6 ms·

Data Engineer in Google Case Is Identified - author of NetStumbler

46 points by hinathan 14y ago

branola 14y ago
Depicting his actions as the work of a rogue “requires putting a lot of dots together,” Mr. Milner said enigmatically Sunday before insisting again he had no comment. It doesn't sound particularly enigmatic to me. It seems like Milner is clearly saying that Google deliberately misrepresented his behavior as a rogue action to facilitate their legal self-protection when in fact it's obvious from their choice of the author of NetStumbler to work on Street View that his designated role was likely to involve making use of his expertise with Wi-Fi networks.
- jack-r-abbit 14y ago
  Of course they hired a WiFi expert for their WiFi-related project. But that doesn't mean their claim of rogue behavior is simply self-protection. What if they hired him for his expertise with Wi-Fi and told him they only wanted to collect the minimal amount of data but he went rogue and collected ALL the data anyway? But I'm with those people that think the freely broadcast unencrypted packets are in the public domain and Google didn't do anything illegal.
  - deleted 14y ago
    [deleted]
    - RegEx 14y ago
      Not the best source, but it gives you the gist of things: http://www.pcworld.com/article/196397/googles_wifi_spying_what_were_they_thinking.html http://www.pcworld.com/article/196397/googles_wifi_spying_wh...
    - wmf 14y ago
      Sigh. They're not related per se, but the same cars were used to collect street view photos and SSID->location mappings (used for Android positioning).
- samstave 14y ago
  Exactly. Utter BS. The company that claims to be the smartest people in the world just haphazardly put this guy on this project. Not a chance.
  - brudgers 14y ago
    With the resources devoted to Streetview, it is unlikely that the software running it was a 20% time project by the time it was deployed.
deleted 14y ago
[deleted]
epochwolf 14y ago
What is the point in publicly naming an the engineer in this case? How does this benefit the public good?
- whackberry 14y ago
  > What is the point in publicly naming an the engineer in this case? How does this benefit the public good? The public has the right to know. Otherwise, who decides what should be public or not, the ministry of big brother?
  - derefr 14y ago
    Well, usually, the individual who comes into possession of the information decides whether it should be public, using their own sense of ethics. And questions like "how does this benefit the public good?" are precisely the kind of thing used as input to that ethical calculation.
  - ok_craig 14y ago
    The public doesn't have the right to know, since no law was broken. The engineer was identified by a "former state investigator [who] spoke on the condition that he not be identified because he was not authorized to speak."
    - whackberry 14y ago
      > no law was broken. We don't know that yet, do we?
      - ok_craig 14y ago
        Yes we do, it's in the second paragraph of the article. "The F.C.C. recently closed its 17-month inquiry into the project, Street View, with a finding that Google broke no laws but had obstructed its investigation." Even if we didn't, that's also a reason for not disclosing this person's identity: innocent until proven guilty.
stevenplatt 14y ago
The data collection, which took place over three years, was legal because the information was not encrypted, the F.C.C. ultimately determined. Interesting how this works. If I went wardriving and collected personal emails from unencrypted networks, I'd have my house rummaged by FBI agents, be hit with a 25,000-count felony wiretapping indictment and have some go-getter federal prosecutor try to convince a judge to sentence me to 7,000 years in prison. Then an appeals court might say reverse on the grounds that it was unencrypted. Maybe. Google does it? A slap on the wrist and a small fine for "obstructing an investigation."
- epikur 14y ago
  Why/how would the FBI be notified? Capturing packets from an unsecured wifi network doesn't exactly ring alarm bells.
- kinghajj 14y ago
  That's because the software Google used didn't actively browse the networks to look for documents, but passively intercepted and logged packets. If they wrote a program that actually searched the networks for shared folders and copied information that way, then conceivably they could be guilty of unauthorized computer access.
  - whackberry 14y ago
    > That's because the software Google used didn't actively browse the networks to look for documents Do we know that for a fact? Sorry if well known, genuine question.
    - 1010011010 14y ago
      When did you stop beating your wife? How do we know for a fact?
      - whackberry 14y ago
        > When did you stop beating your wife? How do we know for a fact? I never was accused of that. Silly response. Google has been accused of several privacy violations.
jlawer 14y ago
It feels to me like they were just logging everything for future analysis so they don't have to come back and do a second pass when they upgrade their software. But then again I'm sorry, I have never seen what the big deal was about this. If you broadcast your crap around you can't blame people for receiving it. Sure people's passwords may be in the data stream, but they broadcast it over an open connection. If your going to blame anyone blame the electronics shop sales guy, the hardware vendor and the TV "experts" that tell people that using an unencrypted wifi access point is completely reasonable.
