July 8, 2005 4:00 AM PDT
FAQ: Wi-Fi mooching and the law
- Related Stories
-
Worried about Wi-Fi security?
January 19, 2005 -
Linksys feels the need for more Wi-Fi speed
January 4, 2005 -
SBC opens up Wi-Fi roaming
October 18, 2004 -
Wi-Fi arrest highlights security dangers
November 28, 2003 -
Cable companies cracking down on Wi-Fi
July 9, 2002
A man sitting in a Chevy Blazer in a residential neighborhood reportedly was poking around nearby wireless networks in violation of computer crime laws, according to local police.
This appears to be the first arrest in which the sole offense was allegedly accessing a wireless network without prior authorization, and it's already being viewed as a probable test case. CNET News.com interviewed legal scholars to ask what rules apply to Wi-Fi (also called 802.1x) hot spots.
Is it legal to use someone's Wi-Fi connection to browse the Web if they haven't put a password on it?
Nobody really knows. "It's a totally open question in the law," says Neal Katyal, a professor of criminal law at Georgetown University. "There are arguments on both sides."
Wi-Fi's urban push
That doesn't make much sense. Is there a specific law that regulates Wi-Fi access?
Sort of. The primary law is the federal Computer Fraud and Abuse Act.
You can read it for yourself, but the important part (check out paragraph (a)(2)) covers anyone who "intentionally accesses a computer without authorization or exceeds authorized access." Nobody knows exactly what that means in terms of wireless connections. The law was written in 1986 to punish computer hacking--and nobody contemplated 802.1x wireless links back then.
What do prosecutors think?
We asked the U.S. Justice Department on Thursday. A department representative who did not want to be quoted by name said, essentially, that it depends on the details of each case.
The representative said in an e-mail exchange: "Whether access is considered authorized can be determined in part by the precise circumstances of access, just as it would be in the physical world. The prosecutor and jury would look at how the access was accomplished and what was done with the access before definitively determining that it was unauthorized." In other words, the representative said, someone sitting in a company's parking lot at 3 a.m. for the sole purpose of network connectivity might be viewed as a lawbreaker.
Will we ever get a straight answer?
Yes, but expect it to take a while. "This is a problem with the way the legal system works," says Orin Kerr, a law professor at George Washington University who has written a detailed article on unauthorized network access. "Nobody knows how an ambiguous law works until a prosecution is brought and a court decides."
Alternatively, Congress could rewrite the Computer Fraud and Abuse Act to clear things up, but nobody expects this to happen anytime soon.
How about sharing? Is it legal for me to share my cable modem or DSL connection with my neighbors?
In many cases the answer is no. It depends on the wording of your contract with your broadband provider. Many don't want you to share. As far back as 2002, Time Warner Cable was sending warnings to customers with open Wi-Fi access points, and a year later it sued an apartment complex on charges of illicit sharing. Also, AT&T Broadband has acknowledged monitoring customers for "inordinately high" usage.
"Our terms of service for Verizon Online DSL customers do prohibit them from sharing their connection," says Verizon spokeswoman Bobbi Henson. "The service is meant for use in one location, which would be their home."
Henson adds: "We haven't seen a lot of problems with this, to tell you the truth. Because of the way the DSL network is configured (with one line into each house), sharing doesn't cause us the network problems, frankly, that it can cause for cable. If we were to receive some kind of complaint, like maybe a neighbor calls and says, 'I know my neighbor is sharing my connection and it's making me mad because other neighbors are getting it for free,' we might warn that customer."
Do all broadband providers feel the same way?
No. DSL provider Speakeasy, for example, doesn't mind wireless sharing. Its policy says: "Speakeasy believes that shared wireless networks are in keeping with our core values of disseminating knowledge, access to information and fostering community..."
Should I put a password on my Wi-Fi access point at home?
It depends on your own security preferences. If your home computer is properly secured and you're not using your wireless connection for anything sensitive, the biggest reason for adding a password is to prevent strangers from leeching off of your connection.
