Slashdot Mirror
Judge Rules Sniffing Open Wi-Fi Networks Is Not Wiretapping
An anonymous reader writes "Ars reports on a decision from a district judge in Illinois, who ruled that sniffing traffic on an unencrypted Wi-Fi network is not wiretapping. In the ruling, the judge points out an exception in the Wiretap Act which allows people to 'intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public.' He concludes that 'the communications sent on an unencrypted Wi-Fi network are readily available to the general public.' Orin Kerr disagrees with the ruling, saying that the intent of the person setting up the network is important: 'No one suggests that unsecured wireless networks are set up with the goal that everyone on the network would be free to read the private communications of others.'"
It's wireless tapping... D'oh.
...because listening to unencrypted cellphones is illegal.
I think that the difference between your conversations and pizza ordering on an analog transmission and on a digital one WRT 4th amendment protection should be zero.
I've fallen off your lawn, and I can't get up.
Open networks are just that. If your intent is to keep your transmissions private, you should be using something better than an open network. Intent may be applicable in a pre-trial hearing on the validity of not having a warrant, but requiring insight in to the intent of an open wifi is highly unlikely at the warrant stage without some pretty strong inside information already.
If it's wiretapping than anyone in the last 20 years who owned a scanner should be fined for listening in on their neighbors telephone calls because their wireless household phones weren't encrypted.
It's not illegal to intercept communications "made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public."
Just who is included in the general public here? This is like saying that most everyone who has a Wi-Fi capable computer typically runs a packet analyzer.
All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
IFF the extent of it is to scan the wireless broadcast, not join the network and access the internet, their private network, files, printer(s), etc. then I think this is an amazing case of common sense. Joining their network and using the internet or anything similar to that is akin to going into someone's house and sleeping on their couch while they're not home. Sure, "you may not be harming them" and they're "not using it right now" but that's not relevant to whether you can jump in and use their resources.
Wireless broadcasts without encryption, however, are akin to a neighbor who yells loud enough for everyone to know their family's business. I don't see any difference between my neighbors having a heated conversation that I can hear inside my house and them sending unencrypted packets into my house. The criminality should only come in if and when they are used maliciously.
It isn't the function of government to protect your "intent" against your own stupidity.
If you want to keep your communications private, encrypt them.
and why does his/her opinion matter so much in the case? (it maybe does, just seeing the name in the summary made me ask the question)
More on point... if you are going to broadcast open packets for everyone to peruse freely... even outside your house, it is like doing something illegal in public and complaining about being caught for it and any witness is illegally watching over your privacy. If it was a secured network, then yes, it would be illegal snooping
Never antropomorphize computers, they do not like that
I'm not on the side of law enforcement but in this case the ruling is fair game. If you use an open, unencrypted wireless access point you do not have a heightened expectation of privacy.
There are many open wifi access points set up with the intent of giving internet access to anyone who happens to be there. How am I supposed to know that the owner of an open network wants to share it or not?
One's guilt depends not on whether a rule was followed or broken, but on what another person was thinking?
Kerr is asking too much.
The intent doesn't matter, if it did it would have been written into the law. Besides, someone scanning wifi channels cannot know with certainty what the intent of someone who hasn't encrypted a particular network is.
Using it to snoop on the owners or other users is wrong. Using it to get to the internet, not so much.
rewriting history since 2109
sniffing a police station's or an FBI office's wifi isn't wiretapping, either, right?
I'm not a lawyer, but I play one on the Internet. Blog
>>> I don't see any difference between my neighbors having a heated conversation that I can hear inside my house and them sending unencrypted packets into my house.
Agreed.
Reminds me of the couple I lived next door to. The guy was constantly yelling at his girlfriend, which made her cry. Then he'd yell "But I love you!" Once they started arguing in the parking lot, so I went to my window to see what was going on. He pointed at my window and said, "What's your problem?" and then came charging up the stairs and pounding on my door.
I guess I was just all supposed to pretend none of this was happening, as if the sounds were not entering my apartment. Just as I'm supposed to pretend I don't see 2 open Wifis broadcasting to my PC. ----- Sorry but I disagree with persons who think that.
