When it comes to search engines, Google is by far the one that most companies and individuals shoot for inclusion into.  But it's not always enough to get into Google.  You want your website to show up at the top of the results page for keywords and phrases that are important to your business.  That's what all the SEO stuff is about.  One of the best ways to make sure Google sees your entire website is to use Google Sitemaps.  I've talked about Sitemaps before.  They're single-file snapshots of every file on your server that Google uses to crawl your website.  It's no doubt that they're very helpful in getting your site indexed.

But, as the Guardian Unlimited reports, Shoemoney.com found out the hard way what an improperly created sitemap can do.  In short, it can open your site up to hackers.

Shoemoney.com used default settings to generate a sitemap for Google to index from.  The sitemap included a listing for every file on Shoemoney's website, including old, unupdated, unused files in obscure locations on the server.  Using Google Code search, a hacker located one of those old files and used it to hack Shoemoney.com.

I see the fault here falling into two camps.  Shoemoney.com accepts full responsibility for what happened to the site because the sitemap generation was done incorrectly.  In part, that's entirely correct.  Don't upload sitemaps to Google (or any other search engine) until you're sure they're created properly and don't contain links to parts of your server that you'd rather keep prying eyes out of.

But I also think Google should accept some responsibility for this and other instances of indexing gone completely wrong.  There are several directories, file types, and individual files that Google has no business indexing and making searchable, regardless of what a sitemap says.  And despite their desire to catalog the world's information, I don't think that involves directories and files store on private servers that the company really knows better than to index.

Oh, but you say the crawling and indexing of websites is done by a computer?  That's true.  But Google really needs to make sure their computers aren't indexing the kind of information mentioned in the GU and Shoemoney articles.  When would a website owner ever want their log files or database configuration files added to the public Google search engine?

The "world's greatest search company" can figure out a way to fix this.  If not, they need to rethink their strategy to using sitemaps.  As soon as the wrong person's website gets exploited because Google indexed a password file, the issue will explode.

But that's not the end of it.  Google's eyes can see much more than the files it indexes for the search engine.  The much-touted Google Desktop is also guilty of what many would consider a pretty serious security violation.  As one IT department found out, a feature included in Google Desktop sends entire files to Google for storage.

The feature allows people with more than one computer to access and search files regardless of which computer they reside on.  It does this by uploading files on personal computers to Google servers from which the document can later be retrieved.  Google says the system does this to allow people to access files located on computers that are turned off or not connected to the internet.  It also says that old files are automatically deleted and aren't accessible by people doing Google searches.

But here's where I think the flaw in that philosophy lies.  Nothing is computer secure.  Sure, Google probably has some of best security measures available in place on its servers.  It would probably be very hard for a hacker to access the server that all of these private files are being stored on.  But nothing is impossible.  It's quite possible, in fact, that private or sensitive information could find its way into foreign hands either by way of a hack or simply curious eyes at Google.  As the IT department in the article I referenced above illustrated, the information that would have been sent to Google from their business contained sensitive medical information on who knows how many people.

Every company out there won't be as observant as that IT department was.  Who's to say that other companies with your private data on their computers aren't sending all that information to Google without even realizing it?

How could Google ever really think this system could be totally secure?  While the information is there for those willing to look, they don't publicize the fact that their search engine crawls private files or that their Desktop product sends entire files to their servers.  Why?  Because they know people wouldn't go for it.