Slashdot Mirror
Marriott Fined $600,000 For Jamming Guest Hotspots
schwit1 writes: Marriott will cough up $600,000 in penalties after being caught blocking mobile hotspots so that guests would have to pay for its own Wi-Fi services, the FCC has confirmed today. The fine comes after staff at the Gaylord Opryland Hotel and Convention Center in Nashville, Tennessee were found to be jamming individual hotspots and then charging people up to $1,000 per device to get online. Marriott has been operating the center since 2012, and is believed to have been running its interruption scheme since then. The first complaint to the FCC, however, wasn't until March 2013, when one guest warned the Commission that they suspected their hardware had been jammed.
I just wonder if the fine that Marriott had to pay actually was large enough to take out the profit that they got from the jamming.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Why is it that the most awful dumpy motels always seem to have free, open and strong wi-fi? Many don't even bother with passwords.
Yet it's the expensive name-brand boutique hotels that always charge for wi-fi. And more often not, it's terrible quality, hard to connect and slow?
And, now we see this happening. This never happens at Motel 6.
Has anyone else noticed this- that overall the cheaper and sleazier the motel, the better the wi-fi?
To return the jamming favor.
Heh. Just commented on this on the Gizmodo post an hour ago. Please forgive the copypasta for my first post on Slashdot in probably 5 years.
My organization recently had a conference in a hotel owned by Marriott in a large Southern city. Not only did they want $500 per device per day for any Internet access — wired or wireless — the $12.95/day in-room wifi straight up did not work. They'd take your money before you could figure out it didn't work, of course. And if you ponied up the $16.95 for the "high speed" in-room wifi, it...barely worked. Barely.
We request one wired connection now. And once it's connected and the hotel staffers leave, I set up our own router with our own network. I'm pretty sure that if there was will or pressure on various and sundry consumer protection agencies, the prices charged by many hotel chains — with Marriott properties being the worst of them all — would not hold up in court.
I'll also add that our Director of Events is fairly convinced a new Marriott property in Washington, DC is doing this right now.
ACs are modded -6. I don't read you, I don't mod you, I don't see you. Don't like it? Don't be a coward.
$600k seems too small for such a large company. This is very sinister behavior. It would be like Burger King parking unmarked trucks or actors playing drunk bums in front of McDondalds' drive-through lanes to block customers.
Table-ized A.I.
Probably trade show booths. $1k is not an unusual cost of doing business internet fee for a convention. Oh yes, it's absurd. And yes, people will pay it if that means they can peddle their wares and make some deals.
"The first complaint to the FCC, however, wasn't until March 2013, when one guest warned the Commission that they suspected their hardware had been jammed."
How many guests would have the technical knowledge to tell if a device is being "jammed" or simply "isn't working" or that "cell reception is bad"?
With proper design of the hardware and protocols, congregation of people should be an advantage, as it is right now for the Hong Kong protesters and their mobile devices.
If it weren't for deadlines, nothing would be late.
Only one man would dare... Lone Star!
I've certainly noticed that. Midrange value-oriented places frequently include a continental breakfast too, whereas high-end places want you to buy their overpriced breakfast.
Sometimes I enjoy employing certain Priceline biding tactics to get a $200 room for $81, but other than the appearance the less-expensive places are often just as good or better.
They didn't jam the spectrum, they sent de-auth packets to the clients making it impossible for them to use the hotspots.
I am very sure it is not the top management of Marriot that dreamt up this scheme. The top honchos of most companies are so technologically inept they need tech support to turn on their iPads. It is most likely a local operation. The local manager lamenting not showing any revenue increase despite installing the WiFi access point server. And from the ranks someone down realizing jamming is possible. After that it is simple making bonus and making numbers for the local team that set up the scheme. The top guy has collected his bonus and will find another job. The mid level guys who knew it would be fired and have to look for a new job. The tab is paid by a big faceless corporation. This is likely to happen again.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
is that now that's less money that Mariott can donate to the Mormon church. Anything to deprive that cult of funds is a good thing.
I have, for years, because of Marriott's cozy relationship with the Mormons, refused to stay in one of their properties or any property owned by same.
So they basically got away with it. $600k when they're charging $250-$1K per wireless account? Yeah...that's fair.
Personal experience: ... where are the refunds? Where are the damages being paid back? My conference was fairly small (this hotel is beyond enormous mind you) and there still had to be 100+ vendors. We were one of ... I don't know ... 5-10 conferences that weekend?