My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
Wireless broadcasts without encryption, however, are akin to a neighbor who yells loud enough for everyone to know their family's business. I don't see any difference between my neighbors having a heated conversation that I can hear inside my house and them sending unencrypted packets into my house.
The difference is that each packet is keyed to the recipients address and to listen in you need a device explicitly made to intercept packets going to others. If you have tenants and offer them internet service and set up a dump of their traffic, are you doing a wiretap? Hell yes. If you are on a cable loop and modify the cable modem to dump all packets for everyone on the loop, are you doing a wiretap? Hell yes. Note that in an earlier case they found the exception didn't apply to cordless phones - the intent was obviously that it was designed to only be received on the handset it belonged to. Wifi packets are the same, you only intend to communicate with that one card and not the world. That it's unencrypted is mostly irrelevant, if you go through a door marked "staff only" you're trespassing even though it was unlocked. The intented user was clear.
Live today, because you never know what tomorrow brings
Interesting analogy of a 'yelling' neighbor. Unfortunately it's not helping your point.
-You can't stop but to hear a yelling neighbor.
-Is your personal network interrupted by theirs?
-Do they have a reasonable expectation of privacy?
Sending an "unencrypted" love letter to a girlfriend by postal mail offers me adequate expectation of privacy... and anyone can just simply intercept that letter many ways.
You are trying to make a point that because you CAN do something from the comfort of your own home/car/bike you SHOULD be able to do it.
The general public doesn't "readily have access" to interpret unencrypted wifi networks any _more_ than we have access intercepting personal wireless phones (which is also easy).
We dont have any _less_ access to DVD decryption software (which is illegal, I'm told) than we do to wifi monitoring tools.
Orin Kerr is wrong. Intent matters, but only up to the point where it's reasonable. If you decide to discuss a sensitive private matter with your SO by yelling at each other at the top of your lungs in a crowded lobby, you can't possibly reasonably expect that conversation not to be overheard by everyone in the lobby. The same with unsecured WiFi: you're broadcasting your traffic in the clear to anyone who has a receiver and you know this. It's up to you, if you intend a communication to be private, to take at least some reasonable steps to make it private. Choosing a method that's so blatantly exposing the communication to the public is decidedly not such a reasonable step. If you don't like it, sorry but the rest of us didn't agree to plug our ears just because you find it inconvenient to go somewhere private to have a private conversation.
The problem with your analogy is that they are transmitting beacons frames without the privacy bit set. This frame basically says: "Hi I am a WiFi network, here is my name and all the other info you need to connect to me if you want to!" If you set the privacy bit it basically says: "Hi I am a WiFi network, here is my name and all the other info you need to connect to me if you are authorized!"
In the case of your analogy, the beacon frame sans privacy bit is the eqivalent of posting a sign that says: "Feel free to sleep on my couch if you want to!"
Whether or not the default mode should be open or private is another debate, and I understand that most new consumer wifi equipment has been addressing this from the should private point of view for quite a while. (see WPS)
This judge is in contempt of common sense.
Just because I leave my car unlocked with the key in the ignition doesn't give you the right to drive away in the car, nor does the fact I forgot to lock my front door give you the right to search my house.
Not really. You can't help but to hear it if someone does that.
To tap a wireless network you need to actively listen in, in a manner that is different from what a reasonable person might consider to be the normal mode of use.
i recommend that we come up with some way of making un-encrypted wi-fi networks a thing of the past.
one simple solution would be to have wi-fi clients automatically attempt to use the default password "open" for encrypted networks if none is supplied.
wi-fi access points should strongly indicate to users that using the password "open" is better for security than no password.
o : private network. password: __________
o : create open network (password is "open")
o : create insecure network (NOT RECOMMENDED)
Movies and software generally have copyright notices which state that they are protected. So if you could figure out how to watch somebody else's movie being streamed over the internet, you would probably be free to do it, but you could not legally make a copy of it.
It is legal. It is technical possible. It still is not the right thing to do.
