Google Street View secretly took your wi-fi details... and will use the data to target ads at mobile phones

By Jason Lewis, Mail on Sunday Security Editor
Last updated at 10:23 PM on 29th May 2010
Google is facing renewed privacy concerns after it secretly mapped every single wireless internet connection in Britain – including those in millions of homes – to help it sell advertising and other services.
The move was part of the search engine’s controversial Street View project, which drew widespread criticism after it photographed people’s houses and published the images on the internet.
Now it has been revealed that the firm had failed to disclose that it was simultaneously building a massive database of individual home wi-fi networks across the UK and in other countries.
As Google’s distinctive fleet of cars, fitted with roof-mounted cameras, cruised Britain’s streets over the past three years photographing every house and public building, antennae inside were also pinpointing the wi-fi hotspots.

There were earlier reports that Google had admitted accidentally collecting some emails from ‘open’ wireless networks. But The Mail on Sunday today reveals how – and why – the company has collected details of all wi-fis, even those protected by security.
Last night the firm, one of the world’s most powerful companies and worth £28billion, admitted that it should have been ‘more transparent’ about the full extent of the project and pledged to stop mapping any new personal wireless networks in future.
But it said it would not delete the information it had already obtained from the Street View project which now covers almost every road in Britain.
Personal wireless equipment – known as a router – allows people to access the internet from anywhere in their homes without plugging laptops and other devices into a telephone point.

 

More...

• MAIL ON SUNDAY COMMENT: Here comes Big Brother... wearing jeans

However, the broadcast signal is not confined by the walls of a property and its footprint will often spill into neighbouring buildings and the street outside.
Internet providers encourage people to set up passwords to prevent anyone from using their web connection without their knowledge or potentially gaining access to personal information held on their computers.
But, even with a password in place, Google was able, without alerting anyone in advance or seeking any permission, to log the locations of all these wi-fi networks noting their names, called SSIDs, and the unique MAC, or Media Access Control, address of people’s personal equipment.
There are fears – dismissed as ‘conspiracy theories’ by Google officials – that personal information, together with the precise location of specific computer devices mapped by the firm, could be cross-referenced to track individuals’ internet use for commercial reasons.
The internet giant, which made profits of £4.5billion last year, says it is now using the data it gathered to offer location-based commercial services and advertising to mobile phone users and people with other portable devices, including Apple’s much-hyped iPad.

Watch out, Google's about: Street View swivels around Parliament Square looking towards Big Ben from every possible viewpoint

Software and phone ‘applications’ can pinpoint exactly where a mobile or computer device is by triangulating its position with the nearest wireless hot spots either at businesses or private addresses.
Google’s Mobile App, for example, allows users to link directly to restaurants and shops, find cinemas and theatres and hotels in their area and even to track the precise location of their friends and display information on their recent movements.
The search engine makes money by selling advertising attached to its internet maps and other content on its site, and also charges business when customers ‘click through’ to their websites to book a table or reserve a hotel room.
Using the wi-fi hotspot locations means Google can pinpoint users more precisely and more cheaply than using mobile phone masts or global positioning satellites.
According to its website, Google advertisers can ‘connect with the right customer at the right moment, wherever they are’.
It adds: ‘Is your customer just around the corner from you? Mobile users’ locations can be pinpointed with metre-level accuracy. Advertisers can easily target or tailor your message according to location and automatically show your customer relevant local store information, like phone numbers and addresses, to enable them to take immediate action.’
The concern about Google’s new system has also raised questions about other less well-known firms who have been quietly building up their own database.
One, Skyhook, says it has collected its information by ‘deploying drivers to survey every single street, highway, and alley in tens of thousands of cities and towns worldwide, scanning for wi-fi access points and cell towers plotting their precise geographic locations’.
There are also fears about possible future uses of the information, which could include users being targeted by unsolicited local advertising sent to them automatically as they walk or drive down a specific street.
For example, an automatic message paid for by a multinational coffee shop chain could be sent saying: ‘Feeling thirsty? You’re just 100 yards from our nearest coffee shop.’
Details of this secret side of the Street View project emerged this month after German regulators demanded details of the data Google was collecting on its citizens as it mapped the country for its version of Street View.

