping data from that connection maybe in some jurisdictions.
People may be stupid for not securing their wifi. But no-one at Google is stupid. They don't have that excuse.
> Do we seriously think that this data was collected maliciously?
Not being evil isn't a magic pass for being daft. Google should have known better. The engineer raised concerns, so at least one person knew it might have been a problem. Google has lived through years of people being concerned about privacy. How can they get something so simple so wrong?
>Connecting to someone's unsecured wifi is a criminal offence
Not necessarily. Check your local laws, and be aware that they will almost certainly differ from those elsewhere. http://en.wikipedia.org/wiki/Legality_of_piggybacking
Not necessarily. Check your local laws, and be aware that they will almost certainly differ from those elsewhere. http://en.wikipedia.org/wiki/Legality_of_piggybacking
True. I should have added "[...] in the UK".
> Connecting to someone's unsecured wifi is a criminal offence
what if the SSID is 'freewifi'?
what if the SSID is 'freewifi'?
[deleted]
Google is not to be trusted. Thats the hard truth. From the article:
"Outlets like the New York Times noted that Milner did raise the [privacy] issue with superiors before the code was implemented (managers claim to never have read his reports)".
Right. Nobody at Google knew anything about this engineer collecting data for 3 YEARS? Thats just not reality. Corporations doesnt work that way.
And the fact that Google lies about it shows exactly what they are like.
"Outlets like the New York Times noted that Milner did raise the [privacy] issue with superiors before the code was implemented (managers claim to never have read his reports)".
Right. Nobody at Google knew anything about this engineer collecting data for 3 YEARS? Thats just not reality. Corporations doesnt work that way.
And the fact that Google lies about it shows exactly what they are like.
It's extremely interesting (read: troubling) to watch Google transform from a collection of geniuses to a bog-standard corporation under substantially the same management. Perception is everything, sometimes.
All of that data has to go somewhere. All the investigators have to do is go find the quota requests and see who approved them.
Was it deliberate, though? The impression I gained was that the engineer made the software dump the packets and extract the SSIDs, but forgot to remove the dumps.
That was Google's old story. The new story is that Milner discussed the idea of running analytics on the captured traffic.
This creates the appearance that every single person involved with actual responsibility (managers, etc) decided to throw Milner under the bus at the first sign of trouble. Disgusting if true.
Claiming not to have read his reports makes them shitty managers. Claiming that everything is his fault despite their complete failure to actually do their jobs makes them terrible people.
Claiming not to have read his reports makes them shitty managers. Claiming that everything is his fault despite their complete failure to actually do their jobs makes them terrible people.
http://www.theregister.co.uk/2007/04/18/uk_war_driving_arres...
Situation in UK not clear, most police action is around cautioning people doing strange things with laptops in parked cars. Responding to complaints.
Given current security levels in UK coming up to Olympics, any use of communications kit like this in a moving vehicle would need to be really upfront, or you had better have a good story when stopped.
Situation in UK not clear, most police action is around cautioning people doing strange things with laptops in parked cars. Responding to complaints.
Given current security levels in UK coming up to Olympics, any use of communications kit like this in a moving vehicle would need to be really upfront, or you had better have a good story when stopped.
War-driving is no longer about laptops in cars.
A couple of years ago I spoke at a New Zealand hacker con (http://2010.kiwicon.org/the-con/talks/#e41) about "Wardriving in the age of Arduino".
My final demo was an Arduino-based War-walking rig that easily fit into a stylish Trilby hat and logged SSIDs with GPS locations as you walked.
You could then easily display the result on a map with indications of the WEP/WPA/etc security in use.
Is that dapper gentleman out for an afternoon constitutional or casing your network?
(Besides, by now, most (possibly rooted) smart phones can probably do all that's required anyway.)
A couple of years ago I spoke at a New Zealand hacker con (http://2010.kiwicon.org/the-con/talks/#e41) about "Wardriving in the age of Arduino".
My final demo was an Arduino-based War-walking rig that easily fit into a stylish Trilby hat and logged SSIDs with GPS locations as you walked.
You could then easily display the result on a map with indications of the WEP/WPA/etc security in use.
Is that dapper gentleman out for an afternoon constitutional or casing your network?
(Besides, by now, most (possibly rooted) smart phones can probably do all that's required anyway.)
Would respectfully advise that enhanced hat wearing people have a very clear explanation ready should the police stop them for any reason! They will need chin straps on windy days. I take the point about smart phones.
What I was getting at is that street law often depends on whether someone has made a complaint to the police or not. Wardriving/warwalking may not automatically be breaking the law in the UK, except through the 'theft' of network or 'nuisance' issues.
What I was getting at is that street law often depends on whether someone has made a complaint to the police or not. Wardriving/warwalking may not automatically be breaking the law in the UK, except through the 'theft' of network or 'nuisance' issues.
If your premise is that Google is a big bad company, this is your case? I've always found this story to be excruciatingly disappointing.
