Header Ziff Davis Enterprise
Advertisement
Advertisement
Monday, June 26, 2006 8:34 AM/EST

It's 2006. Has Google Indexed Your Kid's Social Security # Lately?

School's out for summer, but it looks like Google isn't taking any breaks.

A county school system in North Carolina filed an injunction against the search engine on Friday, saying it improperly indexed private information about schoolchildren, including test scores and Social Security numbers.

The injunction was honored by the Honorable Richard D. Boner and calls for Google to remove any information pertaining to Catawba County Schools Board of Education from its servers. The injunction also alleges conversion and trespass against Google.

The school board alleges that information on 619 students was secured on a DocuShare server, which requires a username and password to access. One of those students has a presence on the Web, according to information the school system's chief technology officer, Judith Ray, shared with a local news site. Ray said the file that Google indexed was removed from the server on Friday, but the information was still available online.

A Google spokesperson said the company cannot index information secured by password The company has not returned an e-mail requesting additional comment.

"We worked with the school district to remove the information from our index within hours of receiving their email request. We have not been served with the injunction," said a Google representative.

"It is completely ridiculous," said Search Engine Watch's Barry Schwartz in a brief interview. "Google cannot index pages behind password forms." Schwartz said that the data may have been accidentally published on the Web, or that a page was published that contained the password embedded in a hyperlinked URL.

Schwartz said, however, that he was "all for Google removing the content."

Google doesn't have a history of complying with court-ordered injunctions, whether in the United States or abroad.

Update: Danny Sullivan has more info, including an e-mail from Catawba County Schools' Judith Ray.

TrackBack

TrackBack

http://googlewatch.eweek.com/cgi-bin/mte/mt-tb.cgi/9454

Comments (21)

anonymous :

robots.txt

Walter :

Do you think this information will disappear from the Google indexes more rapidly than the 5.5 billion bogus pages (http://googlewatch.eweek.com/blogs/google_watch/archive/2006/06/21/10979.aspx) did? I wonder... My experience has been that Google is responsive to requests to remove data, even in cases when the relevant Webmaster refuses to remove the offending content from the site. Does Google treat situations like this as something of an emergency (relatively speaking) given the privacy implications? The school system is completely at fault here, but perhaps it's just a little too difficult to get a prompt/human response from Google, hence the need for legal action? An injunction seems like a nuclear response, but then again, if you have student social security numbers online, and all that Google provides is help forms and support e-mail addresses, maybe this is the easiest way to get your issue addressed immediately?

anon :

According to the school's web site, here is the timeline: 6/22 - The school system was notified of the breach. They deleted the documents from their DocuShare server 6/23 afternoon - The school system shut down it's DocuShare server to evaluate if any other documents were available. They noticed that the documents were still available via Google's cache. They contacted Google about the problem. by 6/23 evening - Google had eliminated the documents from their cache. It seems like Google acted quickly upon learning of the problem. Their web site mentions nothing of the court injunction to remove all information pertaining to Catawba County Schools from its servers. I just checked and you still can search "Catawba County Schools" and there is a cache for their web site. The school system didn't know how Google could have accessed the data from their "Password Protected site." Apparently, the site wasn't very "Password Protected" and the school system probably has no one to blame but themselves. I highly doubt that Google tried to hack into their system so they could make sensitive information available to the public.

Walter :

Such a quick response to a major privacy issue is great to see. Google could have been faulted for not responding quickly in this case, but they did. From a security standpoint, it would be interesting to learn exactly who and/or what opened a hole on the school system's server.

Jim :

More then likely the School Server was not secured properly. My experience with most school data systems are that they are antiquated or run by a third party company, who is not on-site unless there is a problem. Nobody within the school system knows how it works or why, just that it works. Google's spider that searches the web can not hack through passwords, nor would they try. If a hack attempt was made for every secured site, Google wouldn't be able to index anything in a timely manner. Long story short - the school is a fault here. Get an IT staff and a clue.

elrogero :

It is really quite obvious, that having a student with a "web presence" has now bit them. The student or the local administrator accidentally published something to the web that he/she was not supposed too. In an attemtp to cover there own butt they are trying to blame google. It goes something like this.... IT Admin: Oh geez I accidentally published personal information to the web and google indexed it. Superintendant: Oh no, don't tell anyone, if the press gets ahold of this it will be another month long bashing of network security at school's. IT Admin: Wait, I have an idea let's make it out to be that google essentially hacked into our server with their discovery software and than in turn published the information. Super.: That's an idea if we make everyone focus on google we won't have to worry about it. This can actually benefit my sick political idea's that we need to control the internet and its content. Mwuahhahaha.. IT Admin: Well, okay, good I get to keep my job another day.