Not everyone uses a password. Some people think it's more social to have an open access point. Rob Carlson, a system administrator in Baltimore has had an open Wi-Fi access point named "public" at his home for years. "Having a router firewall up in front of your connection is probably a vast improvement (over a direct connection to a cable modem or DSL modem) even if the wireless portion is wide open," Carlson says.
What happens if someone does something unsavory with my Wi-Fi connection? Can I get in trouble?
This is another area of ambiguity. "I don't think you would ever be held vicariously liable for unwittingly allowing someone to use your network even if they're trafficking in child pornography. You're just considered a victim in that case," says Christian Genetski, an information security lawyer at Sonnenschein, Nath and Rosenthal. "It'd be different if you set up your own open relay server and looked the other way while spammers sent billions of messages through your open relay, and you were put on notice and did nothing to stop it."
Still, one reason to tighten up your Wi-Fi security is that an open wireless connection can be used for mischief. In September, a California man pleaded guilty to spamming people through open Wi-Fi hot spots.
Are state laws about unauthorized access different?
Yes, but often not in an important way. Genetski says that "as a general rule, most states model their computer crime laws after (the federal law)."
If I want to make sure that my Wi-Fi network at home is secure, what should I do?
Our sister site, CNET Reviews, has published a how-to guide on setting up a Wi-Fi network. Check out the section on security.
CNET News.com's Anne Broache contributed to this report
41 comments
Join the conversation! Add your comment
view: common sense. Unfortunately, not everbody
posesses this common sense.
Seriously, if you require "intent" -- well, many
systems are configured to automatically connect
to the access point with the strongest signal
for which they can associate. You can't show any
intent if a common implementation of the client
leaves the operator blissfully unaware of the
specifics of what its doing...
Second, I would say that configuring an access
point to publicly broadcast its presence, and to
grant passers by tokens (an IP address and
authorization) to access the network constitutes
explicit authorization for access. One might
argue that because that's the default
configuration for many access points, you can't
make that case, but I would contend that
restricting access is so trivial that failing to
do should be construed as intentional.
Regardless, the prevalence of intentionally open
public access points today reinforces the
public's expectation that if they happen upon an
open access, it's safe to reason that they may
use it.
the laws that require homeowners to fence in their pools - it's
called "Managing an Attractive Nuisance" and basically means if you
leave your pool open to the public and someone drowns, you're
responsible, so if you leave your Wi-Fi open to the public, you are
responsible for everything that happens on your network. It's
ancient case law.
It's very possible for a young child to drown in a pool. Generally the availability of a free WiFi connection doesn't kill people. Otherwise Internet cafes would be out of business. Think about it.
The Federal Courts in California have already decided a parallel but different issue on appeal, with "deep linking" to other websites. The decision said - if the content isn't protected, it's fair game to link to it. The same should be true of WiFi. If it's not protected, minimally by a password, it should be assumed to be open. How many networks are open, and called "Linksys"?
It's the equivalent of owning acres of property adjoining a park - if you don't post a "no trespassing" sign, someone wandering off the park boundary into your property is not trespassing.
This isn't rocket science, and the law is, in fact, clear. If the network has a generic name, no password, and no protection - it's open. So what if I'm in a parking lot at 3AM - maybe I have an urgent email to Europe and my network at home is down for some reason. Panera Bread offers a free, open network at many of its shops. It's on 24x7. If I use it in the parking lot at 3AM is that any different from using it between 8AM and 10PM - especially if the parking lot is public property?
Let's not make more laws to protect stupid people from themselves - and let's not trample our rights under the Constitution. Don't want anyone on your net? Plug the hole. Personally, I have two WiFi routers at my home - one is my "business" router and it's named and WEP encrypted. The other is named - but open. Go ahead and use the open one, as long as I leave it that way.
Al Case
CEO
Stamford Research, LLC
Stupid is as stupid does.
agreement that pops up on the application you are installing?
I'm guessing next to zero...
