Data Engineer in Google Case Is Identified - author of NetStumbler

http://www.nytimes.com/2012/05/01/technology/engineer-in-googles-street-view-is-identified.html

by hinathan • 14 years ago

46 74 14 years ago

branola• 14 years ago

Depicting his actions as the work of a rogue “requires putting a lot of dots together,” Mr. Milner said enigmatically Sunday before insisting again he had no comment.

It doesn't sound particularly enigmatic to me. It seems like Milner is clearly saying that Google deliberately misrepresented his behavior as a rogue action to facilitate their legal self-protection when in fact it's obvious from their choice of the author of NetStumbler to work on Street View that his designated role was likely to involve making use of his expertise with Wi-Fi networks.

jack-r-abbit• 14 years ago

Of course they hired a WiFi expert for their WiFi-related project. But that doesn't mean their claim of rogue behavior is simply self-protection. What if they hired him for his expertise with Wi-Fi and told him they only wanted to collect the minimal amount of data but he went rogue and collected ALL the data anyway? But I'm with those people that think the freely broadcast unencrypted packets are in the public domain and Google didn't do anything illegal.

samstave• 14 years ago

Exactly. Utter BS. The company that claims to be the smartest people in the world just haphazardly put this guy on this project.

Not a chance.

brudgers3• 14 years ago

With the resources devoted to Streetview, it is unlikely that the software running it was a 20% time project by the time it was deployed.

epochwolf• 14 years ago

What is the point in publicly naming an the engineer in this case? How does this benefit the public good?

whackberry15• 14 years ago

> What is the point in publicly naming an the engineer in this case? How does this benefit the public good?

The public has the right to know. Otherwise, who decides what should be public or not, the ministry of big brother?

derefr3• 14 years ago

Well, usually, the individual who comes into possession of the information decides whether it should be public, using their own sense of ethics. And questions like "how does this benefit the public good?" are precisely the kind of thing used as input to that ethical calculation.

ok_craig2• 14 years ago

The public doesn't have the right to know, since no law was broken. The engineer was identified by a "former state investigator [who] spoke on the condition that he not be identified because he was not authorized to speak."

10100110103• 14 years ago

Nice witch hunt you have there.

stevenplatt• 14 years ago

The data collection, which took place over three years, was legal because the information was not encrypted, the F.C.C. ultimately determined.

Interesting how this works. If I went wardriving and collected personal emails from unencrypted networks, I'd have my house rummaged by FBI agents, be hit with a 25,000-count felony wiretapping indictment and have some go-getter federal prosecutor try to convince a judge to sentence me to 7,000 years in prison. Then an appeals court might say reverse on the grounds that it was unencrypted. Maybe.

Google does it? A slap on the wrist and a small fine for "obstructing an investigation."

epikur• 14 years ago

Why/how would the FBI be notified? Capturing packets from an unsecured wifi network doesn't exactly ring alarm bells.

kinghajj• 14 years ago

That's because the software Google used didn't actively browse the networks to look for documents, but passively intercepted and logged packets. If they wrote a program that actually searched the networks for shared folders and copied information that way, then conceivably they could be guilty of unauthorized computer access.

whackberry15• 14 years ago

> That's because the software Google used didn't actively browse the networks to look for documents

Do we know that for a fact? Sorry if well known, genuine question.

smeg• 14 years ago

Legal in what country?

mattgreenrocks• 14 years ago

I hate to be that guy, but do you have any examples? I thought war driving was a very murky gray area of the law.

tlrobinson2• 14 years ago

Has anyone actually been prosecuted for simply passively monitoring unsecured WiFi networks?

jlawer5• 14 years ago

It feels to me like they were just logging everything for future analysis so they don't have to come back and do a second pass when they upgrade their software.

But then again I'm sorry, I have never seen what the big deal was about this. If you broadcast your crap around you can't blame people for receiving it.

Sure people's passwords may be in the data stream, but they broadcast it over an open connection. If your going to blame anyone blame the electronics shop sales guy, the hardware vendor and the TV "experts" that tell people that using an unencrypted wifi access point is completely reasonable.

whackberry15• 14 years ago

> But then again I'm sorry, I have never seen what the big deal was about this.