Jon :

The story headline is flame bait. Google removed the content in a most expeditious manner. For shame, eWeek.

JohnF :

When the US Navy first made online computer training available over the internet, they had a userid/password requirement to login and use the training materials. HOWEVER, once I logged in on the login page, I discovered that the folder that held the training courses' sub-folders was not secured. If you browsed to the folder of courses, you could bookmark that folder and come back to it without logging in. You could download every course without a password. I'm sure the school though the docushare data was secure, but I doubt that it really was.

PaulM :

I agree that this headline seems misleading. If you can follow a link to get to "private" data, so can a search engine. Google and other engines don't guess passwords, so someone left a link lying around with a password in it, or else the data wasn't really password protected at all. Sounds like Google responded quickly. Bad headline, eWeek.

Stuart W. :

I don't think the headline is all that misleading. The first thing I thought of when I saw it was "yeah, my kids' schools are probably inept enough to be publishing private data on the Web." It really doesn't imply any fault of Google, it's a basic fact that Google's system indexed some children's SSNs. Anybody who understands search engines (which apparently does NOT include that school) can quickly assume the fault is with the school.

RickM :

The title definitely implies that google is indexing things they shouldn't be; and adding children into the mix adds the "bam" factor. I lost a chunk of respect for eWeek on this one. Perhaps this is becoming the "National Inquirer" of IT news?

Steve Bryant :

So I guess "Google hates your child" wouldn't have been good either? How about: -- Google's Got a Problem Child. Or two. Or 619. -- Google: Doin it for the Kids -- Google's Numbers Game

Kevin :

The story headline is misleading - This sounds more like the school failed to secure its server. The headline should read more like "Is your school districts network secure?"

Ryan :

I Have to agree that eWeek is a little out of line with that headline. It totally seems to bash Google when they haven't done anything wrong. Don't show any bias in a news story, Journalism 101. :-(

Steve Bryant :

I'm sorry you guys think it's a misleading headline. But I am writing a Google blog here. So I've got a little more leeway than a traditional article. And, I'm pretty sure the article itself was balanced and gave the correct information. But I'm totally down for changing the hed to "Google Hates Your Children.

Stuart W. :

I think it's only misleading for those who are as clueless as the school about how Google works. The only other "excuse" for calling it misleading is thinking that Google is so godly that it shouldn't even be associated innocently with anything negative.

Anonymous :

Shame on you, Steve. Google only indexes publicly available information that any of us could've found if we had the time to look for it. Tell the school system to spend those precious funds on properly securing their servers instead of attorneys and unnecessary litigation.

Steve Bryant :

Shame right back atcha, anonymous. If you read the blog entry, you'll see I didn't cast any aspersions on Google at all. Fact, I gave them a quote and Barry Schwartz a quote, who defended Google.

Bob Juch :

OK, the school took care of Google but how about the other search engines? I'm sure they have the same pages cached. Duh!

anon :

Just shameful. Put your muck-rake down and try helping people, you sound like a stubborn child. "Google doesn't have a history of complying with court-ordered injunctions, whether in the United States or abroad." You have absolutely no factual basis for this (poorly worded) claim. Do you have any idea how many court ordered injunctions Google has complied with versus how many they have not? You might be surprised what you find when you do a little googling yourself. I was able to find this sensitive information on at least one other major search engine. Very sad attempt, Mr Bryant.

anon :

Mr Bryant, sounds to me as if you are desperate for news. I guess for your sake made up news is better than no news. Shame on you, your content is slanderous at best. Anon

Post a Comment

 
 

Advertisement

Advertisement