May 29, 2017

Google Accused Of Pilfering Data

A North Carolina school district claimed Google cracked its server to index a page containing the names, test scores, and Social Security numbers of 619 students.

Google Accused Of Pilfering Student Data
Google Accused Of Pilfering Student Data

Winston-Salem’s Journal Now reported a North Carolina judge granted a temporary injunction against Google, requiring it to remove information about the Catawba County Schools Board of Education from its servers. Google said it hasn’t done anything wrong.

At issue is information the school district had stored on a password-protected server. A page of personally identifiable student information ended up on Google, where searchers could view it until its apparent removal on Friday.

The school district has been carrying details of the incident on its website. Superintendent Tim Markley described what was accessed in a report there:

The media was informed of an internet link that released confidential information. The link, a 2001-2002 document, contained the names of 7th and 8th grade CCS students who took a CTE exam. The document includes students’ social security numbers. This site was a DocuShare password-protected site that required all users to log-in.

A Google spokesperson cited in the Journal Now report confirmed that Google could not access or index a password-protected site. But the districts CTO, Judith Ray, claimed that Google somehow managed to get in and grab the page:

“One of the students on the list had a presence on the Web,” she said. “In Google’s effort to get information on her, one of its spiders latched onto her name in this document. We were not aware that password-protected sites are set up like that. To our knowledge, Google could only cache unsecure information that did not require a password or username.”

It seems more likely that the page was exposed to the Internet through another link, or possibly a misconfiguration in its security. Markley noted that the DocuShare server had been shutdown as of Friday. Access logs to the system would likely be instructive as to the path the Googlebot took to retrieve that page.


Add to | Digg | Yahoo! My Web | Furl

Bookmark WebProNews:

About David Utter 902 Articles
David Utter is a business and technology writer for SecurityProNews and WebProNews.