Slashdot Mirror
Judge Rules Sniffing Open Wi-Fi Networks Is Not Wiretapping
An anonymous reader writes "Ars reports on a decision from a district judge in Illinois, who ruled that sniffing traffic on an unencrypted Wi-Fi network is not wiretapping. In the ruling, the judge points out an exception in the Wiretap Act which allows people to 'intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public.' He concludes that 'the communications sent on an unencrypted Wi-Fi network are readily available to the general public.' Orin Kerr disagrees with the ruling, saying that the intent of the person setting up the network is important: 'No one suggests that unsecured wireless networks are set up with the goal that everyone on the network would be free to read the private communications of others.'"
It's wireless tapping... D'oh.
...because listening to unencrypted cellphones is illegal.
I think that the difference between your conversations and pizza ordering on an analog transmission and on a digital one WRT 4th amendment protection should be zero.
I've fallen off your lawn, and I can't get up.
Open networks are just that. If your intent is to keep your transmissions private, you should be using something better than an open network. Intent may be applicable in a pre-trial hearing on the validity of not having a warrant, but requiring insight in to the intent of an open wifi is highly unlikely at the warrant stage without some pretty strong inside information already.
If it's wiretapping than anyone in the last 20 years who owned a scanner should be fined for listening in on their neighbors telephone calls because their wireless household phones weren't encrypted.
It's not illegal to intercept communications "made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public."
Just who is included in the general public here? This is like saying that most everyone who has a Wi-Fi capable computer typically runs a packet analyzer.
All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
IFF the extent of it is to scan the wireless broadcast, not join the network and access the internet, their private network, files, printer(s), etc. then I think this is an amazing case of common sense. Joining their network and using the internet or anything similar to that is akin to going into someone's house and sleeping on their couch while they're not home. Sure, "you may not be harming them" and they're "not using it right now" but that's not relevant to whether you can jump in and use their resources.
Wireless broadcasts without encryption, however, are akin to a neighbor who yells loud enough for everyone to know their family's business. I don't see any difference between my neighbors having a heated conversation that I can hear inside my house and them sending unencrypted packets into my house. The criminality should only come in if and when they are used maliciously.
It isn't the function of government to protect your "intent" against your own stupidity.
If you want to keep your communications private, encrypt them.
and why does his/her opinion matter so much in the case? (it maybe does, just seeing the name in the summary made me ask the question)
More on point... if you are going to broadcast open packets for everyone to peruse freely... even outside your house, it is like doing something illegal in public and complaining about being caught for it and any witness is illegally watching over your privacy. If it was a secured network, then yes, it would be illegal snooping
Never antropomorphize computers, they do not like that
Whether by accident or on purpose it seems the judge got this one right. The protocol specifically provides for encryption in the cases you want privacy. Not turning it on is like shouting your private business from your roof with a megaphone and then getting mad when someone hears it.
Encryption is in there for a reason. Finally a judge who rules on the side of reason, rather than pandering to stupidity and emotion.
I'm not on the side of law enforcement but in this case the ruling is fair game. If you use an open, unencrypted wireless access point you do not have a heightened expectation of privacy.
There are many open wifi access points set up with the intent of giving internet access to anyone who happens to be there. How am I supposed to know that the owner of an open network wants to share it or not?
One's guilt depends not on whether a rule was followed or broken, but on what another person was thinking?
Kerr is asking too much.
That is amazingly backwards. Using a network that has been configured so that everyone can use it is just fine until you get asked not to do so - for example if the name of the network is "you are not allowed to use this network", then OK, it's not allowed. The analogy to using someone else's couch against their wishes is ridiculous - I am sure that you yourself would rather contribute some bandwidth to the neighbor than have them hang out in your house when you are not there against your wishes, so you refute your own argument - it's not the same thing. You call the cops on squatters, you set up your network properly if you want to prevent people from using it. Not the same thing at all.
However, intercepting other people's network traffic in order to gain information is like opening someone's mail - it's not secured, you only need trivial tools to gain access to it, but there is no reasonable expectation that you are allowed to read it. Your analogy that it is like hearing someone's heated argument fails because in that case it is them informing you about their secrets and not you actively invading their privacy. The difference is that your ears work automatically outside of your will, which is no one is going to blame you for, but you need equipment to intercept private email. In the same way, if you set up a very sensitive microphone in order to detect even faint whispers coming from your neighbor's property, you are doing something creepy that goes beyond just overhearing a heated argument.
The intent doesn't matter, if it did it would have been written into the law. Besides, someone scanning wifi channels cannot know with certainty what the intent of someone who hasn't encrypted a particular network is.