You don't see what the deal is with a major corporation doing wardriving and packet capturing?

> If you broadcast your crap around you can't blame people for receiving it.

By your logic then if someone gets robbed on the streets, then it's their fault for "walking around freely"?

lukeschlather• 14 years ago

No one was deprived of anything other than privacy. Yes, if you broadcast radio waves you shouldn't expect them to remain private.

fennecfoxen• 14 years ago

If by "robbed" you mean "overheard", maybe we can get somewhere by analogizing.

derefr3• 14 years ago

> By your logic then if someone gets robbed on the streets, then it's their fault for "walking around freely"?

Well, to more strictly match the analogy--if someone is walking around with a purse that is constantly leaking coins, and they get "robbed" (by someone finding some of said coins and wandering off with them), then I would say that that is their own fault, yes.

jarcoal2• 14 years ago

That is not a valid comparison at all... would you go after Google for smelling what people are cooking from the street?

dkokelley• 14 years ago

>By your logic then if someone gets robbed on the streets, then it's their fault for "walking around freely"

Your analogy is broken, and I think you know it.

The bigger question is, "is it OK for someone to methodically collect data that people (inadvertently) broadcast about themselves?". The advertising industry has been doing it for years, and it's really a legal and ethical fuzzy area. The more productive conversation will revolve around privacy rights and expectations.

jlarocco2• 14 years ago

> You don't see what the deal is with a major corporation doing wardriving and packet capturing?

I don't, actually. There was no "hacking" or exploitation of any kind - any idiot with a wifi card can do the same thing.

>By your logic then if someone gets robbed on the streets, then it's their fault for "walking around freely"?

If I stand on the corner shouting out my social security and bank account numbers, I expect somebody will rip me off. Changing the type of wave from a sound wave to a radio wave doesn't really change anything.

jlawer5• 14 years ago

> By your logic then if someone gets robbed on the streets, then it's their fault for "walking around freely"?

Come on that a bit excessive...

No one is hurt if packets are captured. Its not a violent act. Surely we can loose the hyperbolae.

I am saying that its not realistic to expect privacy if you do things in a public space, including broadcasting your data. If you choose to tell a story out on the street and I hear it you don't get to then say I am invading your privacy by hearing it.

nickm12• 14 years ago

Ethical behavior is not a zero-sum game. Yes, people should have secured their sensitive data, but they didn't. It doesn't make it ethical to record it, any more than it would be ethical to go into someone's unlocked house and sit on their couch and watch TV while they're out.

whackberry15• 14 years ago

Exactly. We don't go into people's homes not because they have a fence and a shotgun but because we were not invited, that is the whole point.

Most of the arguments here circle around "ah you were a fool to let your data out, so Google was wise and snooped it". WTF kind argument is that? Since when is it ok for a corporation to hire "experts" who go around collecting private data? What is this data for? Why, in the first place, do they have a wifi expert driving around doing that?

option_greek2• 14 years ago

It's more like hearing a loud mouthed neighbor say to his wife "It's a secret! don't tell any one.. its very private too... we have won the jackpot"

I don't think I will close my ears at any point.

jlawer5• 14 years ago

No it isn't a zero-sum game... but this isn't "invading" their network.

If they connected to the AP and ran nmap against my server yes it would be like that... but simply capturing packets that are broadcast into a public space I don't think is reasonable or realistic to expect it is some grave violation of privacy.

beder• 14 years ago

> On his LinkedIn page, Mr. Milner lists his occupation as “hacker,” and under the category called “Specialties,” his entry reads, “I know more than I want to about Wi-Fi.”

While I don't know for sure which use of the word "hacker" Milner intends, the author of this article ought to have added a line like, "Software engineers use the word 'hacker' in a positive, non-malicious sense...", since this is effectively taking his words out of context.

elliotanderson• 14 years ago

Same can be said for knowing too much. I know way too much about PHP, doesn't mean that there is anything malicious about it

hkmurakami• 14 years ago

>On his LinkedIn page, Mr. Milner lists his occupation as “hacker,” and under the category called “Specialties,” his entry reads, “I know more than I want to about Wi-Fi.”

