Skip to main content

What Google's Street View breach means for your privacy

Doug Gross
Spectators check out a Google Street View car at an expo in Germany, where info-gathering prompted privacy concerns.
Spectators check out a Google Street View car at an expo in Germany, where info-gathering prompted privacy concerns.
STORY HIGHLIGHTS
  • Google said vehicles working on Street View feature accidentally grabbed personal data
  • Passwords, e-mails picked up by computer code accidentally inserted in its software
  • Users can have their images removed from Street View with a few clicks
RELATED TOPICS

(CNN) -- This week, Google announced that it had accidentally collected passwords, e-mails and other personal information from random Wi-Fi users while working on its Street View feature.

The news came months after Google first acknowledged gathering the info. But the company originally thought it had picked up only bits and pieces of data.

The whole story, including the backlash from world governments and privacy advocates, can get a little complicated. So here's a look at what happened, what Google has done to address the problem and what you can do if you don't want to be part of Street View.

What is Street View?

Google's Street View is an extension of Google Maps. It lets users search for a location and then zoom in to street-level images of the spot for a close-up look.

It has a number of functions, including using pictures of landmarks for walking and driving directions. When someone says, "Turn left at the purple house," you can actually get an image of what the purple house will look like. Or if you're looking for a friend's house you've never visited before, you can see exactly what it looks like.

Businesses can use it to show their locations, real estate agents can display listings, and individuals can use it for something as simple as showing friends where they live.

Street View was launched in May 2007 in five cities. It is now available in much of North America, western Europe and Australia and smaller portions of South America, southern Africa and Asia.

How is it created?

Google captures images with cameras that create a 360-degree view of locations. Cars or vans drive around the area, taking the pictures.

Google says all pictures are taken from the street, which is obviously public property, and show only locations visible from the street.

What happened?

In May, Google announced that its Street View cars had accidentally collected information that was being transmitted over local Wi-Fi connections.

The company at first said that none of the data were sensitive. But after internal and external investigations, it began to backtrack.

Google said this week that most of the data, which came only from networks that were not encrypted, were "fragmentary": words and phrases that didn't necessarily form legible messages or identify users. In some cases, however, Google collected complete e-mails and passwords.

The data were collected because a piece of computer code written by an engineer in 2006 was mistakenly included in the software that the cars use, according to Google.

The response

Government officials in several countries have demanded access to the information Google gathered. In some cases, they've accused Google of acting illegally.

Last week, the Canadian government said that Google broke the country's law by collecting the data but closed an investigation after calling it "a careless error."

In France, a commission that began investigating this summer ruled that personal data had been collected. Authorities cracked down, even pulling over Street View vehicles to make sure they had stopped collecting personal information.

The Czech Republic has banned Google from expanding the service, and the news sparked an online privacy debate in Germany, where Google is allowing people to opt out of Street View before the images go live.

Great Britain, however, determined that none of the information gathered there was sensitive.

Several lawsuits have been filed in the United States, with some seeking class-action status that would represent everyone harmed.

The gaffe also raised the ire of privacy advocates, who have pushed for Google to tighten its image-collection practices.

"Google is too mature to be making these kinds of rookie privacy mistakes," Jennifer Granick, civil-liberties director for the Web-privacy group Electronic Frontier Foundation, said when news of the leak broke this spring.

"When you are in the business of collecting and monetizing other people's personal data -- as Google and so many other internet businesses are -- clear standards and comprehensive auditing are essential to protect against improper collection, use or leakage of private information."

What Google has done

Google's blog post listed several changes the company has made in the wake of the Street View incident.

• The company named Alma Whitten to the post of director of privacy. She will be charged with making sure Google's products and policies have good privacy controls.

• Google said employees will get enhanced privacy training during orientation, and starting in December, all employees will be required to take part in a security-awareness program.

• The company also said it will add a step to engineering projects that will require project leaders to keep a security-documentation log.

"We work hard at Google to earn your trust, and we're acutely aware that we failed badly here," engineering and research Vice President Alan Eustace wrote in the blog post.

Eustace said Google was deleting the information it collected "as soon as possible," and the company said it fixed the coding that was collecting the data as soon as it was discovered.

What to do if you're concerned

For the average Web user, it's virtually impossible to know whether your personal information was compromised when Google was still using the faulty computer code.

But the odds that any one individual was affected are pretty slim. It would require you to have been transmitting data on an unencrypted Wi-Fi network at the time a Street View vehicle happened to be driving down your block.

Even then, your message would have to have been one of the ones that came through clearly, not part of the "fragmentary" data that Google says makes up most of what was collected.

While critical of Google's mistake, privacy advocates like Granick said there's no reason to doubt Google when the company says it was an accident -- and vehicles are no longer grabbing data.

In addition, anyone can ask that their home be taken off of Street View or report any images of their property that they find offensive.

See how to remove an image from Street View

When viewing the image, the user can click the "Report a Problem" button at the bottom-left of the image, fill out a form and click "Submit."

[TECH: NEWSPULSE]

Most popular Tech stories right now