From an ethical standpoint using someone else's access point is
theft. I baked an apple pie, and set it into my window to cool.
It's sitting in an open window so I must have meant it to be
eaten by whoever wants it. At least that's the argument you are
making.
If it's not yours ask the PERSON that owns it for permission
before you use it. I I want to use my neighbor's unsecured
wireless network, I'll ask them before I do. Unfortunately in
today's world...common sense and common descency aren't
common anymore.
I don't know why I'm still constantly amazed at how difficult it is
for people and the law to keep up with technology (actually I do,
it's more wishful thinking on my part). When you look at the
intent of the action it becomes clear that it's illegal. e.g. Is it
illegal for someone to splice the cable running into my house to
obtain free cable...you bet. It's the same thing here, the only
thing that's different is the physical act, the intent is the same.
When using a wireless hotspot, you are doing so with the
consent of the host, assuming you agree to abide by certain
rules (license agreement/terms of service).
Maybe someday people will wake up and realize there is very
little new legal ground to cover especially when you look at
intent as opposed to physicla means (techies should understand
this as MVC). I'm often reminded of the quote, "there is nothing
new under the sun." It's true when you look beyond the view
and get to the real heart of the matter.
state, it requires willful intent to make it less secure. It kind of
reminds me of the passenger side airbags and child seats stuff a
few years back. "sure you can disable those safety features, but
here are the consequences of those actions (both good and
bad)." Righ now John Q. Public doesn't have a clue, and given
our culture...(if there isn't a warning label in 300pt blinking red
fonts, it must be ok)...selling it in a less secure state (i.e. no WEP
or WPA enabled by default) means that people will think that it's
ok and playing with them funny settings is for them smart
computer geeks.
You know that a password of some sort can be used to keep
intruders off of you wireless network.
Then:
Some pedafile uses your wireless network for child porn and the
police are knocking on your door.
Are you at fault:
I think so...if you are willingly allowing someone to do what they
want with there network.
The moral of the story:
Unless your a Starbuck or use a Corporate Wifi Access point,
lock your wifi up. Be Safe!
-Justin
would companies have them. The logic is the quite
similar as that of phone activity (fax spamming,
fraud, extortion) -- the phone company is simply
the medium, not an active accomplice. Luckily,
the criminal is still responsible for the
criminal activity.
As for the view that it's theft, under US law it
clearly doesn't qualify. To be theft, it would
need to be trespassory (which it could be),
involve actually taking (removal from it's
location; doesn't qualify) a tangible object
(wifi isn't) belonging to another (radio waves
cannot be owned) with the intent (hard to show
for open APs) of permanently depriving the owner
of it (accessing wifi doesn't permanently
depriving anyone of anything).
For the few states that have the concept in state
law, "theft of chattels" probably would apply
either. "Theft of services" wouldn't apply either
since a) the service was given away and b) the
person providing the service was not providing it
as a commercial activity or with expectation of
payment.
Or is it that they are playing music, that you like, and thus can listen to it...for free.
Tough line huh.
(my nephew plays xbox live...kicks my butt too, and doesn't have a modem. Just picks up free signal from his bedroom and uses it. lucky and free. But for how long? and is that illegal?)
Leaving your WiFi access point without a password causes it to broadcast its SSID and an open invitation. Many laptops with WiFi are configured to automatically connect to such an access point.
I'm quite certain that any new laws on this subject will (unintentionally, of course) make use if the Internet illegal. It will simply become the "just cause" to arrest anyone using the net at the whim of local authorities, who then get to confiscate equipent, search your home, etc. <sigh>
First gmail seek to undermine constitutional privacy and now fon ... well you'll see
as you infer. Wifi is a general term encompassing many aspects
of the 802.11 wireless networking standard. 802.1x is a subset
of that and involves the issue that is truly the heart of this
discussion - if a user configures 802.1x, they will not have any
unathorized access that they are not explicitly allowing. On the
other hand, I have a WiFi access point at home that cannot use
802.1x. The best I can do is create a closed network, and use
WEP to require a password.
