Google Van Logs WiFi, MAC addresses

[Ben]

I can't believe Google's CEO was stupid enough to make the comment he did.

-----------
Google Street View logs WiFi networks, Mac addresses

Why are you doing this?, ask Germans

By Andrew Orlowski (andrew.orlowski@theregister.co.uk)

Posted in Government, 22nd April 2010 15:46 GMT

Free whitepaper – Dell PowerEdge R710 solution with VMware ESX vs. Dell PowerEdge 2850 solution

Google's roving Street View spycam may blur your face, but it's got your number. The Street View service is under fire in Germany for scanning private WLAN networks, and recording users' unique Mac (Media Access Control) addresses, as the car trundles along.

Germany's Federal Commissioner for Data Protection Peter Schaar says he's "horrified" by the discovery.

"I am appalled… I call upon Google to delete previously unlawfully collected personal data on the wireless network immediately and stop the rides for Street View," according to German broadcaster ARD.

Spooks have long desired the ability to cross reference the Mac address of a user's connection with their real identity and virtual identity, such as their Gmail or Facebook account.

Other companies have logged broadcasting WLAN networks and published the information. By contrast Google has not published the WLAN map, or Street View in Germany; Google hopes to launch the service by the end of the year (http://www.theregister.co.uk/2010/03/02/google_germany/).

But Google's uniquely cavalier approach to privacy, and its potential ability to cross reference the information raises additional concerns. Google CEO Eric Schmidt recently said internet users shouldn't worry about privacy unless they have something to hide. And when there's nowhere left to hide...?

More from ARD here (http://meta.tagesschau.de/id/35447/datenschuetzer-entsetzt-ueber-google-street-view) and Der Spiegel, here (http://www.spiegel.de/netzwelt/web/0,1518,690600,00.html). The latter describes Google as a "data octopus". ®

[Bogie]

Okay - they have your MAC, what can they do with it? I'm thinking they're probably using it more as a designator cross-reffed with the street addy...
 
Personally, if I need to go online and I'm mobile, I just find a McDonalds, a Starbucks, a bookstore, or any of the jillions of other places that have wireless. Or park just outside a midrange hotel. I'm not going to cruise a suburb hoping for signal.
 

[AJ Dual]

I'm sure the intent is innocent enough, probably hoping to provide geolocation services for searching and maps so users are automatically given their current location when getting directions, searching for restaurants etc. if they happen to have a MAC Google has on file from their public access point/IP.

However of course, this is yet ANOTHER situation where they don't see how it can be abused until it gets found out, and people/EFF-types start screaming...  

Another thing people don't think about. The voice recognition for Google 411 was supposed to be a way for Google to "train" their voice recognition systems for rolling out Google Voice, speech to text dictation of voicemails etc... and for video dialogue phrase searching from within Google/YouTube videos themselves.

However, I see no reason they couldn't also tie voiceprint identification info to every phone number that ever calls them and issues enough voice commands to get a significant statistical sample. 

[Harold Tuttle]

Google Earth started as a CIA funded application called Keyhole Earthviewer...

[CNYCacher]

I fail to see what can be done with a MAC address, and I know a bit about networking.

[AJ Dual]

To a degree, the MORE info is out there, the safer you (or your privacy) is. Because eventually it becomes overwhelming, and you just get "lost in the noise". Unless of course, someone KNOWS what they're looking for on or about you.

And in that case, if they know what they want, and they were sufficiently motivated to begin with, there's plenty of ways to get all that scary and private information the "old fashioned" way. (public tax records, going through your garbage... whatever...)

IMO, the danger will come in when computer expert systems can start sussing out the things about people that you didn't even know to ask in the first place. Then it'll truly be time for tinfoil..  

I fail to see what can be done with a MAC address, and I know a bit about networking.

A lot of ISP's run multiple layers of LAT/NAT, and don't give out a "public" address for a user's connection or session until several steps away from their home, business, or the coffee shop etc. Depending on what you're trying to do, it becomes hard to identify someone if they're running through LAT/NAT and a bunch of 192.168.xxx.xxx, or 10.1.xxx.xxx internal private subnets.

If you know the MAC, you can still identify computer hardware by activity or by location in some circumstances.

http://en.wikipedia.org/wiki/Address_Resolution_Protocol

And it also makes all sorts of other stuff possible. Especially when you consider that 90% of the worlds "computers" are, or soon will be things like netbooks, iPads, phones/PDA's etc. that move about constantly. And not all of them may have OS's that allow for cookies etc. for Google to figure out who you are.

Ostensibly this is to be helpful. Say you have a iPhone or similar that was using WiFi part of the time, and the 3G network at others, and you have cookies disabled in your Safari mobile browser etc. Google wants to get around that. They want to be able to say "Hey! You're the same MAC address! You wanna see a listing of all the sex-toy shops and massage parlors within a five mile radius of your CURRENT location again?" etc. etc. etc...

