10 ms·

Not just metadata: Wasn't the controversy that they were sniffing data packets, too?

uptown 7y ago
Yup: https://www.wired.com/2012/05/google-wifi-fcc-investigation/ https://www.wired.com/2012/05/google-wifi-fcc-investigation/
shadowgovt 7y ago
Yes, the firmware had been configured for open logging and was slurping the packets and dumping them to a debug file.
barbegal 7y ago
Yes but (if we believe they are telling the truth) this was only done accidentally and they only intended to sniff the SSIDs. https://publicpolicy.googleblog.com/2010/05/wifi-data-collection-update.html https://publicpolicy.googleblog.com/2010/05/wifi-data-collec...
jetrink 7y ago
I remember the outrage that this revelation generated and I am still stumped by it. First, the probability that a Google car happens to capture sensitive information as it drives past your residence once per year is basically zero. Even if it did, it would still require detective work to correlate it to you specifically. Second, if you are worried about people recording data broadcast by your WiFi router, it's up to you to secure your network. I would be much more concerned about a neighbor snooping on my traffic. What did people imagine that Google was doing with these random snippets of data?
- henriquez 7y ago
  > if you are worried about people recording data broadcast by your WiFi router, it's up to you to secure your network So that makes it okay for Google to Hoover up? This attitude is why a lot of people are angry at big tech right now. Elitism and arrogance bordering on hubris, but zero self awareness.
  - _jal 7y ago
    "If it is not clearly illegal, I have a god-given right to monetize it and then try to exclude you from it." -- FB, Google, et al on the Commons To be fair, it isn't just them. A disturbingly large number of people in the US appear to believe acknowledging any commonweal is counter to national ideology.
    - renewiltord 7y ago
      It is clearly a general belief everywhere that if you can get some utility out of something and you can manage to do that for free then you should. HN does it with paywall bypasses, piracy, etc. Completely unsurprising that if you take a group of people, each of whom individually believe in deriving utility from things they can get with or without permission, then that collective group also behaves in the same manner.
    - shadowgovt 7y ago
      Nobody's excluded from doing their own wardriving and data-collection on open SSID network names, as far as I'm aware. Hell, if someone just wanted to drive around and record the radio flux sans information, perhaps to build a fun map correlating population density or income levels to broadcast emissions, that's perfectly fair.
- ashtonkem 7y ago
  I’m kind of surprised that you’re surprised by it. Outrage over privacy violations has very little to do with the actual harm that the privacy violation causes, and much more to do with whether or not it seems to violate a prior expectation of anonymity or privacy. This concept is even enshrined in US jurisprudence; the “expectation of privacy” is a big factor in how privacy works in America. Back to Google. The problem isn’t that they captured packets or SSIDs; the problem is that they captured it sitting outside your house. With that change it feels like Google has gone from taking photos of the city that you might be in, to sitting in the bushes taking pictures of your house.
  - judge2020 7y ago
    > the “expectation of privacy” is a big factor in how privacy works in America. You might expect privacy in your home, but if someone looks through your window when passing by and you exchange glances, you likely aren't going to call law enforcement because they violated that expectation of privacy. Of course, if something revealing or private was observed when that happened, or if they were specifically looking someplace people don't just look (eg. upstairs window) it might warrant filing a police report, but my point is that, based on the articles linked in this thread, Google was sniffing all packets without malice or intent.
    - ashtonkem 7y ago
      This is neither about intent nor the letter of the law, it’s about perception and outrage. It doesn’t matter if it’s legal and without malice, it feels creepy in a way that their regular internet behavior does not. It’s also impossible to verify what Google will do with that data now or forever. They say they’re doing it in good faith, but then again everyone says that. How can you verify that, and do you trust them with it forever?
      - ForHackernews 7y ago