When you want to have a private conversation do you go out in the street and yell back and forth? No. You go into a room and close the door.
People generally make some effort when they don't want other people to hear them. The internet is no different. And ignorance is not an excuse.
Using it to snoop on the owners or other users is wrong. Using it to get to the internet, not so much.
rewriting history since 2109
Why is listening to unencrypted WiFi any different than overhearing someone shout in public?
sniffing a police station's or an FBI office's wifi isn't wiretapping, either, right?
I'm not a lawyer, but I play one on the Internet. Blog
Sure, "you may not be harming them" and they're "not using it right now" but that's not relevant to whether you can jump in and use their resources.
I never see this argument modded up on Slashdot, let alone to plus five, when the subject is digital piracy. In fact, they're usually modded down as "trolls" so you can't even see them except for quotes by people posting rebuttals.
Funny how that works.
>>> I don't see any difference between my neighbors having a heated conversation that I can hear inside my house and them sending unencrypted packets into my house.
Agreed.
Reminds me of the couple I lived next door to. The guy was constantly yelling at his girlfriend, which made her cry. Then he'd yell "But I love you!" Once they started arguing in the parking lot, so I went to my window to see what was going on. He pointed at my window and said, "What's your problem?" and then came charging up the stairs and pounding on my door.
I guess I was just all supposed to pretend none of this was happening, as if the sounds were not entering my apartment. Just as I'm supposed to pretend I don't see 2 open Wifis broadcasting to my PC. ----- Sorry but I disagree with persons who think that.
My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
Wireless broadcasts without encryption, however, are akin to a neighbor who yells loud enough for everyone to know their family's business. I don't see any difference between my neighbors having a heated conversation that I can hear inside my house and them sending unencrypted packets into my house.
The difference is that each packet is keyed to the recipients address and to listen in you need a device explicitly made to intercept packets going to others. If you have tenants and offer them internet service and set up a dump of their traffic, are you doing a wiretap? Hell yes. If you are on a cable loop and modify the cable modem to dump all packets for everyone on the loop, are you doing a wiretap? Hell yes. Note that in an earlier case they found the exception didn't apply to cordless phones - the intent was obviously that it was designed to only be received on the handset it belonged to. Wifi packets are the same, you only intend to communicate with that one card and not the world. That it's unencrypted is mostly irrelevant, if you go through a door marked "staff only" you're trespassing even though it was unlocked. The intented user was clear.
Live today, because you never know what tomorrow brings
Interesting analogy of a 'yelling' neighbor. Unfortunately it's not helping your point.
-You can't stop but to hear a yelling neighbor.
-Is your personal network interrupted by theirs?
-Do they have a reasonable expectation of privacy?
Sending an "unencrypted" love letter to a girlfriend by postal mail offers me adequate expectation of privacy... and anyone can just simply intercept that letter many ways.
You are trying to make a point that because you CAN do something from the comfort of your own home/car/bike you SHOULD be able to do it.
The general public doesn't "readily have access" to interpret unencrypted wifi networks any _more_ than we have access intercepting personal wireless phones (which is also easy).
We dont have any _less_ access to DVD decryption software (which is illegal, I'm told) than we do to wifi monitoring tools.
Orin Kerr is wrong. Intent matters, but only up to the point where it's reasonable. If you decide to discuss a sensitive private matter with your SO by yelling at each other at the top of your lungs in a crowded lobby, you can't possibly reasonably expect that conversation not to be overheard by everyone in the lobby. The same with unsecured WiFi: you're broadcasting your traffic in the clear to anyone who has a receiver and you know this. It's up to you, if you intend a communication to be private, to take at least some reasonable steps to make it private. Choosing a method that's so blatantly exposing the communication to the public is decidedly not such a reasonable step. If you don't like it, sorry but the rest of us didn't agree to plug our ears just because you find it inconvenient to go somewhere private to have a private conversation.
The problem with your analogy is that they are transmitting beacons frames without the privacy bit set. This frame basically says: "Hi I am a WiFi network, here is my name and all the other info you need to connect to me if you want to!" If you set the privacy bit it basically says: "Hi I am a WiFi network, here is my name and all the other info you need to connect to me if you are authorized!"
In the case of your analogy, the beacon frame sans privacy bit is the eqivalent of posting a sign that says: "Feel free to sleep on my couch if you want to!"
