Cyber Security Institute

§ Current Worries

Top 3 Worries

  • Regulations
  • Old Firewall Configurations
  • Security Awareness

§ Listening

For the best information

  • The underground
  • Audible
  • Executive Excellence
  • Music (to keep me sane)

§ Watching

For early warnings

  • 150 Security Websites
  • AP Newsfeeds
  • Vendors

Friday, May 21, 2010

Google halts deletion of Street View Wi-Fi data

Google has stopped deleting the personal data its Street View cars collected from open Wi-Fi networks, following what the company called “some uncertainty” over the deletion process.  For three years, Street View cars collected Wi-Fi payload data across 30 different countries.  Some countries have asked Google to delete the data - and in some cases, it has complied - while others have requested that the data be kept for the time being.  “On the instructions of the Irish data protection commissioner, Google destroyed all Wi-Fi data relating to collection in Ireland,” read an open letter from Privacy International to the European privacy commissioners earlier this week.  The action could be seen as collusion to destroy evidence.”

Google announced that despite earlier assurances to the contrary, Street View had been collecting payloads from open Wi-Fi networks as its cars drove across the globe snapping digital photos.  Previously, the company had said it was collecting only SSIDs that identified networks and MAC addresses that identified network hardware, but after German data protection authorities requested an audit of the program, Google says it discovered this was not the case.

In the blog post, Google called the payload data collection “a mistake,” and the company said it would ask a third party to review its data collection software and to confirm that it deleted the data appropriately.  “Given that there is some uncertainty about deletion generally, for example one DPA [data protection authority] changed its instruction from delete to retain in the last 24 hours, we think it makes sense to keep the remaining country data while we work through these issues,” the statement reads.  But the company was also under pressure from Privacy International and Brussels to halt deletion, and German authorities have already launched a preliminary criminal investigation into the data collection, as other countries consider such investigations, according to The FT.

This past Monday, Google updated its original blog post on the matter to say that it had already deleted data at the request of Ireland.  “Before my arrival, Google staff had consolidated the Wi-Fi packet captures onto four hard drives,” read the letter, signed by iSec partner Alex Stamos.

http://www.theregister.co.uk/2010/05/21/google_halts_wifi_payload_data_deletion/

Posted on 05/21
NewsPermalink