Google admits harvesting passwords

The ICO will be investigating Google after the search giant admitted to taking emails, URLs and passwords during its Street View operation.

Computer privacy

Google could face a hefty fine from the UK's privacy watchdog after the search giant admitted it had captured passwords, emails and URLs when it collected unencrypted Wi-Fi payload data during its Street View operation.

The Information Commissioner's Office (ICO) said earlier this year it appeared no "meaningful" data had been taken by Google.

However, following investigations by various regulators from across the globe, Google has now admitted it had taken emails, URLs and passwords.

"We want to delete this data as soon as possible, and I would like to apologise again for the fact that we collected it in the first place," said Alan Eustace, senior vice president for engineering and research at Google, in a blog post.

"We are mortified by what happened, but confident that these changes to our processes and structure will significantly improve our internal privacy and security practices for the benefit of all our users."

The ICO said it will now be investigating Google again and will consider a monetary fine, which could reach 500,000 - the maximum penalty open to the ICO.

"Whilst the information we saw at the time did not include meaningful personal details that could be linked to an identifiable person, we have continued to liaise with, and await the findings of, the investigations carried out by our international counterparts," an ICO spokesperson said.

"We will be making enquires to see whether this information relates to the data inadvertently captured in the UK, before deciding on the necessary course of action, including a consideration of the need to use our enforcement powers."

Rik Ferguson, senior security advisor at Trend Micro, said it was difficult to see what laws Google would have broken, given no third parties appeared to have seen the data.

"It seems it was completely accidental and unintentional and Google did the best they could in terms of surrendering the information as soon as they discovered there was something they needed to surrender and working with every individual European information commissioner," Ferguson told IT PRO.

"Yes they made a mistake but they've been pretty good at putting their hands up and doing the right thing, which is commendable."

As for whether Google should receive a fine from the ICO, Ferguson said "there was no breach."

"It's difficult to see what laws they would have broken."

However, privacy groups continue to press for penalties, including criminal sanctions, against Google. Earlier this year Privacy International said it believed Google had acted with criminal intent in collecting the data.

Featured Resources

Digital document processes in 2020: A spotlight on Western Europe

The shift from best practice to business necessity

Download now

Four security considerations for cloud migration

The good, the bad, and the ugly of cloud computing

Download now

VR leads the way in manufacturing

How VR is digitally transforming our world

Download now

Deeper than digital

Top-performing modern enterprises show why more perfect software is fundamental to success

Download now

Recommended

Microsoft spearheads industry-wide charter against AI cyber attacks
Security

Microsoft spearheads industry-wide charter against AI cyber attacks

23 Oct 2020
Weekly threat roundup: Chrome, Citrix and WordPress
Security

Weekly threat roundup: Chrome, Citrix and WordPress

23 Oct 2020
IT services giant Sopra Steria falls victim to Ryuk ransomware
Security

IT services giant Sopra Steria falls victim to Ryuk ransomware

23 Oct 2020
CMS platforms succumb to KashmirBlack botnet as businesses rush online
Security

CMS platforms succumb to KashmirBlack botnet as businesses rush online

22 Oct 2020

Most Popular

The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

5 Oct 2020
The enemy of security is complexity
Sponsored

The enemy of security is complexity

9 Oct 2020
What is a 502 bad gateway and how do you fix it?
web hosting

What is a 502 bad gateway and how do you fix it?

5 Oct 2020