On 27 April 2010 Google's global privacy counsel, Peter Fleischer, set out what the Street View cars collected as they drove: the names of Wi-Fi networks and the hardware addresses of the routers broadcasting them, used to fix positions for the company's location products, and nothing more. Nine days later the data-protection authority in Hamburg asked to audit that data. Google went back through what the cars had recorded, and on 14 May Alan Eustace, its senior vice-president for engineering and research, published a correction: since 2007 the cars had also been keeping "samples of payload data from open (i.e. non-password-protected) WiFi networks" — fragments of the traffic itself, not merely the labels on the networks carrying it. "Quite simply, it was a mistake."
The explanation reached back to 2006, when an engineer on an experimental Wi-Fi project wrote code that sampled all categories of publicly broadcast Wi-Fi data. A year later the mobile team put it into the software the Street View cars ran, although, Eustace wrote, the project's leaders had no intention of using payload data. A packet sniffer does not choose: it takes whole frames, and the header Google wanted came attached to everything else on the channel. Robert Graham of Errata Security set out the mechanics on 19 May: a car passing an encrypted home network took nothing readable; one held at a light beside an open café hotspot would be "flooded with data packets from people within the café". Google later put the total at about 600 gigabytes from some 30 countries.
Google grounded the cars, stopped collecting Wi-Fi data with them at all, quarantined the recordings on an isolated network, said it had asked a third party to review the software and confirm the deletions, and recommended encryption to everyone else. Then the deletions stalled. Ireland, Austria and Denmark asked for their data to be destroyed and Google complied; Belgium, France, Italy, Spain, Germany, Switzerland and the Czech Republic asked it to keep everything for their own inquiries. By 21 May the company had stopped deleting altogether, saying that at least one authority had changed its instruction from delete to retain inside a day. German prosecutors opened a preliminary criminal inquiry. John M. Simpson of Consumer Watchdog called on the Federal Trade Commission to investigate: "The FTC needs to ask what did Google know and when did Google know it."
What was actually in the recordings, and what the regulators made of it, belongs to October. The longer argument was legal, and Google lost it. Its position was that traffic broadcast in the clear over Wi-Fi was a radio communication readily accessible to the general public, and so outside the reach of the American Wiretap Act. On 10 September 2013 the Ninth Circuit disagreed: unencrypted Wi-Fi was not primarily auditory, and hearing it took equipment, expertise and physical proximity, which is not what the statute meant by readily accessible. The Supreme Court declined to take the appeal in June 2014. The consolidated class action, brought for a class its own counsel estimated at about 60 million people, ended in a settlement of $13 million, agreed in 2018 and made public in July 2019, under which Google undertook to destroy the data.
Quit Facebook Day
At its f8 conference on 21 April 2010 Facebook had launched the Like button, the Open Graph protocol and instant personalisation, which let three partner sites — Yelp, Pandora and Microsoft's Docs.com — read a visitor's public profile the moment a page loaded, unless the visitor found the setting that switched it off. On 5 May the Electronic Privacy Information Center and fourteen other groups told the Federal Trade Commission that the changes "violate user expectations, diminish user privacy, and contradict Facebook's own representations". On 26 May Mark Zuckerberg faced reporters and replaced more than fifty separate controls with one: a single setting for who could see what, applied to old posts and to features not yet built, one click to switch the developer platform off, and a checkbox to leave instant personalisation. "There needs to be a simpler way to control your information," he said. Quit Facebook Day, called for 31 May by two Toronto technologists, Matthew Milan and Joseph Dee, closed that evening with 33,313 names on its website — the organisers' own count, never independently checked, and about 0.008 per cent of the 400 million users Facebook had announced on 5 February.
Three Laptops in Morrow
Three laptops were stolen from the offices of Serco Inc. in Morrow, Georgia, a contractor based in Reston, Virginia that held a contract with the Army's Family and Morale, Welfare and Recreation division. One of the three came with a removable CD, and on the disc were the names, addresses and Social Security numbers of more than 207,000 Army reservists, along with data that Col. Jonathan Dahms of Army Reserve public affairs said might also belong to reservists' spouses and dependents. The disc was not encrypted, according to Brian Krebs, who reported the loss on 13 May. The Army Reserve Command began notifying those affected by email on Friday 7 May 2010, which is how the loss became public the following week. Police in Morrow investigated the theft and the command appointed an officer to conduct a formal inquiry. Its notification letter promised additional training so that staff understood that personally identifiable information "must at all times be treated in a manner that preserves and protects the confidentiality of the data". The date of the theft was not made public, and Lt. Col. Ben Zoller, a spokesman for the Army Reserve, said there had been no reported incidents of the stolen information being used for any unlawful purpose. The record stops there.
Spectrum, and the Boxes to Carry It
India's 3G spectrum auction closed on 19 May 2010, after 34 days and 183 rounds of bidding across 22 service areas. The government raised Rs 67,718.95 crore, roughly $14.6 billion at the time — Rs 50,968.37 crore from private operators and Rs 16,750.58 crore from the state-owned BSNL and MTNL, which did not bid but paid the price the auction set. No company won a licence for the whole country: Bharti Airtel, Reliance Communications and Aircel each took thirteen circles, Idea eleven, Vodafone and Tata Teleservices nine each, S-Tel three. What had been sold was the first mobile internet most Indians would ever use, in a country where the way online was going to be the telephone rather than the computer.