- whackberry 14y ago
  > But then again I'm sorry, I have never seen what the big deal was about this. You don't see what the deal is with a major corporation doing wardriving and packet capturing? > If you broadcast your crap around you can't blame people for receiving it. By your logic then if someone gets robbed on the streets, then it's their fault for "walking around freely"?
  - lukeschlather 14y ago
    No one was deprived of anything other than privacy. Yes, if you broadcast radio waves you shouldn't expect them to remain private.
  - fennecfoxen 14y ago
    If by "robbed" you mean "overheard", maybe we can get somewhere by analogizing.
  - derefr 14y ago
    > By your logic then if someone gets robbed on the streets, then it's their fault for "walking around freely"? Well, to more strictly match the analogy--if someone is walking around with a purse that is constantly leaking coins, and they get "robbed" (by someone finding some of said coins and wandering off with them), then I would say that that is their own fault, yes.
    - 14y ago
beder 14y ago
> On his LinkedIn page, Mr. Milner lists his occupation as “hacker,” and under the category called “Specialties,” his entry reads, “I know more than I want to about Wi-Fi.” While I don't know for sure which use of the word "hacker" Milner intends, the author of this article ought to have added a line like, "Software engineers use the word 'hacker' in a positive, non-malicious sense...", since this is effectively taking his words out of context.
- elliotanderson 14y ago
  Same can be said for knowing too much. I know way too much about PHP, doesn't mean that there is anything malicious about it
hkmurakami 14y ago
>On his LinkedIn page, Mr. Milner lists his occupation as “hacker,” and under the category called “Specialties,” his entry reads, “I know more than I want to about Wi-Fi.” I am more than moderately offended/troubled/irked by this excerpt, as it appears to deliberately depict the engineer as a "hacker" in the sense of Hollywood culture, rather than "hacker" as we know it in makers' terms. In the wrong hands, the English language is much more potent and destructive than any programming language. An English Specialist can often cause more harm than a Wi-Fi Specialist.
- brudgers 14y ago
  Given that he developed a "wardriving" application, black hat connotations are not entirely unreasonable. The use of his talents to hoover up data without permission certainly doesn't offer much in the way of defense, either.
  - magicalist 14y ago
    Ha, your parent post could almost have been written about your post too. Looking past the scare quotes, according to the FCC report it was just Kismet, and the problem basically just came down to deciding to write the non encrypted payloads to disk. He might know too much about wifi, but probably half the regular HN posters could have implemented the same system, if they chose to.
    - goodgracious 14y ago
      "if they chose to" Precisely. I know Kismet exists. I know I can install and run it. I know I can even break wi-fi encryption in some cases. But that doesn't mean I'm going to do this, for commercial purposes, for a company like Google.
      - magicalist 14y ago
        Yes, it comes down to a choice, not scary hackers. That's what I wrote. Maybe I'm not understanding your point?
kevinpet 14y ago
"The F.C.C. report also had Engineer Doe spelling out his intentions quite clearly in his initial proposal. Managers of the Street View project said they never read it." I think the authors intended this to be read as 'wink wink yeah sure', but this sounds entirely plausible on both sides. The more detailed the spec is, the less likely anyone will read it. They probably just forwarded it around and assumed someone competent to render an opinion would raise a red flag if anything were not well thought out.
- martey 14y ago
  The issue is that it is not just the initial proposal. As the NYTimes article points out in the previous paragraph, and the complete FCC report [1] clearly states, there were additional events after the proposal was submitted where other members of the Street View team came in contact with the actual code while doing code review or debugging, but later claimed during interviews with the FCC that they were unaware that it was collecting data. On page 15, the report even mentions "Engineer Doe" sending an email to a manager stating, "You might recall asking me about URLs seen over Wi-Fi...", and talking about the number of unique URLs retrieved (only 32,000 from 300 million packets). The manager asked if the URLs were sniffed from WiFi packets, and Doe responded in the affirmative. [1]: http://s3.documentcloud.org/documents/351298/fcc-report-on-googles-street-view.pdf http://s3.documentcloud.org/documents/351298/fcc-report-on-g...
drucken 14y ago
The engineer who created this system is completely irrelevant since the production implementation of Street View collected all data. The fault lies solely with Google whether by intent, lack of legal or legal ethics advice, lack of technical oversight, or management incompetence etc. This also seems to be the regulator's view. However, Google itself and, of course, the media are quite happy to muddy the waters with a bit of "gone rogue" nonsense, though for differing reasons.

