Information & Ethics Committee on Oct. 28th, 2010

[Patricia Kosseim]

Mr. Chair, we received, as did all data protection authorities, notice from Google in April 2010 that they had intended to collect and were collecting publicly broadcast Wi-Fi radio signals. This was with a view to enhancing its location-based services in order to pick up and to identify the availability of radio signals in the neighbouring area and the relative distance to their automobiles.

As a question of practicality, they were proceeding to collect that data at the same time they were collecting street-level photography, because they had the cars going around anyway. So they announced that they were putting antennae on the roofs of the cars to at the same time collect and capture the neighbouring Wi-Fi radio signals.

What Google did not say, because Google did not know until May, prompted by requests for further information from the German data protection authorities.... They realized in May and publicly announced in May that unbeknownst to them as an organization, they were also collecting not only the radio signals and the presence of those signals, but communications and the content of communications being picked up and travelling through those signals, if I may say. This we found out in May of 2010.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

You're saying that in April 2010 they notified you that they were doing this extra piece. But they had launched the service back in October 2009. So had they been collecting that information prior to April 2010, or was that when they began doing it? Were they just confirming that they had been doing that all along and that it had been part of the photographic work they had done prior to that?

[Patricia Kosseim]

What they began to do earlier was street-level photography, which they announced they were deploying in Canada. What they announced in April 2010 was the addition of antennae on their automobiles, with a view—I believe prospectively—to also collecting Wi-Fi radio signals.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

So it seems that they weren't doing this initially, when they began to do the photographic work to launch their service; that they hadn't initially been collecting data on Wi-Fi access points.

[Patricia Kosseim]

My understanding is that when they deployed the product initially and announced they were deploying the product in Canada, as they had in the U.S., it was with a view to street-level photography imaging—

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Only?

[Patricia Kosseim]

Yes, initially.

And by their correspondence to data protection authorities in April 2010 they announced this now-added feature that they would be doing by placing antennae on the roofs of these cars to prospectively also pick up and publicly broadcast Wi-Fi signals.

Now, I have no knowledge of how early they did that, other than the date at which they notified that they would be doing it.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Okay.

Is there any intrinsic connection between doing the photographic street images and collecting the Wi-Fi access points? Is that necessarily linked? Do you have to collect the Wi-Fi access points to be able to use the street imaging technology appropriately?

[Patricia Kosseim]

No. My understanding, Mr. Chair, is that the street-view imaging technology collects the photographic images of your neighbourhoods that you all see on your Google maps when you Google your neighbourhood, as I'm sure you have—as I have. That is a product in and of itself.

This new enhancement is an additional idea developed by one of their engineers, to include in the code at the same time not only images, but also to pick up radio Wi-Fi signals. And this afterthought, or this additional enhancement, was with a view to improving their location-based services.

If you would like an explanation of the business rationale for this enhancement, I could ask my colleague to explain how that actually enhances location-based services.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

I would appreciate knowing that, yes.

I take it that's you, Dr. Patrick.

[Dr. Andrew Patrick]

Yes, it is.

When you have a device such as a cellphone or a BlackBerry, it has often built into it the ability to help you locate yourself. Most modern devices now can use three technologies simultaneously: GPS, if you can see the GPS satellites; the cellphone tower information from whatever cellphone towers it's able to see; and also this Wi-Fi data. When you walk into a strange street you can determine what satellites are visible, but also whether there's a Wi-Fi from a local coffee shop, or from the Joneses next door, and that information can be used to recognize where you are.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

I'm still struggling with when we knew they were using Wi-Fi data. It sounds as though it can be used as an enhancement of the street imaging process, but it wasn't necessary for it. It improved as it went along, or something like that. Is that possible?

[Dr. Andrew Patrick]

In their statement to us and to all the data protection authorities in April, they said basically that they were taking advantage of the fact that they were driving the cars around anyway,--

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Okay--

[Dr. Andrew Patrick]

--but it really is a separate technology and a separate service.

[Bill Siksay, NDP, Burnaby—Douglas, BC]

Okay.

Is there any privacy concern about the collection of Wi-Fi access points? I know there's clearly a concern with payload data, but what about collecting data about Wi-Fi access points? You talked about their being a public broadcast, and unprotected, and you said people haven't taken steps to protect their wireless networks, but it is there a privacy concern specifically about collecting data about Wi-Fi access points?

[The Chair, Liberal, Shawn Murphy]

Thank you, Mr. Siksay.

[Patricia Kosseim]

May I ask Dr. Patrick to address that question as well?

[The Chair, Liberal, Shawn Murphy]

Yes, please.

[Dr. Andrew Patrick]

There is a potential for concern. If information about the presence of a Wi-Fi access point can be at all linked to a particular individual, either individually or in combination with other bits of information, then it would be potentially personal information and therefore potentially something that we would be worried about.

[The Chair, Liberal, Shawn Murphy]

Thank you very much, Mr. Siksay.

We're now going to move to Ms. Bennett. Ms. Bennett, you have seven minutes.

[A voice]

Do you mean Mrs. Davidson?

[The Chair, Liberal, Shawn Murphy]

I'm sorry; it's Mrs. Davidson.

We'll go to Mrs. Davidson for for seven minutes, and then we'll go to Ms. Bennett.

[Patricia Davidson, Conservative, Sarnia—Lambton, ON]

Thank you, Mr. Chair.

Thanks very much for being here with us this afternoon.

As you can tell, we've got a lot of questions. I think we're almost to the point--at least I know I am at the frustration level--where the “Oops, sorry” scenario is getting to be a little bit thin. We need some firm assurances. We need to know what direction we're taking. The speed and the diversity of our development of technology today make it imperative that we have some better things in place to regulate it and to show we are secure.

Going back to what Dr. Fry asked about the unsecured sensitive information that was inadvertently collected, whether it was inadvertent or whether it wasn't is immaterial at this point; how do we know that there weren't violations when it was collected? Do we know for sure that the information was not used for something it shouldn't have been? Do we have a way to know that?

[Patricia Kosseim]

Mr. Chair, the announcement that Google made when they identified the “oops”, as you say, was a public announcement in May of 2010, announcing to the world that they had inadvertently collected payload data. They immediately halted their automobiles and immediately halted further collection of Wi-Fi data.

In the course of our investigation, to my knowledge there was no indication to lead us to suspect that anything untoward had been done with the data that had been inadvertently collected. As soon as it was identified, as I said earlier, the investigators were confident that appropriate security measures had immediately kicked in and segregated and secured the data appropriately.

We have no knowledge or any reason to believe, from the basis of the investigation, that anything untoward was done with the data that were collected.