A Google street-mapping car in Bristol: Antennae inside were also pinpointing residential wi-fi hotspots

It was only then that the California-based multinational revealed that it was mapping people’s wi-fi networks and in some cases had inadvertently downloaded people’s personal information, including emails and web browsing history.
The German regulator, and also the Information Commissioner’s Office in Britain, have now ordered Google to delete this personal data.
And the firm is also facing a series of court cases in America over the issue, with one lawyer, Robert Carp, who is representing a Massachusetts internet firm, saying that the secret data collection was ‘nothing more than a further attempt to enhance their advertising capabilities’.
He added: ‘Whether information that is sent over someone’s private network is encrypted or not, no one has a right to access it, decode it, and use it for any purpose.’
US privacy campaigners are urging the country’s Federal Communications Commission to investigate Google for ‘wiretap’ offences for what they say amounts to illegally intercepting people’s personal communications.
Last night, British privacy campaigners were urging the Information Commissioner’s Office and Government to intervene.
Human rights group Privacy International said Google was trying to put a spin on the story as being about its mistake in capturing of fragments of people’s emails and internet searches, saying it was ‘sorry’ and would delete it.
A spokesman for the campaign group said: ‘We are deeply unsettled by Google’s assertion that this situation was caused by a mere “mistake” brought about by accidental use of inappropriate code developed for sniffing the content of wi-fi networks. This explanation to us seems entirely implausible.
‘Only a full-scale audit will help uncover the facts. This is a disappointing chapter in Google’s history.’
The group said Google should delete the ‘intrusive’ information it had mapped on people’s personal computer network.
The spokesman added: ‘This is a very serious matter and regulators need to place limits on the use of this private identification without consent.
‘The ghost of Street View continues to haunt Google.
‘We think it will historically be viewed as a horrendous breach of law and something which a better regulator with a better understanding of the issues and the technology would never have allowed to happen.
'There should be a parliamentary inquiry which should question Google and finally get it to explain what it is up to both technically and commercially.
‘The idea that it can log everyone’s wi-fi details because it is all “public” is a bogus argument. It is bogus because of the question of scale and the question of integration with other information which would amount to a huge breach of our privacy.
'The regulator, the ICO, is equally to blame for this mess as it has totally failed to grasp the implications of what Google has been doing.’
Last night, Google acknowledged that it should have been more open about what it was doing, but was unrepentant about its decision to build the database of home internet connections for its commercial use.
Peter Barron, the ex-BBC Newsnight editor who is now head of Google’s corporate affairs department in Britain, said: ‘We collect wi-fi network information to improve location-based services like Google Maps.
'For example, people can identify their approximate location based on the wi-fi access points which are visible to their mobile device.
‘Many other companies have been collecting data like this for as long as, if not longer than, Google. We don’t collect any information about householders, we can’t identify an individual from the location data Google collects via its Street View cars, and we don’t publish this information.
'This is publicly broadcast information which is accessible to anyone with a wi-fi-enabled device, but we accept in hindsight it would have been better to be more transparent about what we collect.’
Asked why Google had failed to announce its decision to map people’s home networks, he added: ‘Given that this information is accessible to any wi-fi-enabled device, we didn’t think it was necessary.’
He promised that Google would never use the information gathered for any other purpose and added that it was not technically possible to use the details to trace individual internet users and their searches on the Google network with the data they had gathered. He added: ‘We make privacy a priority because our business depends on it.’
Despite Google’s failure to alert British authorities to the massive project, the Information Commissioner’s Office said it was merely watching the situation closely.
A spokesman for the ICO, which is already facing criticism for not investigating the computer firm in more detail over its capture of people’s emails and other personal information, said: ‘We are aware that the collection of information by Google Street View cars has raised a number of issues which we are considering.
‘All organisations that process personal information must comply with the requirements of the Data Protection Act.
‘Organisations are only permitted to collect data for a specific purpose. Similarly, organisations must only retain data for as long as necessary.
‘If we find evidence of significant wrongdoing, we will of course investigate and consider what action should be taken.’