46 points by hinathan 14y ago

Depicting his actions as the work of a rogue “requires putting a lot of dots together,” Mr. Milner said enigmatically Sunday before insisting again he had no comment. It doesn't sound particularly enigmatic to me. It seems like Milner is clearly saying that Google deliberately misrepresented his behavior as a rogue action to facilitate their legal self-protection when in fact it's obvious from their choice of the author of NetStumbler to work on Street View that his designated role was likely to involve making use of his expertise with Wi-Fi networks.

jack-r-abbit 14y ago
Of course they hired a WiFi expert for their WiFi-related project. But that doesn't mean their claim of rogue behavior is simply self-protection. What if they hired him for his expertise with Wi-Fi and told him they only wanted to collect the minimal amount of data but he went rogue and collected ALL the data anyway? But I'm with those people that think the freely broadcast unencrypted packets are in the public domain and Google didn't do anything illegal.
- deleted 14y ago
  [deleted]
  - RegEx 14y ago
    Not the best source, but it gives you the gist of things: http://www.pcworld.com/article/196397/googles_wifi_spying_what_were_they_thinking.html http://www.pcworld.com/article/196397/googles_wifi_spying_wh...
  - wmf 14y ago
    Sigh. They're not related per se, but the same cars were used to collect street view photos and SSID->location mappings (used for Android positioning).
samstave 14y ago
Exactly. Utter BS. The company that claims to be the smartest people in the world just haphazardly put this guy on this project. Not a chance.
- brudgers 14y ago
  With the resources devoted to Streetview, it is unlikely that the software running it was a 20% time project by the time it was deployed.

deleted 14y ago

[deleted]

epochwolf 14y ago

What is the point in publicly naming an the engineer in this case? How does this benefit the public good?

whackberry 14y ago
> What is the point in publicly naming an the engineer in this case? How does this benefit the public good? The public has the right to know. Otherwise, who decides what should be public or not, the ministry of big brother?
- derefr 14y ago
  Well, usually, the individual who comes into possession of the information decides whether it should be public, using their own sense of ethics. And questions like "how does this benefit the public good?" are precisely the kind of thing used as input to that ethical calculation.
- ok_craig 14y ago
  The public doesn't have the right to know, since no law was broken. The engineer was identified by a "former state investigator [who] spoke on the condition that he not be identified because he was not authorized to speak."
  - whackberry 14y ago
    > no law was broken. We don't know that yet, do we?
    - ok_craig 14y ago
      Yes we do, it's in the second paragraph of the article. "The F.C.C. recently closed its 17-month inquiry into the project, Street View, with a finding that Google broke no laws but had obstructed its investigation." Even if we didn't, that's also a reason for not disclosing this person's identity: innocent until proven guilty.

stevenplatt 14y ago

The data collection, which took place over three years, was legal because the information was not encrypted, the F.C.C. ultimately determined. Interesting how this works. If I went wardriving and collected personal emails from unencrypted networks, I'd have my house rummaged by FBI agents, be hit with a 25,000-count felony wiretapping indictment and have some go-getter federal prosecutor try to convince a judge to sentence me to 7,000 years in prison. Then an appeals court might say reverse on the grounds that it was unencrypted. Maybe. Google does it? A slap on the wrist and a small fine for "obstructing an investigation."

epikur 14y ago
Why/how would the FBI be notified? Capturing packets from an unsecured wifi network doesn't exactly ring alarm bells.
kinghajj 14y ago
That's because the software Google used didn't actively browse the networks to look for documents, but passively intercepted and logged packets. If they wrote a program that actually searched the networks for shared folders and copied information that way, then conceivably they could be guilty of unauthorized computer access.
- whackberry 14y ago
  > That's because the software Google used didn't actively browse the networks to look for documents Do we know that for a fact? Sorry if well known, genuine question.
  - 1010011010 14y ago
    When did you stop beating your wife? How do we know for a fact?
    - whackberry 14y ago
      > When did you stop beating your wife? How do we know for a fact? I never was accused of that. Silly response. Google has been accused of several privacy violations.

jlawer 14y ago

It feels to me like they were just logging everything for future analysis so they don't have to come back and do a second pass when they upgrade their software. But then again I'm sorry, I have never seen what the big deal was about this. If you broadcast your crap around you can't blame people for receiving it. Sure people's passwords may be in the data stream, but they broadcast it over an open connection. If your going to blame anyone blame the electronics shop sales guy, the hardware vendor and the TV "experts" that tell people that using an unencrypted wifi access point is completely reasonable.