I was a vendor at a conference in this exact hotel in 2013. Internet access was ridiculously expensive...per account which they prohibited sharing between devices of course. Handy when you're trying to present and sell technical services...and your hotspot doesn't work. Many vendors complained about how their hotspots weren't working, quite a few sucked it up and paid the extortion fee. Now I guess we know why. What I want to know is
At a bare minimum the FCC should find them equal to all the WiFi access fees they collected while this system was in place. Would some have paid anyhow? Yes. This is meant to punitive after all.
Oh...and don't let me get started on how they *required* you to "rent" carpet for your booth 10'x10' booth (starting at several hundred dollars) and pay for power connections - another several hundred dollars for the lowest ~300w 110v connection. Then there were fees to receive fedex boxes, fees to store them until you got them, fees to deliver them to you, etc. Want to rent a TV for your display? They quoted something like 6 grand for two 42" TVs with speakers. Yah huh. The vendor that got that quote laughed at them, went to costco and bought two TVs for ~$1500, then raffled them off.
You can get rich if you own a politician, but you have to be rich to buy one in the first place.
Technically this wasn't jamming - it was a DoS through wifi deauth attacks.
Actually jamming other wifi routers while keeping yours up would be extremely tricky or maybe impossible.
"When information is power, privacy is freedom" - Jah-Wren Ryel
Are you kidding?
They were jamming for two years in a convention center where thousands of people meet every weekend, and they were charging exorbitant fees, in some cases $1000 per device. If this looks too high to you, imagine you are giving a talk about the last 18 months of your research, and a prearranged setup stops working. Your tenure, your reputation, your tenure may depend on that talk. And that's just for researchers. A company that has gathered a thousand POS managers for a discussion of a new system will have millions on the line.
Captive customer base indeed.
Fines seldom come close to wiping out the profits from the con, when big businesses with lobbyists are involved. I have personally participated in a cleanup effort (mostly through volunteers) which used about $30,000 on top of our donated time and equipment. While we were working, the assholes released more detectable crap, and were fined $2,500. But hey, they are golfing with the local high scum.
No good deed goes unpunished...
To play devil's advocate - That's pretty much what the people here were trying to do - prevent a disaster like what happened at the 2012 Big Android BBQ, where exhibitors/speakers couldn't use the network because it was completely jammed, or 2013 BABBQ where they at least kept most people off of the convention center network but all of the hotspots around caused everyone's wifi to be flaky.
Keep in mind this happened at a single Marriott location which was a convention center - it's not standard corporate policy. I've been staying at various Marriott hotels for years and the wifi has always been free.
retrorocket.o not found, launch anyway?
As much as I dislike Mariott's practice here, this is clearly outside the scope of the FCC's regulatory powers and as far as I know isn't even in violation of their own regulations. First of all, WiFi operates on UNREGULATED spectrum, which means anyone can use, and anyone must accept interference from other users. Apparently, the FCC wasn't even concerned with the frequencies that Mariott was using, it was the fact that they were sending de-auth packets that bothered them. This is not the sort of thing FCC should be regulating. In fact, the technique used by Mariott is commonly used in many locations (hotels, universities, hospitals) that provide their own WiFi in order to prevent rogue setups from intercepting people's data, and possibly even redirecting traffic to their own phishing sites. (Not everyone checks that the SSL certificate fingerprints haven't changed when they log in to their bank account!) I used to work in the IT department at a university and we did EXACTLY the same thing that Mariott was doing, for just that reason. (Unlike Mariott, we didn't charge people to use our WiFi, but that should make no difference as far as the FCC is concerned.) When we set up that system, we also investigated the legality of it, and the conclusion we came to was that it was perfectly legal since it was on unregulated spectrum. In fact, many, if not most, commercial WiFi systems have this function built in. Ours certainly did, we only had to turn it on.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
That's at least not willful and malicious.
Large venues do beef up their cellular network but there are finite limits on the number of channels and frequencies available. Generally they do a pretty good job at stadiums and concert venues. Ad-hoc venues? Well good luck :)
WiFi is another story. I always use 5GHz and typically don't have an issue even living in NYC. 2.4GHz? Lol...good luck.
You can get rich if you own a politician, but you have to be rich to buy one in the first place.
Comment removed based on user account deletion
Are you kidding?
They were jamming for two years in a convention center where thousands of people meet every weekend, and they were charging exorbitant fees, in some cases $1000 per device. If this looks too high to you, imagine you are giving a talk about the last 18 months of your research, and a prearranged setup stops working. Your tenure, your reputation, your tenure may depend on that talk. And that's just for researchers. A company that has gathered a thousand POS managers for a discussion of a new system will have millions on the line.
Captive customer base indeed.