It is all too common in tech reporting that facts are mistated,
especially when it comes to terms, acronyms, standards and
other industry buzzwords. Please research next time.
<a class="jive-link-external" href="http://searchmobilecomputing.techtarget.com/sDefinition/" target="_newWindow">http://searchmobilecomputing.techtarget.com/sDefinition/</a>
0,,sid40_gci838865,00.html
<a class="jive-link-external" href="http://searchmobilecomputing.techtarget.com/sDefinition/" target="_newWindow">http://searchmobilecomputing.techtarget.com/sDefinition/</a>
0,,sid40_gci787174,00.html
That doesn't make up for the fact that his editor blew it.
And I know this as I was joking with a Verizon tech and I asked her if she could send a note to the upper mgmt about this being on by default, she agreed but said that "they would rather (user) call tech support and learn to disable it..." Um, but these subscribers don't even know its on! Or that its insecure!
This could allow anyone to ride the connection (they don't even need to attempt hacking into the user's PC...just surf for free...). So beware...
Someone puts a drinking fountain on a public sidewalk.
Yes it cost them money to put it there.
Yes it belongs to them.
Yes it's rude to fill up your swimming pool with their water fountain.
No it's not illegal to drink from it.
They may very well have intended for it to be for their own personal use. But to put someone in jail for 1 to 3 years for drinking from it???? Put a lock on it! Excessive use of other people's WiFi is rude, don't play Xbox on it or watch movies all the time. But if you have a problem with other people using your Internet don't broadcast it to the neighborhood without at least a password!
then the OS is telling him that a new 'default' network is accessible, and all information he will share is open and unsecured.....
and the default is to click ok....
doesn't that make MS an accessory before the fact?
the real problem is the lax default security... it should come with at least a pw
Regardless of whether he intends this, or whether it is legal for him to do this (ISP rules) he as the net admin is responsible for his net... not the client.
If you were throwing the pie out into the streets and at your neighbors houses, anything that landed off your property would be considered fair game, and in the case of your neighbors, may even be considered intrusive. If you throw the pie out into the street, then go out and actively protect the pie peices from anyone who tries to take some, then you may have a case for "this is mine and you have no right to it". But If you're freely distributing delicious apple pie and no effort is made to claim it as your own and that you do not wish for anyone to have it, I say too bad for you. You should have heeded the pie baker's manual and put up the "No free pie" signs in your yard. You know, the signs that were included with the pie shell and ingredients? That's how pie is these days. Many pies even come with a button on them that puts the "no free pie" signs up for you.
Until I see signs telling me not to grab the free pie all over the road, I'm gonna eat to my hearts content, and if I'm ever punished for taking public domain, then down with the system.
gmail erodes constitutional privacy protection and now fon ... well you'll see
throw people in jail for a year for accessing a left open router ? come on I think people are getting just a little petty with things here.
plain and simple and to the point if you dont want your router accessed encrypt it. Then if someone breaches the encryption and it can be proven sure I believe that is a crime commited, but for someones ignorance or lack of technical expertise in setting up something that a child in grade school can do is really petty.
Here is anrther question.
The park office has unsecured wi fi that I can not access at my location. I may be able to access the signal with a directional outside antenna. Do you think the park rule could not allow that using the same FCC reg
Really, this goes back to the age old debate of the telephone. Contrary to popular belief, you really cannot identify who is on a telephone. Nobody knows. That is why, when a person is committing a crime, a wiretap is only useful in trying to either prevent the crime, or get authorities to the crime scene to catch the criminal in the commission of a crime, which sometimes results in a "wild goose chase". You need to have the person, and they need to be committing the crime. A person could send a ton of spam mails via a wireless connection, and the only information you would have would be that mail was sent from ip address "X" to thousands of e-mail addresses. You don't know who sent the mail, though. You can't assume that it is the owner of the telephone, or the person who pays for the internet connection. A hacker could even use somebody else's computer via a virus to send spam. You dial a random number on a telephone, and the person that answers is a prostitute or a drug dealer. That doesn't mean that you intended to commit a crime just because you connected or even downloaded something. You actually have to commit a crime like prostitution or buying drugs. You don't get to decide ahead of time, or fabricate evidence based on that fact that a telephone number was dialed. The only exception to this rule has been a credible act of terrorism. Unless the neocons and liberals decide to bypass the constitution.
