Today the U.S. District Court issued a significant ruling that Google can be held liable for damages under the Wiretap Act because of its Wi-Spy program that collected usernames, passwords, whole emails, and other private data.
The Wi-Spy program was a part of a Street View initiative in which Google vehicles drove down nearly every street in America with sophisticated eavesdropping devices that captured any data being transmitted from an unencrypted wireless router. Almost every family in America with a home wireless network was vulnerable to Google’s listening devices. The court describes it best:
In 2006, prior to the launch of the Google Street View vehicles, Defendant’s employee engineers intentionally created a data collection system that included code that sampled, collected, decoded and analyzed all types of data broadcast through Wi-Fi connections. (CCAC ¶¶ 60-61.) This data collection system is commonly known as a packet analyzer, wireless sniffer, network analyzer, packet sniffer or protocol analyzer. (Id. ¶ 61.) Defendant authorized inclusion of this wireless sniffer technology into its Google Street View vehicles and even sought to patent the process. (Id. ¶ 65.) The wireless sniffer secretly captures data packets as they stream across Wi-Fi connections and then decodes or decrypts the data packet and analyzes the contents.
Google has been a bad actor in our industry when it comes to privacy. In addition to Wi-Spy, the company also conducted its Doodle for Google campaign to collect social security numbers and other sensitive data about schoolchildren and recently received the biggest penalty ever issued by the FTC for its Buzz product which revealed private communications between users and deceptively failed to unsubscribe them when asked. Google’s bad acts have reflected poorly on the entire internet and mobile apps community.
The District Court decision is significant because it demonstrates that sufficient privacy safeguards currently exist in our judicial system. Too often a regulatory response to a few bad actors results in unintended downstream consequences that negatively affect the industry. Most often, those that suffer the greatest in this environment are small businesses and startups. We have long been aware of the negative impact Google has had on consumers’ faith in the security of their online privacy. It is our hope that the courts continue to treat the Wi-Spy matter seriously so consumer confidence may be restored.
A copy of the court decision may be found, here. (.pdf)