Just because I can sleep with my best friends wife does not mean I should do it.
Don't fight for your country, if your country does not fight for you.
Using an unencrypted, open wifi connection is the 2012 equivalent of using morse code over shortwave or other open broadcast. You have specifically configured your wifi transceivers to forgo encryption and created a public broadcast station.
doesn't matter who is listening, in an age where encryption is standard, if you don't use encryption, or if you don't limit your transmission radius, then you have not indicated that you which your wi-fi to be private. A transmission via radio is open to 'listening' under laws in many countries, it is what you do with the material that is usually restricted.
There was an unknown error in the submission.
Yes, if you want to keep your communications private from private eavesdroppers, you'll have to do that yourself, though they'll let you use the courts for civil lawsuits in some kinds of privacy violation cases.
But this isn't about private wiretapping, it's about government wiretapping, the kind that many people think should be covered by the Fourth Amendment. It's an entirely different issue. After all, if the government wants to open all of your mail and read it, or climb into your house if you forgot to lock all the windows, or break down your door with a battering ram, or tap your phone wires even though they're not encrypted, they used to have to get a warrant first. Same thing should apply here.
There's also a standards problem - the original Wifi security models were designed for business users, so encryption and access authentication are bundled together; they didn't provide an allow-anybody-and-encrypt-everything guest mode. (You could argue that an encrypted open guest mode is susceptible to man-in-the-middle attacks, so it's a false illusion of security, but I'd still rather have it be the default.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Its a question of effort. Wiretapping requires you at least to identify the wire and access it. That is typically breaking-and-entering and some mechanical damage or changes to the wire tapped. Unsecured wireless (and that is what unencrypted wireless is), just requires you to start some sniffer software in the general vicinity.
Unencrypted wireless is like a billboard: Anybody close enough can read anything, and there is zero changes or impact to the billboard itself. Or put differently: If you pump these radio-waves out for anybody to see them, somebody is bound to look.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The protocol provides for authentication if you want authentication, and provides for encryption of authenticated traffic, because that matched the most common business model of the businesses who got the standards passed. It doesn't provide for encrypted guest mode, so there's no direct way to get privacy while allowing anybody to access your internet connection; you can fake it by setting your SSID to "Password=guest" or some such. There have even been some recent newspaper articles on a proposal to allow default backdoor access for emergency personnel like firefighters, most of which doesn't recognize that they're really looking for guest access. (5-10 years ago, you could just use "linksys" as your roaming internet access provider, and it'd usually work, but wifi routers pretty much all want the owner to configure security these days.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Yes, if you use your credit card over unencrypted wifi or leak the passwords to your bank account, all that data is fair game to thieves and you should have encrypted it to protect yourself.
But the government aren't supposed to be data thieves; they're supposed to get warrants when they want to wiretap you, just as they're supposed to get warrants before walking into your house even if you've left the door unlocked.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
That's not really a privacy bit. It's an encryption flag. I say this knowing that it's called the "Privacy bit". /quibble
If you're using an open access point, and privacy is an issue, you need to use a VPN. If your privacy is violated, do you really care if it's a government agent or some creep who wants your credit card numbers?
Once again, no false dichotomies please. Telling people they need to guard against snooping is not the same as condoning said snooping.
Somehow I think that Google would be interested in this case being brought before the FTC's case against Google for data slurping.
Listening to broadcast wifi is no different than monitoring a CB.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
It doesn't matter if someone's intent is to keep things private; if they shout it out, it's public.
>>>>>
I guess I was just all supposed to pretend none of this was happening
Well it'd certainly be the polite thing to do (as long as no one was being physically harmed). Not that I'd expect you to understand anything about being polite.
It's a PUBLIC parking lot. If I hear people yelling at one another, of course I'm going to look to see what the hell is going on. (And you would too.) The guy crossed the line when he came marching up the steps and pounding on my door (thus putting me in fear). But then I guesd you think th't sjust "a-okay" huh? Stupikd erhr fujckign peic eof shit. Burn in hell.
My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"