        > in a way that their regular internet behavior does not. Counterpoint: I think if most regular people understood the extent of Google's other surveillance behavior, they would also find it creepy.
- 72deluxe 7y ago
  Does that mean you'd be alright with me sitting outside your house taking photos of it and scanning for network signals coming from your house and running a software radio receiver to see what you've got going on inside? If not, why are you alright with Google doing it?
  - chrisdhal 7y ago
    If you are in the street, then yes, that is considered "public" and there's really not much I can do about it. I have zero expectation of privacy if you take pictures of the front of my house from a public area. If my WiFi signal reaches the street, then, again, that's a public area. I may not like it, but doing it from a public area is perfectly legal (in the US at least). Now, you can't come onto my lawn to get a better signal, but there's really not much I could do if you parked on the street in front of my house.
    - judge2020 7y ago
      Someone doing so would potentially violate wiretap laws, probably also stalking depending on the state.
      - vntok 7y ago
        No they would not. Not until you actually went to the police station, got them to open a case, got an injunction and the "culprit" would get served with a formal notice. Then if they kept doing that would they potentially be in breach.
        judge2020 7y ago
        I agree that detecting and pursuing this is unlikely to happen but it's still likely a violation of state wiretap laws and/or stalking. Anyone that wanted to do this would just lay a rpi with cellular and a battery so they don't need to be right outside your house all the time, making it both hard to detect and untraceable.
    - 7y ago
- freefriedrice 7y ago
  Not directed at you personally, just "you" generally: unless you're not using PSK or WEP, no one is snooping anything meaningful from your Wi-Fi traffic. WPA can be cracked by collecting enough handshake info to create enough hashes you can then set some GPUs from the cloud on in a matter of days. WPA2 (and enterprise) are not crackable unless you are a government. And even if a malicious person gets your passkey, HTTPS is pretty damn near impenetrable. Source: I've been to DefCon for the past 7 years, and with the exception of TLSv1.3 replay or trying to hijack global DNS routers or compromise CAs, which either require the stars to align, military style infiltration, or non-existant computing, you're safe. You're far more likely to be hacked by a phone call pretending to be your bank, or by a fake AirBNB scam. Or someone stealing your mail. Ok internet: prove me wrong. Where are your WPA2 and TLSv1.3 hacks that anyone can do?
- vmception 7y ago
  nah its just kind of creepy the multiple ways that Google and services assign a GPS location to your SSID that has nothing to do with sniffing packets or network security
- sitkack 7y ago
  It was effectively a Wifi Stingray and MITM peoples connections so they could form a baseline of what people in that local were doing with their internet connections at the time the street view car passed. It most certainly broke connections. Multiple levels of unethical, how this ever got past anyone at Google stumps me.
  - shaftway 7y ago
    Can you provide a citation? I haven't heard any evidence that they were actively interfering in connections, only recording what was broadcast in the clear.
MertsA 7y ago
To add to the other responses, the reason why they were capturing sensitive data was most likely because instead of doing filtering and processing live while they were driving around they chose to just deal with that after the fact and process the WiFi data through whatever system they already had for post processing. Even with just recording the SSIDs and timestamps on the vehicle all of the data that was controversial would still be captured by the radio on the vehicle, it would just be discarded immediately instead of being discarded when the Google maps vehicle offloaded that data for processing. If Google wanted to do something nefarious, they could still turn it back on all in software. The only real privacy gain is that they can't retroactively do it but I doubt even originally that they kept the packet dumps around for too long after processing it.
- shadowgovt 7y ago
  Based on the reporting at the time, it sounds like it was unintentional; they were capturing the raw packets to a debug file that wasn't even routed for post-processing.

