4 ms·

I would readily buy that if they didn't also, you know, sniff network contents and then attempt to obscure that fact. > The unredacted FCC report refers to a G

I would readily buy that if they didn't also, you know, sniff network contents and then attempt to obscure that fact. > The unredacted FCC report refers to a Google "design document" written by an engineer who crafted the Street View software to collect so-called payload data, which includes telephone numbers, URLs, passwords, e-mail, text messages, medical records, video and audio files sent over open Wi-Fi networks. https://www.wired.com/2012/05/google-wifi-fcc-investigation/ https://www.wired.com/2012/05/google-wifi-fcc-investigation/

shadowgovt 7y ago
Reading the linked Wired article leaves me wanting to read the design doc for myself; I don't agree with (Wired's synopsis of) the FCC regulator's interpretation of the document they read. From the quoted bit of the FCC doc: """ In a discussion of 'Privacy Considerations,' the design document states, 'A typical concern might be that we are logging user traffic along with sufficient data to precisely triangulate their position at a given time, along with information about what they were doing.' That statement plainly refers to the collection of payload data because MAC addresses, SSIDs, signal-strength measurements. and other information used to map the location of wireless access points would reveal nothing about what end users 'were doing.'" """ I disagree with that assessment. If you're a Google engineer writing the privacy section of the design doc, you're encouraged to blue sky possible abuse scenarios, even unlikely ones. That quote, to me, reads not as admission that packet capture was part of the design, but that SSID, MAC address, and signal strength measurement alone could be enough to make ballpark guesses on what a user was doing (MAC addresses, for example, are issued to specific device vendors, so knowing my MAC address is chatting to my wifi, and no other information, could be used to make an educated guess as to whether I'm watching TV if you see heavy traffic between my wifi and a device advertising a MAC address that tends to show up in a Samsung smart TV product line). I think the FCC investigator lacked imagination here. ;) You'll note what the quote omits, which is any section of the design document that says something like "Full data packets will be captured and stored for future analysis." That's a glaring omission if full-packet data capture were part of the actual design, and the quote appears to be an FCC investigator attempting to read between the lines.
- ethanbond 7y ago
  We would have a lot more clarity here if the following hadn't occurred: 1. Google sniffed the packets 2. Google stonewalled the investigation (receiving a $25k fine for doing so) 3. Google ignored the recommendation to have counsel review the design But those things did occur, so I believe it is a leap of faith to simply accept their word that 2 years of wardriving people's wifi traffic was "an accident."
  - shadowgovt 7y ago
    I've done too much engineering on large-scale projects with cross-office stakeholders for that leap to require any faith; it aligns with my own experience. ;) It doesn't take more than a handful of misconfigured flags to find out you've been accidentally logging every packet going through your router. The backstop against that is usually I'd run out of storage space, and Google certainly doesn't. The product counsel oversight failure was a major error in this project. It's the specific step that's supposed to help Google avoid $25k fines, and I don't doubt someone internally got their head thunked over that.
    - gowld 7y ago
      It wasn't an accident. https://www.wired.com/images_blogs/threatlevel/2012/05/unredactedfccgoog.pdf https://www.wired.com/images_blogs/threatlevel/2012/05/unred...
      - shadowgovt 7y ago
        Good find; this is much more informative. Clearly not accidental. Though still definitely an error; product council would have told them to knock it off, and it's unclear whether it was maliciousness or ignorance that nobody brought them in for consult.
- gowld 7y ago
  You can read the details here: https://www.wired.com/images_blogs/threatlevel/2012/05/unredactedfccgoog.pdf https://www.wired.com/images_blogs/threatlevel/2012/05/unred... including (on page 15) quotes from emails that state "We store the whole body of all non-encrypted frames" and discussed an analysis of HTTP URLs extracted from sniffed wifi data.

shadowgovt 7y ago

Reading the linked Wired article leaves me wanting to read the design doc for myself; I don't agree with (Wired's synopsis of) the FCC regulator's interpretation of the document they read. From the quoted bit of the FCC doc: """ In a discussion of 'Privacy Considerations,' the design document states, 'A typical concern might be that we are logging user traffic along with sufficient data to precisely triangulate their position at a given time, along with information about what they were doing.' That statement plainly refers to the collection of payload data because MAC addresses, SSIDs, signal-strength measurements. and other information used to map the location of wireless access points would reveal nothing about what end users 'were doing.'" """ I disagree with that assessment. If you're a Google engineer writing the privacy section of the design doc, you're encouraged to blue sky possible abuse scenarios, even unlikely ones. That quote, to me, reads not as admission that packet capture was part of the design, but that SSID, MAC address, and signal strength measurement alone could be enough to make ballpark guesses on what a user was doing (MAC addresses, for example, are issued to specific device vendors, so knowing my MAC address is chatting to my wifi, and no other information, could be used to make an educated guess as to whether I'm watching TV if you see heavy traffic between my wifi and a device advertising a MAC address that tends to show up in a Samsung smart TV product line). I think the FCC investigator lacked imagination here. ;) You'll note what the quote omits, which is any section of the design document that says something like "Full data packets will be captured and stored for future analysis." That's a glaring omission if full-packet data capture were part of the actual design, and the quote appears to be an FCC investigator attempting to read between the lines.

ethanbond 7y ago
We would have a lot more clarity here if the following hadn't occurred: 1. Google sniffed the packets 2. Google stonewalled the investigation (receiving a $25k fine for doing so) 3. Google ignored the recommendation to have counsel review the design But those things did occur, so I believe it is a leap of faith to simply accept their word that 2 years of wardriving people's wifi traffic was "an accident."
- shadowgovt 7y ago
  I've done too much engineering on large-scale projects with cross-office stakeholders for that leap to require any faith; it aligns with my own experience. ;) It doesn't take more than a handful of misconfigured flags to find out you've been accidentally logging every packet going through your router. The backstop against that is usually I'd run out of storage space, and Google certainly doesn't. The product counsel oversight failure was a major error in this project. It's the specific step that's supposed to help Google avoid $25k fines, and I don't doubt someone internally got their head thunked over that.
  - gowld 7y ago
    It wasn't an accident. https://www.wired.com/images_blogs/threatlevel/2012/05/unredactedfccgoog.pdf https://www.wired.com/images_blogs/threatlevel/2012/05/unred...
    - shadowgovt 7y ago
      Good find; this is much more informative. Clearly not accidental. Though still definitely an error; product council would have told them to knock it off, and it's unclear whether it was maliciousness or ignorance that nobody brought them in for consult.
gowld 7y ago
You can read the details here: https://www.wired.com/images_blogs/threatlevel/2012/05/unredactedfccgoog.pdf https://www.wired.com/images_blogs/threatlevel/2012/05/unred... including (on page 15) quotes from emails that state "We store the whole body of all non-encrypted frames" and discussed an analysis of HTTP URLs extracted from sniffed wifi data.