Google WiFi Privacy Breach Challenged by 38 States

Connecticut Attorney General Richard Blumenthal is leading 38 states in an investigation into Google's WiFi data collection, which was done with Street View cars. He will sue if he doesn't receive answers from Google.

Thirty-eight states, led by Connecticut Attorney General Richard Blumenthal, have asked Google whether it intended to have its Street View software collect data from unsecured wireless computer networks.

Blumenthal-who has aggressively defended Connecticut against perceived threats to consumer privacy regarding social networks such as Facebook and MySpace-threatened to sue the company if he does not receive some answers.

Google admitted back in May that its Street View cars had stored 600GB of WiFi network payload data for the last three years from more than 30 countries and regions around the world. This included fragments of citizens' e-mails, Web browsing data and password information.

Google insisted the data collection was the result of rogue code placed on its servers to collect WiFi data to improve the company's location-based services.

Blumenthal's latest questions are aimed at teasing out culpability. The AG asked whether the company's program was designed to collect WiFi data and whether Google tested its Street View software before use. Such testing, he argued, would have revealed that the program collected data transmitted over wireless computer networks.

He further wondered whether Google has sold or used technical network information collected by the Street View cars.

"Google's responses continue to generate more questions than they answer," Blumenthal said in a statement. "We are asking Google to identify specific individuals responsible for the snooping code and how Google was unaware that this code allowed the Street View cars to collect data broadcast over WiFi networks."

He also wants to know how the "spy software" was included in Google's Street View servers, as well as the specific locations where unauthorized data collection occurred.

Google reiterated its position in a statement to eWEEK July 21:

"As we've said before, it was a mistake for us to include code in our software that collected payload data, but we believe we did nothing illegal. We're continuing to work with the relevant authorities to answer their questions and concerns."

Blumenthal began looking into the so-called "WiSpy" case in June, holding a conference call with his counterparts in more than 30 states to decide whether or not to investigate the issue. On June 21, he agreed to lead a multistate investigation into Google's data-collection practices.

"We will take all appropriate steps-including potential legal action if warranted-to obtain complete, comprehensive answers," Blumenthal said. "Consumers have a right to expect that data transmitted over personal and business wireless networks remains confidential. Our multistate investigation will determine whether laws were broken and whether legislation is necessary to prevent future privacy breaches."

Meanwhile, Google has been working with affected countries to delete the data or disclose what data was collected in each region.

The company July 9 removed WiFi equipment from all of its Street View vehicles.