Confessions of a Wi-Fi Thief

Michelle Shildkret from Time wrote in to tell us about a story about "the ethics of stealing Wi-Fi. Many of us been guilty of the same crime at one point or another — according to the article, 53% of us at least. But how guilty do we really feel? As it is officially a crime to steal wi-fi (Title 18, Part 1, Chapter 47 of the United States Code, which covers anybody who 'intentionally accesses a computer without authorization or exceeds authorized access')."

Comments

Not a thief

[xtracto]

"intentionally accesses a computer without authorization or exceeds authorized access")."

Then, I have never stolen WiFi. I have never accessed without authorization; as I have never cracked a WEP or WPA password scheme.

Everytime I use an available wireless network, I instruct my computer to ask for permission to connect to the router and enter to the wireless network. And most of the time the router gives me such permit and assigns my router an IP. When it does not happen, then I assume the owner has instructed the router to give permission to specific machines (as in, machines with a specific MAC adddress) and hence I do not use such networks.

Seriously, someone must create an interface in which a person is able to send the commands manually to the router (like the AT commants in a modem) to ask for connection permission (i.e., DHCP protocol). That way, when you are in court, you could use that program along the court's wifi to show them how you are indeed asking for permission and the software is granting you the permission.

Re:Not a thief

[Rinisari]

Exactly the defense that anyone would should use. If the plaintiff says, "Well, I didn't explicitly grant you permission to use my network," then you can fire back, "You did when your router gave me explicit permission by assigning me an IP address and giving me a gateway by which I could access the Internet. Essentially, I asked if I could use the network, and, acting on your behalf since you set it up, it said I could when it gave me the information required to use the network."

Re:Not a thief

[palegray.net]

Then, I have never stolen WiFi. I have never accessed without authorization; as I have never cracked a WEP or WPA password scheme. That's the key to the whole debate. I've had a WiFi router at my home and various offices for years. If I enable features designed to limit access (MAC address checking, WEP/WPA encryption, etc) and someone tries to spoof and/or brute force their way into my network, that's theft of service and unauthorized access. If my router is set up for wide open access, I'm granting permission for anyone to use it.

In general, laws are designed to work like this: that which is not expressly forbidden is permitted. We're talking about radio waves here; before anyone starts up with some dumb analogy to parked cars and leaving the keys in them, consider this: when you use a resource I have made freely available, you're not denying me access to it. Someone might make the argument that excessive use of my resource would degrade its usefulness to the primary (owning) party, but that's easily remedied using simple protection schemes (either block access entirely, or throttle access to unauthenticated clients). I've done exactly this in numerous cases, using various router packages.

Here's a sad, but interesting article: Man charged with wireless trespassing from July of 2005. To quote a section:

Wireless networks are becoming more prevalent with the spread of broadband Internet access, and many consumers are not aware of how to configure their networks to avoid unauthorized access. This man was charged with a felony because the owner of the connection failed to educate himself on how to use a point and click interface to secure a home wireless router. Was he up to no good? Maybe, but we don't know for sure, and it's beside the point. If someone were to use my connection for criminal activities, it becomes my problem to prove it was the third party's actions, and not my own that led to the violation of law. He's "innocent until proven guilty" the same as I am. This is why companies (at least ones that aren't interested in getting sued) track their network access and provide authentication schemes.

Re:Not a thief

[Just Some Guy]

Does the law already consider an open, unencrypted network as implicitly giving permission, or is it written to say that if the person who owns that open, unencrypted network has not given permission then it's illegal?

How does the law answer the same question about websites?

Re:Not a thief

[palegray.net]

I've never done any of the things you describe, because I consider them to be highly unethical. In my mind, connecting to an unadvertised resource fails the ethics test because there's no way anyone could reasonably imply that consent was given.

Those who crack networks by breaking WEP, spoofing keys, or other measures should be held legally accountable. People who merely access an open, advertised resource shouldn't be at risk of going to prison.

Re:Not a thief

[Anonymous Coward]

I liken using somebody's unsecured wireless network to listening to a neighbor's music that they play loud enough for me to hear. I didn't ask my neighbor to send wifi signals into my home.

Re:Not a thief

[McDutchie]

So it's more like entering an unlocked house to take a sip from the faucet. The only crime committed is that you didn't pay for bottled water.

Except that you didn't enter any house. Your neighbour is transmitting their open-access signal into your own house for you to use. Your analogy is therefore broken.

Re:Not a thief

[xtracto]

If you leave the network, the bandwidth will still be there.

That could presumably be false if whoever is paying for the service pays for a limit GB/month allowance

Broadcast = Permission

[Toe, The]

Indeed. I don't know how the law is interpreted, but I cannot imagine how anyone who broadcasts an unencrypted radio signal can complain if someone else picks up that signal. It would be like a TV station claiming that you are stealing their content because you tuned into their channel.

You could say that a wifi router is different from TV because the activity is two-way: but the wifi router chooses to respond to me. If the owner of the router never bothered to tell their router not to respond to me, then is it my fault that it does? Am I guilty if my computer merely pings their router because it created a response on that router? They are the one who initiated the communication by broadcasting hello packets.

Re:Broadcast = Permission

[Just Some Guy]

Am I guilty if my computer merely pings their router because it created a response on that router? They are the one who initiated the communication by broadcasting hello packets.

Complicating matters is that certain popular OSes (XP, I'm looking at you) tend to auto-connect to the strongest signal available, no matter how nicely you ask them to stop doing that. If you're closer to your next-door neighbor's WAP than your own, and Windows decides to use his without asking your permission or even telling you, then can you really be considered guilty of anything? And doesn't that mean that the world's largest OS vendor considers "default allow" to be the correct interpretation of WAP etiquette?

As little as I'm a fan of MS, I think "that's the way Windows does it automatically" would be a pretty good defense against criminal intent, even if a jury disagreed with the legality of the actions themselves.

tsoat

[Tsoat]

Encrypt your signal or expect people to use it. It's that simple folks