Whether or not the default mode should be open or private is another debate, and I understand that most new consumer wifi equipment has been addressing this from the should private point of view for quite a while. (see WPS)
As an amateur radio operator, there is overlap in the 2.4ghz range that WiFi uses, that I can use higher power on and other modifications. When I do this though, I still have to follow the FCC Regulations assigned to me as an amateur radio operator. 1. I have to broadcast my call. 2. It can not be encrypted. The reasoning is that by the FCC Regulations, other amateur radio operators shall be able to learn and listen. .. So, in my eyes, if some one's WiFi AP is not encrypted, they must be an amateur radio operator who is not broadcasting their call.
This judge is in contempt of common sense.
Just because I leave my car unlocked with the key in the ignition doesn't give you the right to drive away in the car, nor does the fact I forgot to lock my front door give you the right to search my house.
the land of "freedom".
i recommend that we come up with some way of making un-encrypted wi-fi networks a thing of the past.
one simple solution would be to have wi-fi clients automatically attempt to use the default password "open" for encrypted networks if none is supplied.
wi-fi access points should strongly indicate to users that using the password "open" is better for security than no password.
o : private network. password: __________
o : create open network (password is "open")
o : create insecure network (NOT RECOMMENDED)
Movies and software generally have copyright notices which state that they are protected. So if you could figure out how to watch somebody else's movie being streamed over the internet, you would probably be free to do it, but you could not legally make a copy of it.
All WiFi networks should transmit an intent bit. Problem solved!
It is legal. It is technical possible. It still is not the right thing to do.
Just because I can sleep with my best friends wife does not mean I should do it.
Don't fight for your country, if your country does not fight for you.
Since when could you see and/or hear the information flowing through he airways without special equipment. And you must be some kinda superman to not only be able to see and detect the information without hardware setup to do it but to be able to read and decode binary that quickly.
Also, I will remember to bring some military grade listening devices and aim it at your windows to amplify the sound you are carelessly letting out into the outside world and filtering it to clean it up so I can hear crystal clear what all you like talking about heck, might even make a website about it and post the audio and infrared images of you the next time you and your girl are having sex to some websites, I hear 4chan might like it and you won't mind obviously or you would have taken steps to ensure that the sound and heat signatures never made it out of your house, if you have an open window by your bed, even better.
Does this ruling mean that Google can get a refund for all those fines they had to pay? Or for that matter, does this mean that I personally can hop on my neighbor's open WAP, inventively named "linksys," and legally steal their packetses?
In Soviet Russia, dot slashes YOU!
Mr. Kerr must understand that the USA (except Louisiana, Puerto Rico, and most of the remaining insular possessions) have a common-law legal system in that academia does not usurp the bench in finding what the law is, despite its "persuasive authority".
Using an unencrypted, open wifi connection is the 2012 equivalent of using morse code over shortwave or other open broadcast. You have specifically configured your wifi transceivers to forgo encryption and created a public broadcast station.
doesn't matter who is listening, in an age where encryption is standard, if you don't use encryption, or if you don't limit your transmission radius, then you have not indicated that you which your wi-fi to be private. A transmission via radio is open to 'listening' under laws in many countries, it is what you do with the material that is usually restricted.
There was an unknown error in the submission.
Welp, I'm quite certain that the intent of most people's open networks is not that everyone can wiretap it.
BUT, I do think the point of this wiretap exception is clear, and clearly applies here. Wiretapping is a serious crime, and if someone is either putting receiving equipment near a wire or actually hooking into it, they are going to some serious effort; if they intercept encrypted wireless transmissions and decrypt them they are going to some serious effort. Picking a wifi network off a list takes no serious effort. I'm sure the original intent was so someone could not get in trouble for tuning around the dial with their ham or shortwave radio, and pick up some broadcast that somebody assumed was "secure" even though it was plain jane AM. Open wifi is analogous.
Yes, if you want to keep your communications private from private eavesdroppers, you'll have to do that yourself, though they'll let you use the courts for civil lawsuits in some kinds of privacy violation cases.
But this isn't about private wiretapping, it's about government wiretapping, the kind that many people think should be covered by the Fourth Amendment. It's an entirely different issue. After all, if the government wants to open all of your mail and read it, or climb into your house if you forgot to lock all the windows, or break down your door with a battering ram, or tap your phone wires even though they're not encrypted, they used to have to get a warrant first. Same thing should apply here.
There's also a standards problem - the original Wifi security models were designed for business users, so encryption and access authentication are bundled together; they didn't provide an allow-anybody-and-encrypt-everything guest mode. (You could argue that an encrypted open guest mode is susceptible to man-in-the-middle attacks, so it's a false illusion of security, but I'd still rather have it be the default.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Its a question of effort. Wiretapping requires you at least to identify the wire and access it. That is typically breaking-and-entering and some mechanical damage or changes to the wire tapped. Unsecured wireless (and that is what unencrypted wireless is), just requires you to start some sniffer software in the general vicinity.
