Inside Google

WASHINGTON, D.C. — Google has said that the cars used for its “Street View” mapping service had been mistakenly collecting personal data that people sent over unsecured WiFi networks for several years.

Google said it was “profoundly sorry for this error,” which is likely to intensify criticism of the Internet giant and Street View by privacy advocates and officials in a number of countries, particularly in Europe.

The Mountain View, California-based Google said it will end the collection of WiFi network information entirely by the Street View cars which have been used in over 30 nations.

It was also taking steps to delete the private data, which was scooped up as the cars drove around taking photographs and gathering publicly broadcast WiFi information for mobile versions of the online mapping service.

Street View, which is available for the United States and certain other countries, allows users to view panoramic street scenes on Google Maps and “walk” through cities such as New York, Paris or Hong Kong.

Amid concerns that thieves could use pictures of private houses to gain access and that photos of people were being published without their consent, Street View already blurs faces and car registration plates.

The collection of WiFi network information by Street View, which began in 2006, has been controversial, particularly in Germany.

Google had insisted previously it was only collecting WiFi network names and MAC addresses, the unique number given to a device like a WiFi router.

“It’s now clear that we have been mistakenly collecting samples of payload data from open (ie non-password-protected) WiFi networks,” Alan Eustace, Google senior vice president for engineering and research, said in a blog post.

Eustace said a coding error was responsible for the collection of personal data sent by people over unsecured WiFi networks.

Google did not specify what data was gathered but it could potentially include emails or details about which websites a person had visited.

Eustace said Google discovered that personal data had been swept up a week ago following a request to audit WiFi data from the Data Protection Authority in Hamburg, Germany.

“As soon as we became aware of this problem, we grounded our Street View cars and segregated the data on our network, which we then disconnected to make it inaccessible,” he said.

“We want to delete this data as soon as possible, and are currently reaching out to regulators in the relevant countries about how to quickly dispose of it,” Eustace said.

“Given the concerns raised, we have decided that it’s best to stop our Street View cars collecting WiFi network data entirely,” he added.

He said personal information was collected only from non-password-protected WiFi networks and “we never used that data in any Google products.”

A Google spokesperson said about 600 gigabytes of personal information had been gathered, roughly the amount as in a standard computer hard drive.

Eustace said the data was just fragments. “Because our cars are on the move, someone would need to be using the network as a car passed by, and our in-car WiFi equipment automatically changes channels roughly five times a second,” he said.

“Maintaining people’s trust is crucial to everything we do, and in this case we fell short,” he said.

“We are profoundly sorry for this error and are determined to learn all the lessons we can from our mistake.”

John Simpson of Consumer Watchdog, an advocacy group that is a frequent critic of Google, said the company had demonstrated a “lack of concern for privacy.”

“Its computer engineers run amok, push the envelope and gather whatever data they can until their fingers are caught in the cookie jar,” Simpson said.

“The takeaway from this incident is the clear need for government oversight and regulation of the data all online companies gather and store,” he said.

Google said Street View cars have been collecting WiFi data in Australia, Austria, Belgium, Brazil, Britain, Canada, the Czech Republic, Denmark, Finland, France, Germany, Greece, Hong Kong, Hungary, Ireland, Italy, Japan, Luxembourg, Macau, Mexico, the Netherlands, New Zealand, Norway, Poland, Portugal, Romania, Singapore, South Africa, South Korea, Spain, Sweden, Switzerland, Taiwan and the United States.