The internet fixes itself. Spam mail is most of time rejected by mail clients and filters. Thus, the concept of spam mail is slowly becoming obsolete and not a viable method of sales. How many people know to automatically delete or ignore those e-mails from people in nigeria? How many of us know more than one e-bay scam? Look at how e-bay evolved. E-mails from your bank asking to verify your information? Hey, they've been doing the same thing on the telephone!
The swimming pool analogy is a bad one. There's a difference between data connections and a swimming pool.
A side note: personally think that if somebody is trespassing and they drown in your swimming pool, that you shouldn't be liable any way. The whole idea that you are liable for the wrongful or accidental acts of a third party, even an unattended child, is absurd. We need to get rid of the slip and fall and sue attitude in America. Really, if we eliminated the concept of liability all together, we'd fix 40 percent of our financial and economic problems in this country!
Am I a liberal or a conservative when I say that unfortunately accidents happen and sometimes there's nothing you can do about it. It doesn't mean you can or should sue somebody because you can.
It is, and always has been illegal for a person to illegally access stored communications. In other words, connecting to the internet on a wireless connection really isn't illegal, because websites made accessable on the internet are public (not public domain), and therefore, your access to them isn't illegal. It would be illegal for someone to sit in the parking lot of a business at 3 am and try to hack or gain access to their non public local network, but not their internet, if they were on the same connection. Even at 3 am, it is not illegal to do so, though I might suggest that if your the only car sitting in the parking lot at 3 am, you might look suspicious, like a burglar.
It is illegal for someone to connect to a wifi, and then attempt to break into someone's computer that is non-public that is also connected to the wifi or router, or to intercept packets on the wifi intended to be sent to someone else's computer. Most people who use wireless protect themselves with a firewall, and lock their computer via a simple password.
There are grey areas involving conditional access on wifi connections. Some may be password protected but not encrypted. That means that if you were able to connect to the router without entering a password, the interference concept applies here, again. Connections that bypass the conditional access may be considered undesired operation. Breaking encryption is and always has been illegal.
ISPs and Wifi and State Laws
I would like to see a challenge in federal court to any of these "state" laws regarding internet connections. The internet connects world wide, and based on the commerce clause, that means that it is subject to federal law. States really don't have any authority to regulate internet, just as they don't have authority to regulate telephone. It is lawful for states to have various taxes on connections of services to your location within a specific state, but the actual traffic is governed federal law, international law, or no law at all. It is not the state's powers to regulate interstate commerce, nor should it be.
I also would like to see a legal challenge, to show that providers of internet service have limited authority to regulate what happens to your connection after it enters your home. The clauses they put in their contracts are really fraud, because the product they are selling is internet service. Many cable companies are trying to sell internet as a subscriber service like cable service. However, the very fact that it is "internet" service means that the connection can be shared with other computers and the "web", which may include more computers in your area, or around the neighborhood. The word "internet" means a connection between multiple computers on network. This means that if you choose to do so, your computer can connect to another, and from that one, another, and from that one, another. The goal of the ISP is to sell you a fast connection so that you will hopefully buy their connection, rather than connecting to a subnet on the internet, like a wifi.
If the cable companies and phone companies want to sell internet as a tv service like pay tv, then they must also pay fees to web hosting companies - the entire internet - for their programming. That would kill the entire internet, and would probably result in loss of business for cable and telephone companies that would be replaced by competitors.
Why should it be any different with WiFi? Unless explicitly INVITED or given permission to use someone else's property it is trespass or theft. Unless the word PUBLIC is in the SSID, or the wireless client has been explicitly invited, they should stay out... seems pretty simple to me.