In the wake of a stunning data breach the University of Victoria campus community could only hope that the institution would do everything it could to regain lost trust. One such opportunity arose this week, when controversial Google Streetview vehicles have been scheduled to canvas the campus. Unfortunately the opportunity was squandered: it is largely by accident that the campus community has – or will – learn that Google is capturing images and wireless access point information.

In this short post I want to discuss how seriously the University failed to disclose Google’s surveillance of the campus. I begin by providing a quick overview of Streetview’s privacy controversies. I then describe the serious data breach that UVic suffered earlier this year, which has left the institution with a significant trust deficit. A discussion of the institution’s failure to disclose Google’s presence to the community, and attempts to chill speech around Google’s presence, follows. I conclude by suggesting how institutions can learn from UVic’s failures and disclose the presence of controversial, potentially privacy invasive, actors in order to rebuild flagging trust deficits.

Google Streetview and Privacy

Streetview has been a controversial product since its inception. There were serious concerns as it captured images of people in sensitive places or engaged in indiscreet actions. Initially the company had a non-trivial means for individuals to remove images from the Google Streetview database. This process has subsequently been replaced with an option to blur sensitive information. Various jurisdictions have challenged Google’s conceptual and legal argument that taking images of public spaces with a Streetview vehicle are equivalent to a tourist taking pictures in a public space.

In their early discussions of the Streetview product, the Privacy Commissioner of Canada had this to say:

We would again highlight the need for knowledge and consent – you must let citizens know that they are going to be photographed, when, why, and how they can have their image removed.  We would also encourage you to be sensitive about the areas you choose.   We note that in your company’s appearance before the ETHI Committee, you committed to contacting community organizations prior to the launch of StreetView in Canada to notify them of the blurring capability as well as the process for having images removed, in case they wish to explore that option.  We appreciate your undertaking to do so.

Further, the Privacy Commissioners of Canada, Alberta, Quebec, and Ontario collaborated to produce a short letter to Canadians about Streetview-like systems. As noted by a member of their staff, the basic message from this letter was:

Under Canadian privacy law you should know when your picture is being taken for commercial reasons, and what your image will be used for. Your consent is also needed. There are exceptions, but they are very limited and specific.

…

We think companies that engage in this activity have to let citizens know that they are going to be photographing the streets of their city, when this will happen, why and how they can have their image removed if they don’t want it in a database.

While concerns remained amongst Canadians surrounding Streetview, the next major controversy arose when the public learned that Google was capturing unencrypted wireless access point data. Google initially stated that they had only collected SSID and MAC addresses from routers. As I’ve written before

In layman’s terms, the SSID is the name of the wireless network that is usually given to the device during configuration processes following the installation of the device (e.g. Apartment 312, Pablo14, or any of the other names that are shown when you scan for wireless networks from your computer). The MAC address is a unique number that is associated with each piece of Internet networking equipment; your wireless card in your computer, your LAN card, your router, and your iPhone all have unique numbers.

Google correlated the SSID and MAC address with GPS information to geolocate the router. This information is used to speed along geolocational searches using Google products; it’s faster to query wifi points and then move to GPS coordination than purely rely on GPS. Google collected this information, initially, regardless of whether an individual was interested in having wireless access point information deposited in Google’s databases. This has changed, though the ‘solution’ is perhaps as absolutely inelegant as is humanly/technically possible.

The Privacy Commissioner of Canada, amongst others, saw the collection of the SSID and MAC data as minor issues. The relative significance of this information varies depending on its usage; in a Blackhat conference talk, a researcher demonstrated how this information was instrumental in geolocating people who communicated with the researcher. In a research case this is interesting: in a human abduction or stalker situation it’s far more poignant.

What Privacy and Information Commissioners around the world were most concerned and upset by were subsequent revelations that Google’s Streetview vehicles were actually collecting data from the unsecured wireless networks that they drove past. While the company initially stated that this was an error – the result of old code accidentally being recycled – it turns out that the company knew it was collecting this data for three years before their actions came to the public eye. In her analysis, the Privacy Commissioner of Canada concluded that Google had collected the following types in information: complete email messages; user names and passwords; real names of individuals; residential and business addresses; phone numbers; medical conditions; potentially illegal actions (e.g. statements of speeding); unencrypted cookies with personal information such as IP addresses, user names, and postal addresses.

Google has since assured the public that the offending code has been removed and that ‘accidentally’ collected data has been purged. They have not been particularly forthcoming in American investigations and, partially as a result, have experienced renewed international investigations of the product. Regardless of whether the company has incurred serious financial costs due to Streetview’s continued mishaps, the Streetview brand has been tarnished: Streetview vehicles almost inherently carry with them a degree of controversy.

University of Victoria and Community Trust

In early 2012, the University of Victoria suffered a serious data breach. From reading the report produced by the Office of the Information and Privacy Commissioner of British Columbia (OIPC), we learn that a series of failures occurred. Data was lost to unknown criminal third-parties when an unencrypted storage device was stolen from the Administration Building. In the report, we learn that (.pdf):

Interviews with various University staff made it clear that senior staff in Financial Services had considered using encryption on the storage device and in fact had received advice from others that encryption should be used. Further, they agreed that encryption was an appropriate security measure. However, although there appears to have been an intention to encrypt the data, it was not carried out (Pp. 15-6).

Further, the Commissioner recognizes that physical security was lacking. First, she found that

the University placed the device in what was deemed to be a secure physical location. Of course, in the actual event, what was perceived to be a very secure location was not, because the safe was not properly fixed in place. The anchors were not appropriate to prevent the safe being dislodged, and the thieves were able to remove it (Pp. 13).

Second, she found that

the University staff did not make a decision to alarm the premises of Financial Services. Although we were informed that a break-in of the premises was considered an unlikely occurrence in the past, I believe that the amount of personal information housed in the Financial Services and Payroll areas should have led to the recognition of the need to alarm those areas. As well, since the other half of the building already had alarms in place, all areas of the building could have been easily alarmed (Pp. 14).

These physical security failures, accompanied by a failure to encrypt the data on the storage device, meant that almost 12,000 current and former employees of the University of Victoria had the following information compromised: names, social insurance numbers, and banking information. The loss of such information constitutes an incredibly serious data breach.

In short, UVic suffered an incredibly public loss of face. Ryan Berger, who sits on the Canadian Bar Association’s freedom of information and privacy section, recognized that the University had a large challenge in rebuilding its reputation. While being public about the data breach and – somewhat surprisingly to some – subsequently being recognized as a top employer in Canada might help, rebuilding trust would be an ongoing process.

Streetview Comes to Campus

Given the need to rebuild community trust, it’s disappointing to see the University of Victoria obfuscate the fact that a controversial, previously found to be privacy invasive, service was authorized to work on campus without any apparent public consultation. The Privacy Commissioner of Canada strongly suggested that Google should contact community groups prior to deploying their cameras and, it seems, Google has done that: they apparently contacted the University and the institution subsequently ‘notified’ the campus community. I would suggest, however, that the notice is as minimal as possible and is intentionally designed to hide Google’s presence to the wider community.

The University released the following information, though it was not distributed widely to the campus community and instead quietly added to a sub-section of their homepage:

Campus mapping project May 29-31