Yup: https://www.wired.com/2012/05/google-wifi-fcc-investigation/ https://www.wired.com/2012/05/google-wifi-fcc-investigation/

shadowgovt 7y ago

Yes, the firmware had been configured for open logging and was slurping the packets and dumping them to a debug file.

barbegal 7y ago

Yes but (if we believe they are telling the truth) this was only done accidentally and they only intended to sniff the SSIDs. https://publicpolicy.googleblog.com/2010/05/wifi-data-collection-update.html https://publicpolicy.googleblog.com/2010/05/wifi-data-collec...

jetrink 7y ago

I remember the outrage that this revelation generated and I am still stumped by it. First, the probability that a Google car happens to capture sensitive information as it drives past your residence once per year is basically zero. Even if it did, it would still require detective work to correlate it to you specifically. Second, if you are worried about people recording data broadcast by your WiFi router, it's up to you to secure your network. I would be much more concerned about a neighbor snooping on my traffic. What did people imagine that Google was doing with these random snippets of data?

henriquez 7y ago
> if you are worried about people recording data broadcast by your WiFi router, it's up to you to secure your network So that makes it okay for Google to Hoover up? This attitude is why a lot of people are angry at big tech right now. Elitism and arrogance bordering on hubris, but zero self awareness.
- _jal 7y ago
  "If it is not clearly illegal, I have a god-given right to monetize it and then try to exclude you from it." -- FB, Google, et al on the Commons To be fair, it isn't just them. A disturbingly large number of people in the US appear to believe acknowledging any commonweal is counter to national ideology.
  - renewiltord 7y ago
    It is clearly a general belief everywhere that if you can get some utility out of something and you can manage to do that for free then you should. HN does it with paywall bypasses, piracy, etc. Completely unsurprising that if you take a group of people, each of whom individually believe in deriving utility from things they can get with or without permission, then that collective group also behaves in the same manner.
  - shadowgovt 7y ago
    Nobody's excluded from doing their own wardriving and data-collection on open SSID network names, as far as I'm aware. Hell, if someone just wanted to drive around and record the radio flux sans information, perhaps to build a fun map correlating population density or income levels to broadcast emissions, that's perfectly fair.
ashtonkem 7y ago
I’m kind of surprised that you’re surprised by it. Outrage over privacy violations has very little to do with the actual harm that the privacy violation causes, and much more to do with whether or not it seems to violate a prior expectation of anonymity or privacy. This concept is even enshrined in US jurisprudence; the “expectation of privacy” is a big factor in how privacy works in America. Back to Google. The problem isn’t that they captured packets or SSIDs; the problem is that they captured it sitting outside your house. With that change it feels like Google has gone from taking photos of the city that you might be in, to sitting in the bushes taking pictures of your house.
- judge2020 7y ago
  > the “expectation of privacy” is a big factor in how privacy works in America. You might expect privacy in your home, but if someone looks through your window when passing by and you exchange glances, you likely aren't going to call law enforcement because they violated that expectation of privacy. Of course, if something revealing or private was observed when that happened, or if they were specifically looking someplace people don't just look (eg. upstairs window) it might warrant filing a police report, but my point is that, based on the articles linked in this thread, Google was sniffing all packets without malice or intent.
  - ashtonkem 7y ago
    This is neither about intent nor the letter of the law, it’s about perception and outrage. It doesn’t matter if it’s legal and without malice, it feels creepy in a way that their regular internet behavior does not. It’s also impossible to verify what Google will do with that data now or forever. They say they’re doing it in good faith, but then again everyone says that. How can you verify that, and do you trust them with it forever?
    - ForHackernews 7y ago
      > in a way that their regular internet behavior does not. Counterpoint: I think if most regular people understood the extent of Google's other surveillance behavior, they would also find it creepy.
72deluxe 7y ago
Does that mean you'd be alright with me sitting outside your house taking photos of it and scanning for network signals coming from your house and running a software radio receiver to see what you've got going on inside? If not, why are you alright with Google doing it?
- chrisdhal 7y ago
  If you are in the street, then yes, that is considered "public" and there's really not much I can do about it. I have zero expectation of privacy if you take pictures of the front of my house from a public area. If my WiFi signal reaches the street, then, again, that's a public area. I may not like it, but doing it from a public area is perfectly legal (in the US at least). Now, you can't come onto my lawn to get a better signal, but there's really not much I could do if you parked on the street in front of my house.
  - judge2020 7y ago
    Someone doing so would potentially violate wiretap laws, probably also stalking depending on the state.
    - vntok 7y ago
      No they would not. Not until you actually went to the police station, got them to open a case, got an injunction and the "culprit" would get served with a formal notice. Then if they kept doing that would they potentially be in breach.
      - judge2020 7y ago
        I agree that detecting and pursuing this is unlikely to happen but it's still likely a violation of state wiretap laws and/or stalking. Anyone that wanted to do this would just lay a rpi with cellular and a battery so they don't need to be right outside your house all the time, making it both hard to detect and untraceable.
  - 7y ago
freefriedrice 7y ago
Not directed at you personally, just "you" generally: unless you're not using PSK or WEP, no one is snooping anything meaningful from your Wi-Fi traffic. WPA can be cracked by collecting enough handshake info to create enough hashes you can then set some GPUs from the cloud on in a matter of days. WPA2 (and enterprise) are not crackable unless you are a government. And even if a malicious person gets your passkey, HTTPS is pretty damn near impenetrable. Source: I've been to DefCon for the past 7 years, and with the exception of TLSv1.3 replay or trying to hijack global DNS routers or compromise CAs, which either require the stars to align, military style infiltration, or non-existant computing, you're safe. You're far more likely to be hacked by a phone call pretending to be your bank, or by a fake AirBNB scam. Or someone stealing your mail. Ok internet: prove me wrong. Where are your WPA2 and TLSv1.3 hacks that anyone can do?
vmception 7y ago
nah its just kind of creepy the multiple ways that Google and services assign a GPS location to your SSID that has nothing to do with sniffing packets or network security
sitkack 7y ago
It was effectively a Wifi Stingray and MITM peoples connections so they could form a baseline of what people in that local were doing with their internet connections at the time the street view car passed. It most certainly broke connections. Multiple levels of unethical, how this ever got past anyone at Google stumps me.
- shaftway 7y ago
  Can you provide a citation? I haven't heard any evidence that they were actively interfering in connections, only recording what was broadcast in the clear.

MertsA 7y ago

To add to the other responses, the reason why they were capturing sensitive data was most likely because instead of doing filtering and processing live while they were driving around they chose to just deal with that after the fact and process the WiFi data through whatever system they already had for post processing. Even with just recording the SSIDs and timestamps on the vehicle all of the data that was controversial would still be captured by the radio on the vehicle, it would just be discarded immediately instead of being discarded when the Google maps vehicle offloaded that data for processing. If Google wanted to do something nefarious, they could still turn it back on all in software. The only real privacy gain is that they can't retroactively do it but I doubt even originally that they kept the packet dumps around for too long after processing it.

shadowgovt 7y ago
Based on the reporting at the time, it sounds like it was unintentional; they were capturing the raw packets to a debug file that wasn't even routed for post-processing.