Google in 'significant breach' of UK data laws

BBC - 3 November 2010

Information Commissioner, Christopher Graham: "I think the important thing was to get the foot in the door for an audit of Google which had to be by consent"

There was a "significant breach" of the Data Protection Act when Google collected personal data via its Street View cars, the UK's Information Commissioner has ruled.

But Google will not face a fine or any punishment, Christopher Graham added.

Instead, the Information Commissioner's Office (ICO) will audit Google's data protection practices.

The move marks a U-turn for the ICO which originally ruled that no data breach had occurred.

Last week the ICO vowed to look again at the evidence, after the Canadian data agency found the search giant in breach of its law.

Its decision was welcomed by MP Robert Halfon, who has been critical of the ICO and of Google, which he recently accused of deliberately collecting the data for commercial gain.

However, he said that action had come too late. 

"The ICO failed to act when it should have done, despite the fact that Google staged a significant infringement of privacy and civil liberties, by harvesting millions of e-mails, wi-fi addresses, and passwords.

"Furthermore, the ICO has already proved that it lacks the technical expertise to audit Google's activity. What confidence can we have in their audit now? People feel powerless."

The ICO said it "strongly refutes" Mr Halfon's suggestion that it did not have "the necessary expertise to audit" Google. 

"We have a team of experienced and qualified auditors who regularly check organisations compliance with data protection requirements."

Mr Graham said Google must delete the data - collected from unsecured wi-fi networks - "as soon as it is legally cleared to do so".

Google has apologised for collecting the data, which it said had been done by mistake. 

'Profoundly sorry'

Google has been the subject of scrutiny from data protection agencies around the world, following news that software in its Street View cars collected personal information.

 

Street View has been under scrutiny in Germany

 

This was revealed following a request from the German data commissioner to audit all the data being collected by Street View cars.

Google discovered that, along with legitimate data about the location of wi-fi hotspots, the cars were also hoovering up personal details from unsecured networks, known as payload data.

Peter Fleischer, Google's Global Privacy Counsel, said the firm was "profoundly sorry for mistakenly collecting payload data in the UK".

Google said it happened as the result of code written by one of its engineers being mistakenly incorporated in the Street View software.

"Since we announced our mistake in May we have co-operated closely with the ICO and worked to improve our internal controls," said Mr Fleischer.

"We are in the process of confirming that there are no outstanding legal obligations upon us to retain the data, and will then ensure that it is quickly and safely deleted."

'Serious violation'

It announced recently that it would appoint a head of privacy and ensure that all its engineering teams followed strict privacy protocols.

New impetus was given to the UK enquiry, which had originally ruled that no significant breach had occurred, following harsh criticisms of Google from the Canadian authorities.

Last month it found that the search giant had breached its privacy laws.

"This incident was a serious violation of Canadian's privacy rights," privacy commissioner Jennifer Stoddart concluded.

But she said that no further action would be taken if Google tightened its privacy policies.

Backlash

Street View is now available in around 20 countries and allows uses to walk through towns and cities using photos taken by the Street View cars.

Anyone wishing to have an image removed can request this from Google.

But there is a growing backlash against the service, following complaints from people that their privacy was breached when the photos were taken.

In Germany, where Google is imminently rolling out a service, the government forced it to allow people to opt out of the service before pictures went live.

Italy has asked it to give citizens notice before starting mapping operations while the Czech Republic has banned it from taking any more pictures.

Hacker builds cellphone tapping device

 

VULNERABLE: Paget setting up a long range RFID reading device at the DefCon hacker conference in Las Vegas. - AP

 

LAS VEGAS: A computer security researcher has built a device for just US$1,500 (RM4,800) that can intercept some kinds of cellphone calls and record everything that's said.

The attack Chris Paget showed illustrates weaknesses in GSM (Global System for Mobile Communications), one of the world's most widely used cellular communications technologies.

His attack was benign; he showed how he could intercept a few dozen calls made by fellow hackers in the audience for his talk at the DefCon conference here on Saturday.

But it illustrates that criminals could do the same thing for malicious purposes, and that consumers have few options for protecting themselves.

Paget said he hopes his research helps spur adoption of newer communications standards that are more secure.

"GSM is broken - it's just plain broken," he said.

GSM is considered 2G (second generation) cellular technology. Phones that run on the newer 3G and 4G standards aren't vulnerable to his attack.

If you're using an iPhone or other smartphone and the screen shows that your call is going over a 3G network, for example, you are protected. BlackBerry phones apply encryption to calls that foil the attack, Paget pointed out.

But if you're using a type of phone that doesn't specify which type of network it uses, those phones are often vulnerable, Paget said.

Paget's device tricks nearby cellphones into believing it is a legitimate cellphone tower and routing their calls through it. Paget uses Internet-based calling technology to complete the calls and log everything that's said.

A caveat is that recipients see numbers on their Caller IDs that are different than the cell numbers of the people calling them. Paget claims it would be easy to upgrade the software to also include the callers' real numbers.

IMSI
The device he built is called an "IMSI catcher," which refers to the unique International Mobile Subscriber Identity numbers that phones use to identify themselves to cellular networks.

Commercial versions of such devices have existed for decades and have mainly been used by law enforcement. Paget's work shows how cheaply hobbyists can make the devices using equipment found on the Internet.

"That's a significant change for research - it's a major breakthrough for everyone," said Don Bailey, a GSM expert with iSec Partners who wasn't involved in Paget's research.

Another security expert, Nicholas DePetrillo, said such devices haven't been built as cheaply in the past because the hardware makers have closely controlled who they sell to. Only recently has the necessary equipment become available cheaply online.

There are more than three billion GSM users and the technology is used in nearly three quarters of the world's cellphone markets, according to the GSM Association, an industry trade group.

In a statement, the group emphasised the hurdles to launching an attack like Paget's, such as the fact an attacker's base station would need to be physically close to the target and that only outgoing calls can be intercepted. Incoming calls are not vulnerable.

"The overall advice for GSM calls and fixed-line calls is the same: Neither has ever offered a guarantee of secure communications," the group said. "The great majority of users will make calls with no reason to fear that anyone might be listening.

"However, users with especially high security requirements should consider adding extra, end-to-end security features over the top of both their fixed line calls and their mobile calls."

Paget had been debating dropping the demonstration from his talk, after federal authorities told him it might violate wiretapping laws. He went ahead with it after conferring with lawyers. He said he didn't believe he had broken any laws. - AP