<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7638.1">
<TITLE>RE: [AusNOG] Google creepier than Conroy?</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>If you're running Chrome, check this out: this is probably the end-game goal for Google :)<BR>
<BR>
<A HREF="http://html5demos.com/geo">http://html5demos.com/geo</A><BR>
<BR>
<BR>
-----Original Message-----<BR>
From: ausnog-bounces@lists.ausnog.net on behalf of Narelle<BR>
Sent: Mon 5/31/2010 8:49 PM<BR>
To: ausnog@ausnog.net<BR>
Subject: Re: [AusNOG] Google creepier than Conroy?<BR>
<BR>
On Sun, May 30, 2010 at 4:18 PM, Craig Askings <craig@askings.com.au> wrote:<BR>
> Why do I get the feeling that Dale Clapperton is lurking on this list and<BR>
> just shaking his head as we all play Telco Solictor..... Badly<BR>
<BR>
IANAL and neither have I read Google's actual code (so I am making<BR>
assumptions on what they've done)<BR>
<BR>
BUT<BR>
<BR>
I have read both the Telecommunications Act and the Telecommunications<BR>
Interception Act and it is my professional opinion that neither of<BR>
these acts is relevant to the activity under question. Both of these<BR>
relate to 'network units' or 'links' provided under carriage<BR>
services...<BR>
<BR>
Neither is the Privacy Act relevant.<BR>
<BR>
The one I do think is relevant, however, is the Crimes Act, at least<BR>
in NSW it's section 308 - the parts related to unlawful access to<BR>
someone's computer. Federally, it's the CYBERCRIME ACT 2001 - SCHEDULE<BR>
1. You'd have to follow that assessment up with a review of relevant<BR>
case law, and this I haven't checked.<BR>
<BR>
The question in legislation imho is long settled that just because you<BR>
left the window open the burglar is still - in law - deemed to have<BR>
broken in...<BR>
<BR>
<BR>
On to the question of home network security and WiFi access points:<BR>
these things are appallingly insecure in general use. Consumers are<BR>
not generally aware that they are making their networks easily<BR>
accessible by anyone in the vicinity of them. Their expectation is<BR>
that they will be lucky if they can get it to work at all, so are<BR>
happy when their own computer/s can connect to it and then the<BR>
Internet.<BR>
<BR>
I've set up a few recently for people, and, as a statistically<BR>
unrepresentative sample, I've been using the set up wizards just to<BR>
see where they take me. None of them, so far, have left me with a<BR>
secured access point! The most they do is set a new SSID - they don't<BR>
prompt users to turn off broadcasting, nor add even a WEP key (let<BR>
alone something stronger), NOR change the default password! [These<BR>
are, of course, the next few steps I take...]<BR>
<BR>
Anyone who's spent any time on a helpdesk will also know how much fun<BR>
it is talking people through these steps on a telephone. One recent<BR>
experience I had with this went round and round with the device<BR>
repeatedly refusing to accept the config... Of course, it "worked"<BR>
fine just following the bouncing ball, but, yes, it was totally<BR>
insecure. Customer was happy to have it totally open, as long as they<BR>
could get to the Internet... [yes, I fixed it later]<BR>
<BR>
imho Google may have done people a service by publicising this level<BR>
of insecurity. That said, I didn't see them actually publish any<BR>
useful data on - for eg - rates of insecurity in home wireless LANs,<BR>
or helpfully advise people that x level of WLAN usage exists. Please<BR>
don't get me wrong - I do consider what has been _alleged_ to have<BR>
occurred unethical!<BR>
<BR>
Has anyone seen the code in question? I saw in question time that Sen<BR>
Conroy had seen it, but I doubt he will have "decoded" it...<BR>
<BR>
What is Google's intent with this data? What have they admitted to<BR>
doing with it? How are they securing the information they have<BR>
collected? Have they issued a public statement on the topic?<BR>
<BR>
I have a strong recollection that had I done a similar thing as part<BR>
of a research study there would have been ethics committee approvals<BR>
required... but we wouldn't have had the funding!<BR>
<BR>
<BR>
<BR>
--<BR>
<BR>
<BR>
Narelle<BR>
narellec@gmail.com<BR>
_______________________________________________<BR>
AusNOG mailing list<BR>
AusNOG@lists.ausnog.net<BR>
<A HREF="http://lists.ausnog.net/mailman/listinfo/ausnog">http://lists.ausnog.net/mailman/listinfo/ausnog</A><BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>