Google Street View: Chronology of a Cock-Up
Much as Google would like Connecticut Attorney General Richard Blumenthal to follow the Federal Trade Commission’s lead and close his inquiry into the inadvertent collection of user data by its Street View cars, that seems unlikely. Blumenthal, whose office is spearheading a multistate investigation into Google’s Wi-Fi data-gathering debacle, says he has no plans to end it simply because of some announced improvements to the company’s privacy practices.
“Google’s alarming admission last week–confirming it collected entire emails and passwords–only heightened our concerns about how and why this data was collected,” Blumenthal said, adding that he’d rather not “rely on Google’s explanations and assurances…to confirm the facts about how this happened and how consumers will be protected going forward.”
A wise move, I think, particularly given the way Google’s narrative for this particular cock-up has evolved over the past few months, from an outright denial in April to a backpedaling, embarrassing admission in May and finally an apology in October.
In April, an outright denial:
Writing in Google’s European Public Policy blog, Peter Fleischer, the company’s global privacy counsel, denies there was a privacy issue with Google’s Wi-Fi data collection practices. “Google does not store or collect payload data,” he says.
Google product manager Raphael Leiteritz reiterates this assertion in the company’s Submission to Data Protection Authorities that same day. “All data payload from data frames are discarded, so Google never collects the content of any communications,” he writes.
In an interview with the New York Times a few days later, Google spokesman Kay Oberbeck dismisses the privacy concerns of German officials, saying: “What we are doing is totally legal and is being done by other companies around the world….We did not mention the WLAN project during our discussions with data protection officials because it is not related to Street View.”
In May, an embarrassing admission…
Writing in Google’s official blog two weeks later, Google SVP Alan Eustace reveals that the company actually had been collecting payload data. “It’s now clear that we have been mistakenly collecting samples of payload data from open (i.e., non-password-protected) Wi-Fi networks,” he explains. “So how did this happen? Quite simply, it was a mistake.” Then there was this from Peter Barron, Google’s director of communications for Northern and Central Europe: “We didn’t want to collect this data in the first place and we would like to destroy it as soon as possible.”
…followed by some aggressive damage control and a downplaying of the issue:
Speaking at Google’s annual Zeitgeist Europe forum, Google CEO Eric Schmidt describes the payload data collected as inconsequential and excuses the company for its misstep, saying, “There was no harm, no foul.”
In June, an unsettling hypothesis:
Apologizing for the company’s mistaken collection of user data, a Google New Zealand spokesperson tells the Otago Daily Times that the information the company’s Street View cars intercepted might not have been as inconsequential as Schmidt claimed. “Our in-car WiFi equipment automatically changes channels five times a second,” she says. “That said, it’s possible that the fragments of data we collected could contain entire emails or other content if a user broadcast personal information over an open network at that moment.”
In October, some hard evidence, another embarrassing admission and a change of tack…
A few months pass, and then a Canadian Privacy Commissioner’s investigation reveals “that Google did capture personal information–and, in some cases, highly sensitive personal information such as complete emails.” Interestingly, in its report on the matter, the Canadian Privacy Commissioner’s office notes that while Google “does not intend to resume collection of Wi-Fi data through its Street View cars…[it does intend to] rely on its users’ handsets to collect the information on the location of Wi-Fi networks that it needs for its location-based services database.”
And then the Schmidtstorm:
Appearing on CNN’s “Parker Spitzer,” Google CEO Schmidt cavalierly suggests that folks worried about Google Street View invading their privacy should “just move.” Ironically, he says this on the very day that Google admits those cars captured more than just fragments of personal payload data and says it is “mortified by what happened.”
“As you can see from the unedited interview, my comments were made during a fairly long back and forth on privacy,” he says. “I clearly misspoke. If you are worried about Street View and want your house removed please contact Google and we will remove it.”
And a day later the FTC announces that it has concluded its inquiry into Google Street View, saying the improvements Google has made to its internal privacy practices have alleviated its concerns for consumer safety.
Meanwhile, Blumenthal’s investigation continues.