Fines seldom come close to wiping out the profits from the con, when big businesses with lobbyists are involved. I have personally participated in a cleanup effort (mostly through volunteers) which used about $30,000 on top of our donated time and equipment. While we were working, the assholes released more detectable crap, and were fined $2,500. But hey, they are golfing with the local high scum.
Did you host an event there? Sue Marriott in civil court.
If the FCC doesn't have the authority under current law, what agency should regulate situations like this (assuming for the sake of argument that Congress intended for such situations to be regulated)? The Federal Trade Commission perhaps?
What you were doing was arguably more ethical since you weren't making money off of people using the service, but if it happened today you would be denying other companies (namely, cell phone carriers who sell wifi hotspots and who charge by the byte) the right to conduct business.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The ISM bands are not unregulated. Operations in the ISM bands are not protected from unintentional interference, but the FCC most certainly has the authority to, but chooses to abide by agreements with the ITU deferring to ETSI.
This is exactly what the FCC should be regulating, and not the content of TV or Radio broadcasts. This type of intentional disruption of service should be policed by the FCC.
by Mike Buddha -- Someday the mountain might get him, but the law never will.
You're confusing unlicensed with unregulated. The FCC regulates ALL the RF spectrum in the US.
With that said...The rules include:
"...no person shall willfully or maliciously interfere with or cause interference to any radio communications of any station licensed or authorized by or under this chapter or operated by the United States Government"
This was definitely willful and arguably malicious as well.
You can get rich if you own a politician, but you have to be rich to buy one in the first place.
First of all, WiFi operates on UNREGULATED
This is completely and patently false. There ARE regulations on wifi. They are merely moved into the unlicensed spectrum which is NOT the same thing as unregulated. Granted, the regulations are pretty few, they are NOT non-existent.
Fortunately, there is a solution for those; unfortunately it is not cheap. The cell service providers can supply one or more high-capacity "mini towers" at the venue with a fiber uplink to their own system, and a provider-agnostic third-party repeater system can be installed so that all frequencies from those providers can be broadcast throughout the venue in locations where the mini towers cannot reach directly, and to ensure that 10,000 users don't try to connect to a lower-capacity tower nearby that happens to have a good signal.
Also, many large venues (pro stadiums in particular) provide complimentary WiFi with full-load capacity in mind, so you should still be able to make calls on a VoIP service or send messages via any app that uses TCP/IP instead of SMS.
...WiFi operates on UNREGULATED spectrum, which means anyone can use, and anyone must accept interference from other users... and we did EXACTLY the same thing that Mariott was doing, for just that reason. ... we also investigated the legality of it, and the conclusion we came to was that it was perfectly legal since it was on unregulated spectrum.
According to that logic, I can come with a router backpack and prevent all users from connecting to YOUR university network. Well, it's unregulated, right? You should accept the interference and you cannot ask me to leave (in fact, I can be on a public place to cause you enough of a headache, so all is a fair game).
How did Google get charged exorbitant fees for briefly recording unencrypted wi-fi traffic from their street view cars while everything they did was on an unregulated spectrum?
There's no such thing as "illegal download"
Seems like you're asking for the FCC do go beyond their duties. What you're looking for is a class-action lawsuit.
Enforcement is...difficult at best.
When APs were big and bulky and more scarce perhaps. These days though my daily carry bag has 2 or 3 APs in it (iPhone, android, sometimes hotspot or iPad). Chromecast uses WiFi. Samsung printers with NFC use wifi ... as to a plethora of other things that people don't even realize.
Yes you can get some directional antennas and start triangulating people...but you've probably got dozens of WiFi networks that the owners don't even know exist and aren't using to get internet anyhow. So chasing them down doesn't earn you a sale and just pisses people off.
You can get rich if you own a politician, but you have to be rich to buy one in the first place.
As much as I dislike Mariott's practice here, this is clearly outside the scope of the FCC's regulatory powers and as far as I know isn't even in violation of their own regulations. First of all, WiFi operates on UNREGULATED spectrum, which means anyone can use, and anyone must accept interference from other users.
Not quite true, the ISM bands are Unlicensed bands, not unregulated. In order to sell equipment used to transmit on these bands, the systems must be type approved. Part of this type approval process includes ensuring that the equipment in question will not cause undue interference to other users on the band. To me, sending rogue de-auth packets constitutes interference.
In Meraki's Air Marshal Whitepaper, they explicitly state on page 8 that Unauthorized containment is prosecutable by law (subject to the FCC’s Communications Act of 1934, Section 333, ‘Willful or Malicious Interference’)..
