IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Google admits harvesting passwords

The ICO will be investigating Google after the search giant admitted to taking emails, URLs and passwords during its Street View operation.

Computer privacy

Google could face a hefty fine from the UK's privacy watchdog after the search giant admitted it had captured passwords, emails and URLs when it collected unencrypted Wi-Fi payload data during its Street View operation.

The Information Commissioner's Office (ICO) said earlier this year it appeared no "meaningful" data had been taken by Google.

However, following investigations by various regulators from across the globe, Google has now admitted it had taken emails, URLs and passwords.

"We want to delete this data as soon as possible, and I would like to apologise again for the fact that we collected it in the first place," said Alan Eustace, senior vice president for engineering and research at Google, in a blog post.

"We are mortified by what happened, but confident that these changes to our processes and structure will significantly improve our internal privacy and security practices for the benefit of all our users."

The ICO said it will now be investigating Google again and will consider a monetary fine, which could reach 500,000 - the maximum penalty open to the ICO.

"Whilst the information we saw at the time did not include meaningful personal details that could be linked to an identifiable person, we have continued to liaise with, and await the findings of, the investigations carried out by our international counterparts," an ICO spokesperson said.

"We will be making enquires to see whether this information relates to the data inadvertently captured in the UK, before deciding on the necessary course of action, including a consideration of the need to use our enforcement powers."

Rik Ferguson, senior security advisor at Trend Micro, said it was difficult to see what laws Google would have broken, given no third parties appeared to have seen the data.

"It seems it was completely accidental and unintentional and Google did the best they could in terms of surrendering the information as soon as they discovered there was something they needed to surrender and working with every individual European information commissioner," Ferguson told IT PRO.

"Yes they made a mistake but they've been pretty good at putting their hands up and doing the right thing, which is commendable."

As for whether Google should receive a fine from the ICO, Ferguson said "there was no breach."

"It's difficult to see what laws they would have broken."

However, privacy groups continue to press for penalties, including criminal sanctions, against Google. Earlier this year Privacy International said it believed Google had acted with criminal intent in collecting the data.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

Apple executive rejoins Google over remote work policy
flexible working

Apple executive rejoins Google over remote work policy

18 May 2022
Here’s the first look at Google’s new Bay View campus
Business operations

Here’s the first look at Google’s new Bay View campus

17 May 2022
Google offers UK SMBs £87,000 scholarships to boost tech skills
Careers & training

Google offers UK SMBs £87,000 scholarships to boost tech skills

10 May 2022
Google Cloud confirms it is building a dedicated team to support Web3 developers
Cloud

Google Cloud confirms it is building a dedicated team to support Web3 developers

9 May 2022

Most Popular

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
Researchers demonstrate how to install malware on iPhone after it's switched off
Security

Researchers demonstrate how to install malware on iPhone after it's switched off

18 May 2022
Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022