whackberry 14y ago
> But then again I'm sorry, I have never seen what the big deal was about this. You don't see what the deal is with a major corporation doing wardriving and packet capturing? > If you broadcast your crap around you can't blame people for receiving it. By your logic then if someone gets robbed on the streets, then it's their fault for "walking around freely"?
- lukeschlather 14y ago
  No one was deprived of anything other than privacy. Yes, if you broadcast radio waves you shouldn't expect them to remain private.
- fennecfoxen 14y ago
  If by "robbed" you mean "overheard", maybe we can get somewhere by analogizing.
- derefr 14y ago
  > By your logic then if someone gets robbed on the streets, then it's their fault for "walking around freely"? Well, to more strictly match the analogy--if someone is walking around with a purse that is constantly leaking coins, and they get "robbed" (by someone finding some of said coins and wandering off with them), then I would say that that is their own fault, yes.
  - 14y ago

beder 14y ago

> On his LinkedIn page, Mr. Milner lists his occupation as “hacker,” and under the category called “Specialties,” his entry reads, “I know more than I want to about Wi-Fi.” While I don't know for sure which use of the word "hacker" Milner intends, the author of this article ought to have added a line like, "Software engineers use the word 'hacker' in a positive, non-malicious sense...", since this is effectively taking his words out of context.

elliotanderson 14y ago
Same can be said for knowing too much. I know way too much about PHP, doesn't mean that there is anything malicious about it

hkmurakami 14y ago

>On his LinkedIn page, Mr. Milner lists his occupation as “hacker,” and under the category called “Specialties,” his entry reads, “I know more than I want to about Wi-Fi.” I am more than moderately offended/troubled/irked by this excerpt, as it appears to deliberately depict the engineer as a "hacker" in the sense of Hollywood culture, rather than "hacker" as we know it in makers' terms. In the wrong hands, the English language is much more potent and destructive than any programming language. An English Specialist can often cause more harm than a Wi-Fi Specialist.

brudgers 14y ago
Given that he developed a "wardriving" application, black hat connotations are not entirely unreasonable. The use of his talents to hoover up data without permission certainly doesn't offer much in the way of defense, either.
- magicalist 14y ago
  Ha, your parent post could almost have been written about your post too. Looking past the scare quotes, according to the FCC report it was just Kismet, and the problem basically just came down to deciding to write the non encrypted payloads to disk. He might know too much about wifi, but probably half the regular HN posters could have implemented the same system, if they chose to.
  - goodgracious 14y ago
    "if they chose to" Precisely. I know Kismet exists. I know I can install and run it. I know I can even break wi-fi encryption in some cases. But that doesn't mean I'm going to do this, for commercial purposes, for a company like Google.
    - magicalist 14y ago
      Yes, it comes down to a choice, not scary hackers. That's what I wrote. Maybe I'm not understanding your point?

kevinpet 14y ago

"The F.C.C. report also had Engineer Doe spelling out his intentions quite clearly in his initial proposal. Managers of the Street View project said they never read it." I think the authors intended this to be read as 'wink wink yeah sure', but this sounds entirely plausible on both sides. The more detailed the spec is, the less likely anyone will read it. They probably just forwarded it around and assumed someone competent to render an opinion would raise a red flag if anything were not well thought out.

martey 14y ago
The issue is that it is not just the initial proposal. As the NYTimes article points out in the previous paragraph, and the complete FCC report [1] clearly states, there were additional events after the proposal was submitted where other members of the Street View team came in contact with the actual code while doing code review or debugging, but later claimed during interviews with the FCC that they were unaware that it was collecting data. On page 15, the report even mentions "Engineer Doe" sending an email to a manager stating, "You might recall asking me about URLs seen over Wi-Fi...", and talking about the number of unique URLs retrieved (only 32,000 from 300 million packets). The manager asked if the URLs were sniffed from WiFi packets, and Doe responded in the affirmative. [1]: http://s3.documentcloud.org/documents/351298/fcc-report-on-googles-street-view.pdf http://s3.documentcloud.org/documents/351298/fcc-report-on-g...

drucken 14y ago

The engineer who created this system is completely irrelevant since the production implementation of Street View collected all data. The fault lies solely with Google whether by intent, lack of legal or legal ethics advice, lack of technical oversight, or management incompetence etc. This also seems to be the regulator's view. However, Google itself and, of course, the media are quite happy to muddy the waters with a bit of "gone rogue" nonsense, though for differing reasons.