The same department was meanwhile refusing to clear the equipment those networks would be built from. Under the security rules then in force operators had to obtain clearance for imported network gear, and through that spring orders naming Western vendors went through while orders naming Chinese ones did not; operators were told that Huawei and ZTE, among others, had not been cleared. The block held for the better part of the year and was lifted in August 2010, when the Department of Telecommunications amended the security conditions in the Unified Access Service Licence and both vendors were reported to have accepted every term: inspection of equipment, network designs and source code lodged in escrow, and the operator answerable for the security of its own network. The argument outlived the settlement. What an Indian network must now report when it is breached, and how quickly, is set out on our India desk.
A limited preview of machine learning
At Google I/O in Moscone West on 19 May 2010 Google opened a limited preview of the Prediction API, which put its machine-learning algorithms behind a REST call: a developer left labelled historical data in Google Storage, trained a hosted model and queried it, the announcement on Google's code blog offering product recommendations, sentiment read from blogs and tweets, message routing and the assessment of "suspicious activities". BigQuery arrived the same day on the same terms, invitation only and free through the preview. Neither was a research result; both argued that the useful part of prediction was renting a model someone else had trained. On 4 May, as the ICRA robotics conference opened in Anchorage, Willow Garage had named eleven groups — MIT's CSAIL, Stanford, Berkeley, Pennsylvania, Tokyo's JSK laboratory, Freiburg, Leuven and Bosch among them — each to have a PR2 robot for two years at no cost, chosen from 78 proposals, on condition that the resulting code went back out under ROS. Google shut the Prediction API down on 30 April 2018; BigQuery and ROS are both still standing.
Symantec buys the check mark
Three weeks in May moved much of the security industry into new hands. On 19 May 2010 Symantec agreed to pay about $1.28 billion for VeriSign's authentication business — SSL certificates, public key infrastructure, VeriSign Trust Services, the VeriSign Identity Protection service and a majority stake in VeriSign Japan — the business VeriSign was founded in 1995 to run. The check mark came with it, and became the Norton Secured Seal in April 2012. Six days later McAfee agreed to buy Trust Digital, a privately held firm whose software secured and centrally managed smartphones across iPhone OS, Android, Windows Mobile, Symbian and webOS; terms were not disclosed. Earlier, on 4 May, funds advised by Apax Partners had agreed to take a majority stake in Sophos at an enterprise value of $830 million, the founders keeping a significant minority; Sophos had booked revenue above $260 million in the year to 31 March 2010. The certificates aged worst: Symantec sold that business to DigiCert in 2017 after browsers lost confidence in how it issued them, and Chrome finished withdrawing trust the following year.
⏳ Time capsule — May 2010
- On 6 May, beginning at 2.32 in the afternoon in New York, the Dow Jones Industrial Average fell 998.5 points inside the trading day, about nine per cent, the second-largest intraday point decline to that date, and recovered most of it within about twenty minutes.
- On 11 May, after the general election of 6 May left no party with a majority, Gordon Brown resigned and David Cameron was appointed prime minister at the head of a coalition with the Liberal Democrats — Britain's first coalition government since the Churchill war ministry ended in 1945.
- On 20 May the J. Craig Venter Institute reported in Science the first bacterial cell running on a chemically synthesised genome: about 1.08 million base pairs of Mycoplasma mycoides, assembled from manufactured fragments and transplanted into an emptied Mycoplasma capricolum cell. They called it JCVI-syn1.0.
- On 22 May, at the Santiago Bernabéu in Madrid, Inter Milan beat Bayern Munich 2–0 with both goals from Diego Milito, and under José Mourinho became the first Italian club to take the league, the cup and the European Cup in a single season.
What a passing car could keep
The question Google's mistake raised — whether traffic thrown into the air unencrypted is private — was answered against Google and has stayed answered. The Ninth Circuit's holding of 10 September 2013 stands, the Supreme Court having declined the appeal in June 2014, and the class action ended in the $13 million settlement made public in July 2019, with the data to be destroyed. The practical answer was the one Eustace's post recommended in passing. Sixteen years on the web is encrypted by default and browsers mark plain HTTP as not secure; a car driving the same street in 2026 would hear almost nothing worth keeping. Firesheep, in October 2010, made the case for that shift impossible to argue with.
The protest of 31 May changed nothing. The complaint of 5 May changed a great deal: it became the Federal Trade Commission's 2012 order against Facebook, which required express consent before information was shared beyond a user's settings and independent assessments of the company's privacy programme for twenty years. On 24 July 2019 the Commission imposed a $5 billion penalty for breaking that order and placed a privacy committee on the board. Zuckerberg's answer in May 2010 set the pattern the industry kept — a confusing interface replaced by a clearer one, while the flow of data to partners went on. India's month was quieter and, in its way, larger: spectrum sold for the handsets on which a few hundred million people would first go online, under security conditions written into the licence, where they remain.