Google's Sly-Fi Network

The full report on the Federal Communications Commission’s inquiry into Google’s Street View project, released last week, paints a picture of a program that, despite the tech giant’s claims, was designed to collect samples of private data from unencrypted wireless networks. But for all that, the best the FCC could do is fine Google $25,000—a pittance for a company whose annual revenues topped $37 billion last year.

The fine had nothing to do with a privacy breach, however. Google was hit for failing to cooperate with the government’s probe. Some privacy advocates, such as the Electronic Privacy Information Center, contend that Google violated wiretap laws. But most agree with the Center for Democracy and Technology’s Aaron Brauer-Rieke, who said that the inconclusive investigation highlights the absurdity of relying on laws enacted decades ago largely to deal with radio or telephone systems. “These are incredibly ambiguous laws, and you can’t map today’s issues onto them with any level of certainty,” Brauer-Rieke said. The case could have significant implications for consumers who use unsecured Wi-Fi networks, with a potential impact on privacy and the future of wireless.

In 2006, an engineer working for Google wrote a piece of code that, when used with the Street View project, gathered information from private, but unencrypted, Wi-Fi networks around the world using cars cruising streets. Four years later, when European officials discovered the program, Google first denied, then admitted, that the so-called payload data included personal information such as passwords and e-mails.

Google, which is facing a separate antitrust probe by the Federal Trade Commission into the dominance of its search engine, uses data about wireless networks to make its map services more accurate. What upset critics in the Street View case was that, in addition to taking pictures of streets and collecting basic Wi-Fi information, Google gathered private information. The FCC report found that the project’s lone engineer, referred to as “Engineer Doe” in government documents but identified by The New York Times as Marius Milner, shared his intentions with other employees but didn’t discuss the privacy implications with company attorneys—and that Google’s supervision of the project was minimal. However, the FCC joined the Justice Department and the FTC in determining that despite having collected personal information for two years, the Google program did not break any U.S. laws.

Unsurprisingly, Google agrees. While they dispute the FCC’s version of events, Google officials admit they “failed badly.” Nevertheless, the company has argued from the beginning that if it wanted, it was within its legal rights to gather information from unsecured networks. Governments in at least nine countries have cited Google for violating privacy laws and European officials say they may reopen their investigations, yet U.S. regulators appear to have largely agreed with the company.

When the Google Street View case first surfaced in 2010, then-Connecticut Attorney General Richard Blumenthal joined other officials in pressing Google to turn over information about the program. Now a Democratic member of the Senate Judiciary Committee, Blumenthal says that while it’s debatable whether the company violated any laws, it’s clear that action is required. “The issue is way bigger than Google,” he said in an interview. “There is an urgent, immediate need for updated laws.”

Blumenthal said he will press for a review of existing wiretap laws, but with little consensus, many competing interests, and the current skepticism on Capitol Hill toward legislation that constricts the free flow of information on the Web, it’s highly unlikely that privacy legislation will move any time soon.

Most tech companies reject the need for more regulations. New laws will quash innovation right when it’s most needed and could threaten the nature of the Internet, they argue. “Are we going to pass a law every time a company makes a mistake?” asks Thomas Lenard, president of the free-market Technology Policy Institute. “I haven’t seen the harm from companies using this data. On the other hand, I haven’t seen a legislative proposal yet that is innocuous.” Old laws haven’t kept up with technology, he notes. Why would new ones?

Google, for its part, repeatedly apologized for the breach and says it has enacted stricter privacy rules for reviewing new projects as well as appointed a privacy director and instituted employee privacy training. “We emphasize that being lawful and being the right thing to do are two different things, and that collecting payload data was a mistake for which we are profoundly sorry,” the company wrote in a letter to Congress when the issue became public in 2010.

But Brauer-Rieke said that while he hopes all companies will follow Google’s lead and avoid gathering payload data, it is not enough to depend on self-regulation. The privacy information center, which has launched legal challenges seeking more information about the FCC’s investigation, says that consumers shouldn’t shoulder the burden of making sure companies aren’t gathering their personal data. Without some form of updated protections, privacy advocates argue, people who use unsecured Wi-Fi at a coffee shop, library, or even their homes may be dodging not only hackers and thieves but data-hungry companies as well.