So, besides cameras and lasers, they also had a wifi sniffer on board that just captured all the data in the right frequency band. That is, after all, the whole point of this exercise: gather data and see what you can do with it later on. The case for doing this for WiFi is obviously that matching SSID to GPS locations and a little bit of triangulation through signal strength gives you a fast, precise enough location with a simple WiFi scan without having to wait for a one minute cold GPS fix. That you are not even going to get if indoors.
The big problem here seems to be that they captured raw data instead of just running an actual wifi scan like your network card would. But if you've ever had to manually trigger one, you know that these take time, and then they only represent a single snapshot. So capturing raw data over the whole timespan solves both the timing problem and it allows you to get much better results given that you can now pretty exactly tell when a network comes out of reach. These things however require analysis that is easier done at some backend, not on the same machine occupied with freaking 3D lasers.
And yes, it turns out, that if you were sending an email at the exact same time the google car was in reach of your network and that your network was unencrypted, they could possibly collect single isolated frames or fragments of your message. The reason we don't use WiFi for time critical stuff after all is of course that data corruption is very frequent and might require many turnarounds for one package to arrive in whole and correct.
If you want to prove that Google is evil, find that 'Chiquita colombia killings' case. This one is just.. stupid.
So, besides cameras and lasers, they also had a wifi sniffer on board that just captured all the data in the right frequency band. That is, after all, the whole point of this exercise: gather data and see what you can do with it later on. The case for doing this for WiFi is obviously that matching SSID to GPS locations and a little bit of triangulation through signal strength gives you a fast, precise enough location with a simple WiFi scan without having to wait for a one minute cold GPS fix. That you are not even going to get if indoors.
The big problem here seems to be that they captured raw data instead of just running an actual wifi scan like your network card would. But if you've ever had to manually trigger one, you know that these take time, and then they only represent a single snapshot. So capturing raw data over the whole timespan solves both the timing problem and it allows you to get much better results given that you can now pretty exactly tell when a network comes out of reach. These things however require analysis that is easier done at some backend, not on the same machine occupied with freaking 3D lasers.
And yes, it turns out, that if you were sending an email at the exact same time the google car was in reach of your network and that your network was unencrypted, they could possibly collect single isolated frames or fragments of your message. The reason we don't use WiFi for time critical stuff after all is of course that data corruption is very frequent and might require many turnarounds for one package to arrive in whole and correct.
If you want to prove that Google is evil, find that 'Chiquita colombia killings' case. This one is just.. stupid.
It sounds like Milner has a conscience.
But the conduct of his managers when faced with the issue is troubling.
OK, so if wardriving (sniffing wireless networks other than your own) is legally in the clear, then should everyone start collecting data? If Google does it, then it must be a business opportunity, right? As long as people don't do anything illegal with the data[1], what's the harm?
This is why paying serious attention to encryption, and making it easy for people to use, might not be the mere fodder of "tinfoil hats" that some portray it to be. Maybe it's just plain common sense.
1. How many of you read about the TJ Maxx case?
But the conduct of his managers when faced with the issue is troubling.
OK, so if wardriving (sniffing wireless networks other than your own) is legally in the clear, then should everyone start collecting data? If Google does it, then it must be a business opportunity, right? As long as people don't do anything illegal with the data[1], what's the harm?
This is why paying serious attention to encryption, and making it easy for people to use, might not be the mere fodder of "tinfoil hats" that some portray it to be. Maybe it's just plain common sense.
1. How many of you read about the TJ Maxx case?
> This is why paying serious attention to encryption, and making it easy for people to use, might not be the mere fodder of "tinfoil hats" that some portray it to be.
Setting up WPA2 on your Wifi router is not very hard. Most routers now will do it at the push of a button. (I personally don't do it that way, I set everything up by hand through the router's web interface, but that's because I'm a techie.)
Setting up WPA2 on your Wifi router is not very hard. Most routers now will do it at the push of a button. (I personally don't do it that way, I set everything up by hand through the router's web interface, but that's because I'm a techie.)
[deleted]
Then there is also the question of how much baby sitting / bureaucracy / micro management can a company like Google should/could afford.
For instance, where I work, we have mandatory training for handling ethics issues without supervision. It is pretty decent in terms of coverage and clarity. Then there is a relatively modestly staffed ethics department that can assist in resolving any issues that cannot be resolved using existing training and guidelines. There is no supervision or management involvement here. It's not management's job to burden the Engineers with supervision.
Perhaps Google could learn from this and develop a "when in ethical doubt, don't do it" culture amongst the Engineers and have a Ethics compliance department handy if issues arise that cannot be resolved using the standard training.
Obvious things aside, did the Google management actually encourage the Engineers to collect plain text data and what did Google actually do with that data - that we will never know. But what _could_ they possibly do with people's browsing data, from a management/corporation perspective? Certainly they have no use for people's passwords to increase their profits? (The "rogue employee" can do harm with that data but that is different territory.)