I actually had this particular issue affect me. As a volunteer, I operate a community-wide network, including a widespread wifi network, at a retreat centre high in the mountains of WA. At this time, there is a significant mine remediation project going on in our valley, so we have leased out several buildings to the construction companies, who setup their own Meraki system. Unfortunately, they enabled Air Marshal, which then went on to attack our wireless network. Despite running WPA-Enterprise on our network, it was still successful in attacking our networks, and rendering them nearly useless. In the end, we had to flex our muscles as the landlord to get the feature disabled.
In my mind, the ability to attack adjacent networks should be illegal, and Cisco and the others should not be permitted to sell this technology to the general public. Rather the systems should simply alert on the presence of other wifi networks, and assist in locating them. Also, the wifi standards should really be updated to fix this type of vulnerability... in a WPA-Enterprise environment, clients should only respond to a de-auth packet encrypted/signed with the session key between the client and the AP its connected to.
...si hoc legere nimium eruditionis habes...
I'd call it malicious but that's an opinion word. Nobody, however, can deny that it was willful. They admitted they did it and said they think it's an okay thing to do; that is clearly willful. That's fine, they are being honest: they violated a rule which has the force of law because they don't think that rule should exist.
They can lobby for a change to the law/rule, and until then they should obey the law/rule. My only problem is, like always, the fine is 100x too small.
Is the $600,000 going to the government or the people that were affected? Could Marriott be in the crosshairs for a class action also?
Passionately Indifferent
Yeah that's one way.
Another way is to have laws and fines that are sufficient to actually stop abuses, instead of burdening courts with remunerating for abuses after the fact. I prefer this way.
For instance, yeah my family could sue the maker of the tainted drug that kills me, or we could just have the nanny state certify drug manufacturers and then people don't have to die nearly so much in the first place. I think that is a better world so that's the one I support.
Sometimes they're just too many people and too much traffic. As a member of the HPC community I attend the annual super computing trade shows hosted in various cities each year. Each year the SCinet network infrastructure team does everything they can to build out and improve the hardware and software infrastructure at these venues. Mind you, these are extremely well funded and talented people who "know how to get it done right". Yet every year within the 3 blocks of the convention centers you barely get a functional cell phone link, let alone functional wireless or even wired connection to the intertubes.
Mind you, these are extremely well funded and talented people who "know how to get it done right".
If they're well funded, they're obviously not talented enough.
It's certainly a challenge to provide coverage at these events, but it's a solved problem. Football stadiums get it right. Nearly every big Vegas tech convention I've been to recently gets it right. They've got talent, money and time. What's the problem with SCinit?
ISM is very much regulated. Get a new legal team.
ISM is unLICENSED. That means that you don't need a license to operate in that band as long as you obey the regulations in place. Those regulations cover radiated power and intentionbbal interferance (which is MUCH different than unintentional interference.
If your baby monitor causes trouble for my WiFi (or vice versa), that is unintentional. OTOH, if you get a baby monitor and a parabolic antenna with the intention of interfering with my WiFi you are violating regulations (but it may be hard to prove). If you get a WiFi and send deauth packets to my hardware it becomes easier to prove willful interference. If you change channels when I change channels it is very easy to prove.
Maybe it was, maybe it wasn't.
Many Marriott properties offer "free" WiFi. Indeed, the cost of providing this service is rolled into the room rates.
Other Marriott properties charge a fee for WiFi access. However, Platinum (and I think maybe Gold as well) Marriott Rewards members get access for free (though this is a relatively new development). Since these folks have the same room rates as everyone else, it's not exactly accurate to say that the price is included in the room rate (since many people pay the room rate and the WiFi fee).
Tough I suppose in some sense, even air isn't free.
Chuuch. Preach. Tabernacle.
The Mariott owns the property, and they have a right to dictate the use of their property, so they have a right to control what WiFi equipment can be brought into and used within their premises.
While I can see why a business owner would want to control WiFi on their property, the fact is they do not have that as a blanket right under US law. For example, as a business open to the public, they can't say AT&T cell phones may be used but not Verizon or Sprint since they have a contract with AT&T. Nor could they say you are prohibited from using your radio to listen to any radio station but theirs. BY LAW, they do not control the airwaves. They are allowed use to the airwaves under the rules and regulations set forth by the US Government and its duly authorized regulating bodies. They may be able to put usage wording into contracts that they could then enforce in the courts if the user violated them, or even kick them out of the conference, but they can not do a vigilante move by killing all radio signals they think must be from someone violating the contract. And that already presumes a legally binding contract. The public owns the airwaves, not the hotel/convention center.