Unencrypted wireless is like a billboard: Anybody close enough can read anything, and there is zero changes or impact to the billboard itself. Or put differently: If you pump these radio-waves out for anybody to see them, somebody is bound to look.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The protocol provides for authentication if you want authentication, and provides for encryption of authenticated traffic, because that matched the most common business model of the businesses who got the standards passed. It doesn't provide for encrypted guest mode, so there's no direct way to get privacy while allowing anybody to access your internet connection; you can fake it by setting your SSID to "Password=guest" or some such. There have even been some recent newspaper articles on a proposal to allow default backdoor access for emergency personnel like firefighters, most of which doesn't recognize that they're really looking for guest access. (5-10 years ago, you could just use "linksys" as your roaming internet access provider, and it'd usually work, but wifi routers pretty much all want the owner to configure security these days.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Yes, if you use your credit card over unencrypted wifi or leak the passwords to your bank account, all that data is fair game to thieves and you should have encrypted it to protect yourself.
But the government aren't supposed to be data thieves; they're supposed to get warrants when they want to wiretap you, just as they're supposed to get warrants before walking into your house even if you've left the door unlocked.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
That's not really a privacy bit. It's an encryption flag. I say this knowing that it's called the "Privacy bit". /quibble
If you're using an open access point, and privacy is an issue, you need to use a VPN. If your privacy is violated, do you really care if it's a government agent or some creep who wants your credit card numbers?
Once again, no false dichotomies please. Telling people they need to guard against snooping is not the same as condoning said snooping.
is entirely ignorant of baby monitors and all sorts of other Part 15 devices.
This ruling harmonizes unencrypted WiFi with every other Part 15 device out there.
Kerr is a moron.
--
BMO
the network is set up with the goal of being able to read private information?
Well that may not be the "goal", but it's certainly an expected outcome.
I'm sorry, but I agree with this ruling. If you want to secure your network, encrypt it.
If you want to leave it open for anyone to use, but still have your traffic open, encrypt it at the application level: HTTPS, SFTP, etc.
or set up two SSIDs like many routers let you do. One open, one closed.
and you don't understand what it does, or how it works... and you try to preheat a fork or something...
Somehow I think that Google would be interested in this case being brought before the FTC's case against Google for data slurping.
Listening to broadcast wifi is no different than monitoring a CB.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
Yeah, and the guy peeking in my window isn't a Peeping Tom, because (a) I left my curtains open, nice day that it was, and (b) I live in a compartment -- er, I mean apartment -- so I don't own the land outside my window.
I guess you have to have a mortgage and a guard dog to have any "reasonable expectation of privacy". What a country!
It doesn't matter if someone's intent is to keep things private; if they shout it out, it's public.
I guess I was just all supposed to pretend none of this was happening
Well it'd certainly be the polite thing to do (as long as no one was being physically harmed). Not that I'd expect you to understand anything about being polite.
An unencrypted WiFi signal no different from a CB or Ham radio. Anyone who can build or buy the equipment is allowed to listen.
>>>>>
I guess I was just all supposed to pretend none of this was happening
Well it'd certainly be the polite thing to do (as long as no one was being physically harmed). Not that I'd expect you to understand anything about being polite.
It's a PUBLIC parking lot. If I hear people yelling at one another, of course I'm going to look to see what the hell is going on. (And you would too.) The guy crossed the line when he came marching up the steps and pounding on my door (thus putting me in fear). But then I guesd you think th't sjust "a-okay" huh? Stupikd erhr fujckign peic eof shit. Burn in hell.
My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
It's a PUBLIC parking lot.
And?
If I hear people yelling at one another, of course I'm going to look to see what the hell is going on. (And you would too.)
No I wouldn't. Not unless what I heard told me that I should make it my business. In which case I would step in, not simply look-on like a highway rubbernecker.
Just like a child throwing a temper tantrum in a grocery store, it only works if there are people sticking their nose in the parent's business, making the parent feel uncomfortable about the continued actions of their child. So as a considerate action towards the parent, I go about my business, pretending that the child isn't throwing a temper tantrum, in the hope that the child learns that a temper tantrum will not work.
The guy crossed the line when he came marching up the steps and pounding on my door (thus putting me in fear). But then I guesd you think th't sjust "a-okay" huh? Stupikd erhr fujckign peic eof shit. Burn in hell.
I never said I approved of what the guy then did to you. Please do not put words in my mouth. I actually think what he did to you was wrong. I was simply commenting on the fact that, yes, you were supposed to pretend none of that was happening (unless something you heard indicated that you should make it your business and step in).