Google Person Finder Easily Abused

Apparently Google wanted to help earthquake victims but gave them a tool that lacked even the most basic protection against abuse. It quickly attracted mischievous and hurtful anonymous comments. It then came under harsh criticism. Japan Probe, for example, issued this warning:

If you are using Google’s Person Finder App to search for information about people who were in Japan during the 2011 Tohoku Earthquake, please be warned: the site has fallen victim to dozens of trolls. Legitimate inquiries by family members are being met with untruthful death notice responses from mean-spirited jerks.

The comments are too awful to repeat here — racist and graphic — but can be found on the Japan Probe site.

I am not surprised that some people in the world are cruel and will try to attack or take advantage of those who are most vulnerable. That is a sad reality.

I am surprised, however, that Google developers would post an application for victims that exposes them and makes them targets of obvious/known threats and abuse. It did not filter on harmful language, it did not require any confirmation. Did Google allow a product to launch without even the most basic security review?

Google provides a disclaimer on the data entry page:

PLEASE NOTE: All data entered will be available to the public and viewable and usable by anyone. Google does not review or verify the accuracy of this data.

Obviously, however, they have responded after criticism. Japan Probe has posted an update: the fake death reports and fraud messages (asking for contact and personal information) they reported have been removed.

Note the URL, designed for easy abuse automation:

http://japan.person-finder.appspot.com/create?add_note=&age=&author_email=&author_name=&author_phone=&clone=&confirm=&content_id=&date_of_birth=&description=&dupe_notes=&email_of_found_person=&error=&first_name=&flush_cache=&found=&home_city=&home_country=&home_neighborhood=&home_postal_code=&home_state=&home_street=&id=&id1=&id2=&id3=&key=&lang=&last_known_location=&last_name=&max_results=&omit_notes=&operation=&person_record_id=&phone_of_found_person=&photo=&photo_url=&query=&role=provide&sex=&signature=&skip=&small=&source_date=&source_name=&source_url=&status=&style=&subdomain_new=&target=&text=&utcnow=&version=

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.