"or authorized by" you are authorized to use unlicensed frequencies, by that very chapter if you are abiding by those rules, ergo the marriott's AP was not abiding by that rule and therefore technically not permitted to use the unlicensed frequencies which would be the legal grounds for the fine - would it not?
In Meraki's Air Marshal Whitepaper [cisco.com], they explicitly state on page 8 that Unauthorized containment is prosecutable by law (subject to the FCC’s Communications Act of 1934, Section 333, ‘Willful or Malicious Interference’)..
Hmm, according to the whitepaper you linked it says "As containment renders any standard 802.11 network completely ineffective, containment measures should taken in your airspace(emphasis mine). Extreme caution should be taken to ensure that containment is not being performed on a legitimate network nearby and, action should only be taken as a last resort. Unauthorized containment is prosecutable by law (subject to the FCC’s Communications Act of 1934, Section 333, ‘Willful or Malicious Interference’). "
So provided that the "containment" effort took place only on Marriott's property (not a public space), I'm having trouble seeing how Marriott is legally in the wrong. Obviously, it's sleazy (and the FCC found reason to fine them, as well, so what do I know). Perhaps there is an implied right to the public use of the air in a building that, while not freely "open to the public" per se, is also not "closed off" private, either?
Would a retail store be prevented from doing the same thing?
Look at the tomato! Isn't it sad? He can't dance! Poor tomato!
OK, Econ 102. They get repeat customers using their hotel instead of a competitor's hotel. If the Rewards incentive wasn't there, many of these customers would not use the Marriott properties as much as they do, maybe even rarely or not at all, and so Marriott's gross income would be lower, and therefore presumably net income. This means these customers, by using the Marriott chain hotels as much as they do, are providing a higher revenue stream for Marriott, and it is in Marriott's financial interest to provide benefits, like WiFi at no additional charge. The "charge" for the WiFi is built into this increased revenue stream, since the traveler could at times have chosen a cheaper non-Marriott hotel, and also since the WiFi (or wired) expense is a sunk expense, namely it is already paid for and whether the room is empty or the room has a guest in it using the wire the cost to Marriott is essentially the same, give or take potential future expansion needs.
That explanation wasn't very clean but I have a project due and didn't have time to edit it much, but hope you get the idea.
Am I wrong? That's how I read the whitepaper.
You are wrong. At least one model of Meraki access point has a dedicated radio for this purpose. It attacks other wifi networks through a number of mechanisms, including pretending to be the AP under attack, to attract clients to it, sending spoofed de-auth packets to the clients of other APs, and other techniques to effectively conduct a denial of service attack on whatever other wireless network that may exist within its range. This is precisely what I was encountering on my network.
The main issue I have with this technology is that it can be set to attack all other wifi networks. If it was limited to protecting the SSIDs under its control, I would have less of an issue with it. IE if the wireless system is advertising the SSID "Marriott Convention Center" and someone else sets up a rogue AP using the same SSID, then that's fair game, as the person running the rogue AP is either clueless, or has nefarious intent. If it's attacking "Bob's iPhone Network" then that's another matter.
...si hoc legere nimium eruditionis habes...
Guess what was authorized?
These are guest-created hotspots. Likely provided by A LICENSED CELLULAR CARRIER. You are attacking my ability to connect to something I paid for in an attempt to get me to pay YOU for the same thing.
This is a violation of FCC rules, tortious interference of contract, and CFAA bait, on top of a RICO suit.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
But Noooooo. We have to play by communista rules, where companies are not allowed to use the airwaves, which belong to them to intercept, jam or do whatever they want to, as guaranteed in the Constitution, when Jesus wrote it.
Thanks, Obama.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
"No additional fee" would be more accurate that "free" in this case.
They aren't talented. Get 10,000 people in a convention center. How do you give them wireless? You can't just put in APs. Even 10,000 APs won't work (one per person). The problem isn't the RF (well, not always), but is L-2. When you have 10,000 people on the same L2 network, and every link on that L2 network is half-duplex, what's the usable capacity of the network? Rounds to zero.
These "talented" people should have known that. So you need some number of APs (I'd aim for about 1000, with minimal overlap and no interference), and each one (or groups of 10) on the same L2 network. If you want L3 transparency, you'll need expensive APs that can tunnel L3 to other APs for seamless L3 roaming across separate L2 networks.
I know it works. I've done it. You just have to identify the problems and solve them. Given that they've done it annually and it doesn't work, the problem isn't that it's wireless, it's that the "talented" people aren't.
Learn to love Alaska
By your definition of "free", "free" has no meaning. As people presume it to have some meaning, then your definition must be wrong.
Learn to love Alaska
How did he do it?
News for nerds, come on!