Of course the darker side of such "help" is not difficult to imagine.

[GigaBuist]

If you know the MAC, you can still identify computer hardware by activity or by location in some circumstances.

http://en.wikipedia.org/wiki/Address_Resolution_Protocol

And it also makes all sorts of other stuff possible. Especially when you consider that 90% of the worlds "computers" are, or soon will be things like netbooks, iPads, phones/PDA's etc. that move about constantly. And not all of them may have OS's that allow for cookies etc. for Google to figure out who you are.

Keep in mind the MAC doesn't leave the physical network.  Once something comes out of your home router heading toward the internet NOBODY can figure out what MAC it came from except that router.

In order for them to geo-locate you with a map of WiFi networks and the MAC addresses of those WiFi adapters a device on the local network needs to report back to Google that MAC address outside the bands of normal communication.  My Android phone might very well be sending to Google that address.  I have no idea.

I turned Google Latitude services on in my wife's Google account the other day and somehow they knew where that machine was even.  Not sure how they did that though.  Could be that my phone was reporting back its GPS location and that it was connected to the same WiFi hotspot my wife was. *shrug*

[AJ Dual]

Keep in mind the MAC doesn't leave the physical network.  Once something comes out of your home router heading toward the internet NOBODY can figure out what MAC it came from except that router.

In order for them to geo-locate you with a map of WiFi networks and the MAC addresses of those WiFi adapters a device on the local network needs to report back to Google that MAC address outside the bands of normal communication.  My Android phone might very well be sending to Google that address.  I have no idea.

I turned Google Latitude services on in my wife's Google account the other day and somehow they knew where that machine was even.  Not sure how they did that though.  Could be that my phone was reporting back its GPS location and that it was connected to the same WiFi hotspot my wife was. *shrug*

Sorry, I wasn't explicit in that. Yes EXACTLY.

So collecting that data might be the first steps in getting around the fact MAC info does not travel beyond the first connection/subnet.

[Marnoot]

I turned Google Latitude services on in my wife's Google account the other day and somehow they knew where that machine was even.  Not sure how they did that though.  Could be that my phone was reporting back its GPS location and that it was connected to the same WiFi hotspot my wife was. *shrug*

Google Earth on my wife's IPod Touch figures out where we are pretty close most of the time, and the IPod has no GPS or phone-system to go off of; I assume it's using the cache of mapped WiFi MAC addresses to determine the location.

[AJ Dual]

Or it's going from the latitude/longitude put into the nearest gateway/router. Although that info is notoriously unreliable, since not everyone does it, either through oversight or through security concerns.

A very handy feature though in a large campus, or WAN, letting you draw up graphical maps of where everything is in the enterprise you're trying to administer.

[CNYCacher]

Google Earth on my wife's IPod Touch figures out where we are pretty close most of the time, and the IPod has no GPS or phone-system to go off of; I assume it's using the cache of mapped WiFi MAC addresses to determine the location.

I'm almost completely certain that ipod touches have GPS

[Azrael256]

iPod Touches do not have GPS.  It's SSID based.  Turn off all the SSID broadcasts in an area and it will fail.  I tested it with my mifi card.  It saw the municipal wireless and got me the right city, but nowhere near the house.  Turned my router back on, and it found me instantly.

As for the MAC and SSID collection, the difference between turning on a wifi router and a 30' tall neon sign with your MAC and SSID is purely semantic. I'll bet the government has fifty databases that correlate my name with my address, which is just as plainly visible, albeit at a different frequency.

If I made extraordinary efforts to shield the world from my wifi, that would be one thing.  Broadcasting it loudly enough to detect it half a block away is another entirely.

[bedlamite]

http://www.theonion.com/articles/google-responds-to-privacy-concerns-with-unsettlin,16891/

[alex_trebek]

iPod Touches do not have GPS.  It's SSID based.  Turn off all the SSID broadcasts in an area and it will fail.  I tested it with my mifi card.  It saw the municipal wireless and got me the right city, but nowhere near the house.  Turned my router back on, and it found me instantly.

As for the MAC and SSID collection, the difference between turning on a wifi router and a 30' tall neon sign with your MAC and SSID is purely semantic. I'll bet the government has fifty databases that correlate my name with my address, which is just as plainly visible, albeit at a different frequency.

If I made extraordinary efforts to shield the world from my wifi, that would be one thing.  Broadcasting it loudly enough to detect it half a block away is another entirely.

+1

I would really like to know why Europeans generally zealously hate any percieved intrusion on their privacy by a private corporation, while simultaneously promoting and encouraging a "nanny state."

 

[Headless Thompson Gunner]

Yeah, if you're worried about people learning your MAC or SSID, quit shouting it out into the streets.