DISCLAIMER

This weblog is created for the purposes of an MBA project for the subject BYL 7134, Cyberlaw. The materials posted on this weblog are for the purposes of the assignment as well as study and non-profit research. Appropriate acknowledgments to the materials that do not belong to the weblog owner have been publicly made. If you are the author or a copyright owner of any of the articles posted in this weblog and you object to such posting on any grounds, including copyright infringement, please contact me and I will take your material down. I state herein that I am relying on the doctrine of fair use. Thank you for supporting my blog.

Tuesday, May 18, 2010

One Case about aniffing by Google: "Google WiFi sniffing technology was patent plan"


A just-amended complaint in a class-action lawsuit first submitted two weeks ago claims that a patent Google submitted to the US Patent and Trademark Office in November 2008 shows that the search giant purposefully created technology to gather, analyze and use data sent by users over their wireless networks.

The lawsuit, which was filed by an Oregon woman and a Washington man in a Portland, Oregon federal court May 17, accused Google of violating federal privacy and data acquisition laws when its Street View vehicles snatched data from unprotected Wi-Fi networks as they drove up and down streets.

Google acknowledged the privacy issue 14 May, but said it had not known it was collecting data from unprotected wireless networks until recently.

The company faces multiple civil lawsuits in the US, and is under investigation by authorities in several countries, including Canada , the Czech Republic, France, Germany Spain and Italy. The US Federal Trade Commission (FTC) has said it will take a "very, very close look" at the Google practice.

Lawyers for the plaintiffs in the Oregon lawsuit upped the ante Wednesday when they amended the original lawsuit to include charges that Google filed for a patent on Wi-Fi sniffing technology more than a year and a half ago.

According to the modified complaint, Google's technology can collect the make and model of wireless routers, the street address of that router and even the "approximate location of the wireless AP [access point] within the user's residence or business."

In its patent application , Google noted that multiple antennas could be mounted on vehicles, which would be able to obtain a more accurate estimate of the router's location based on a "stereo" effect.

Google has admitted that it sniffed basic wireless network information -- including the network and router identifiers -- to map those networks, which would then be used by mobile devices such as smartphones to pinpoint their locations in Google's mapping services. Google has claimed, however, that the code which grabbed data from unsecured Wi-Fi networks was added to the Street View vehicles data sniffers by mistake.

But the plaintiffs' lawyers said Google's patent application showed that the company's Wi-Fi locating technology had more in mind than just basic information.

"As disclosed in the '776 Application, the more types and greater the quantity of Wi-Fi data obtained, decoded, and analyzed by Google from any particular user, the higher its 'confidence level' in the calculated location of that user's wireless AP," the changed lawsuit stated. "Collection, decoding, and analysis of a user's payload data would, therefore, serve to increase the accuracy, value, usability, and marketability of Google's new method."

"Payload data" is the term given to the information transmitted over wireless networks, including the data that Google said it unintentionally snatched from the air as its Street View cars and trucks drove by homes and businesses.

"Google has employed one or more of the methods disclosed in the '776 Application to collect, decode, analyze, store, and make beneficial use of wireless data (including payload data) it collected from plaintiffs and class members," the lawsuit alleged.

Thursday, May 6, 2010

Avoiding the Risks of Eavesdropping and types of It....

The risks of eavesdropping affect all Internet protocols, but are of particular concern on the World Wide Web, where sensitive documents and other kinds of information, such as credit card numbers, may be transmitted. There are only two ways to protect information from eavesdropping. The first is to assure that the information travels over a physically secure network (which the Internet is not). The second is to encrypt the information so that it can only be decrypted by the intended recipient.

One form of eavesdropping that is possible is traffic analysis. In this type of eavesdropping, an attacker learns about the transactions performed by a target, without actually learning the content. For example, the log files kept by Web servers are particularly vulnerable to this type of attack.