I am more than moderately offended/troubled/irked by this excerpt, as it appears to deliberately depict the engineer as a "hacker" in the sense of Hollywood culture, rather than "hacker" as we know it in makers' terms.

In the wrong hands, the English language is much more potent and destructive than any programming language. An English Specialist can often cause more harm than a Wi-Fi Specialist.

brudgers3• 14 years ago

Given that he developed a "wardriving" application, black hat connotations are not entirely unreasonable. The use of his talents to hoover up data without permission certainly doesn't offer much in the way of defense, either.

magicalist3• 14 years ago

Ha, your parent post could almost have been written about your post too.

Looking past the scare quotes, according to the FCC report it was just Kismet, and the problem basically just came down to deciding to write the non encrypted payloads to disk. He might know too much about wifi, but probably half the regular HN posters could have implemented the same system, if they chose to.

untog2• 14 years ago

I've long thought that trying to adopt "hacker" as a professional term was a bad idea. I told friends that I was going to a government hackathon once, and they thought I was going to be arrested.

Why do we have to be hackers? What was wrong with being developers?

switz• 14 years ago

Developer !== Hacker

tlrobinson2• 14 years ago

I think it's almost like a secret handshake. If someone understands what I mean when I say "hacker" I respect them a little more.

jlawer5• 14 years ago

Because society took both hacker and developer and changed their meaning.

Hackers became criminals and developers were Javabean coding wage slaves... given a choice criminal sounds cooler then wage slave.

goodgracious3• 14 years ago

In the wrong hands, deep knowledge of Wi-Fi can be far more destructive than the conventional methods of a non-technical journalist. It's a new level of power in snooping.

It's a good thing journalists generally do no have Milner's level of knowledge, as surely they too would abuse it. Maybe even worse than Google. Milner's comment reflects the power of the knowledge he has. He has to take some responsibility for it.

Both Google engineers and NYT journalists do snooping on others for a living.

They are just at odds with each other, for various reasons; engineers for companies like Google generally do not like journalists and generally the same is true vice versa.

Google has a genuine PR problem. And journalists are watching their careers disintegrate with the advance of communications technology. It's an amusing little spat to watch.

kevinpet• 14 years ago

"The F.C.C. report also had Engineer Doe spelling out his intentions quite clearly in his initial proposal. Managers of the Street View project said they never read it."

I think the authors intended this to be read as 'wink wink yeah sure', but this sounds entirely plausible on both sides. The more detailed the spec is, the less likely anyone will read it. They probably just forwarded it around and assumed someone competent to render an opinion would raise a red flag if anything were not well thought out.

martey• 14 years ago

The issue is that it is not just the initial proposal. As the NYTimes article points out in the previous paragraph, and the complete FCC report [1] clearly states, there were additional events after the proposal was submitted where other members of the Street View team came in contact with the actual code while doing code review or debugging, but later claimed during interviews with the FCC that they were unaware that it was collecting data.

On page 15, the report even mentions "Engineer Doe" sending an email to a manager stating, "You might recall asking me about URLs seen over Wi-Fi...", and talking about the number of unique URLs retrieved (only 32,000 from 300 million packets). The manager asked if the URLs were sniffed from WiFi packets, and Doe responded in the affirmative.

[1] http://s3.documentcloud.org/documents/351298/fcc-report-on-g...

drucken• 14 years ago

The engineer who created this system is completely irrelevant since the production implementation of Street View collected all data.

The fault lies solely with Google whether by intent, lack of legal or legal ethics advice, lack of technical oversight, or management incompetence etc. This also seems to be the regulator's view.

However, Google itself and, of course, the media are quite happy to muddy the waters with a bit of "gone rogue" nonsense, though for differing reasons.

Data Engineer in Google Case Is Identified - author of NetStumbler

Related Stories