Confessions of a Wi-Fi Thief 849
Michelle Shildkret from Time wrote in to tell us about a story about "the ethics of stealing Wi-Fi. Many of us been guilty of the same crime at one point or another — according to the article, 53% of us at least. But how guilty do we really feel? As it is officially a crime to steal wi-fi (Title 18, Part 1, Chapter 47 of the United States Code, which covers anybody who 'intentionally accesses a computer without authorization or exceeds authorized access')."
Not a thief (Score:5, Insightful)
Then, I have never stolen WiFi. I have never accessed without authorization; as I have never cracked a WEP or WPA password scheme.
Everytime I use an available wireless network, I instruct my computer to ask for permission to connect to the router and enter to the wireless network. And most of the time the router gives me such permit and assigns my router an IP. When it does not happen, then I assume the owner has instructed the router to give permission to specific machines (as in, machines with a specific MAC adddress) and hence I do not use such networks.
Seriously, someone must create an interface in which a person is able to send the commands manually to the router (like the AT commants in a modem) to ask for connection permission (i.e., DHCP protocol). That way, when you are in court, you could use that program along the court's wifi to show them how you are indeed asking for permission and the software is granting you the permission.
I ain't a theif (Score:1, Insightful)
This can be argued, but... (Score:5, Insightful)
But then again, I'm not a lawyer.
How Guilty? (Score:5, Insightful)
Re:Not a thief (Score:5, Insightful)
Re:no theft here (Score:4, Insightful)
Re:Not a thief (Score:5, Insightful)
In general, laws are designed to work like this: that which is not expressly forbidden is permitted. We're talking about radio waves here; before anyone starts up with some dumb analogy to parked cars and leaving the keys in them, consider this: when you use a resource I have made freely available, you're not denying me access to it. Someone might make the argument that excessive use of my resource would degrade its usefulness to the primary (owning) party, but that's easily remedied using simple protection schemes (either block access entirely, or throttle access to unauthenticated clients). I've done exactly this in numerous cases, using various router packages.
Here's a sad, but interesting article: Man charged with wireless trespassing [cnn.com] from July of 2005. To quote a section:
Re:no theft here (Score:3, Insightful)
In this case, you aren't accessing the computer, you are communicating with it.....you are accessing the NETWORK without (human) permission.....which the law (as stated in the summary) doesn't cover that situation.
Layne
Re:Not a thief (Score:2, Insightful)
What you say makes sense, but I don't expect the law to make sense.
Broadcast = Permission (Score:5, Insightful)
You could say that a wifi router is different from TV because the activity is two-way: but the wifi router chooses to respond to me. If the owner of the router never bothered to tell their router not to respond to me, then is it my fault that it does? Am I guilty if my computer merely pings their router because it created a response on that router? They are the one who initiated the communication by broadcasting hello packets.
Re:Not a thief (Score:5, Insightful)
Have you ever spoofed a MAC address?
Have you ever connected to an access point that did not broadcast its SSID?
Have you ever connected to an access point that says "private", "stay out", or otherwise?
If 'yes' to any of the above; I don't know about the U.S. law, but in The Netherlands you would still be guilty of "computerhuisvredebreuk"; meaning so much as tresspassing on a computer network
Then again, a great many people seem to think that even WEP encryption is an open invite to use the system, given the easy of cracking it.
Re:Not a thief (Score:5, Insightful)
How does the law answer the same question about websites?
tsoat (Score:5, Insightful)
Re:Not a thief (Score:5, Insightful)
Re:Not a thief (Score:5, Insightful)
Those who crack networks by breaking WEP, spoofing keys, or other measures should be held legally accountable. People who merely access an open, advertised resource shouldn't be at risk of going to prison.
Re:This can be argued, but... (Score:3, Insightful)
An advertised SSID is identifying an available service. Just like a sign that says "bookstore" or "Starbucks" advertises the service available inside.
When I walk up to the door of the starbucks, I pull on the handle. If it's locked, I assume it's closed and I leave. If it's open, I go inside. Same with a wifi access point. If they have an advertised SSID and don't set a password it's the same as putting up a business sign and having the door unlocked.
In fact, a number of companies use this exact business model for wireless. Starbucks, TMobile, etc.
1). Connect to a wireless network without explicit authorization
2). Open a web browser.
3). A web page displays asking for credit card payment or other credentials for use.
On an open network, you're already surfing google before you get to step 3. And if that is committing a crime, so is accessing starbucks wireless.
Re:no theft here (Score:4, Insightful)
Accessing a hotspot without authorization may be a crime, but so is smoking pot. Is smoking marijuana "thieft"?
You are correct, TFS is wrong. If I steal your truck you don't have access to your truck. If I hide in its bed and ride downtown with you without your knowledge, it may be wrong and it may be illegal but I didn't steal anything.
It *is* unethical to steal wi-fi (Score:2, Insightful)
1. It puts your neighbor at risk for any illegal activities done by you that get traced to their IP address.
2. It boosts their bandwidth use higher than it otherwise would have been. Even if this doesn't directly harm them, it causes indirect harm to all the ISP's paying users because they have to subsidize your freeloading.
If you're stealing wifi right now, do the right thing and pay for it. SOMEONE has to pay for it, and it's not right to have someone else pay for you.
I thought that law was un-enforceable (Score:3, Insightful)
Re:Not a thief (Score:3, Insightful)
I've never been one of those people who feels like an unlocked door is an invitation, but call me old fashioned.
Re:plenty of us just give it away... (Score:3, Insightful)
Re:Not a thief (Score:3, Insightful)
Since nothing was bolted to your floor, I proceeded to help myself to your TV and associated A/V equipment, your PVR, your Playstation 3, and your Wii. Additionally, your study door similarly allowed me to enter your study, where I noticed some computer equipment that wasn't chained to the desk, so I left with that, too.
Since your doors granted me permission to enter your house, and they were acting on your behelf since they are on your house, you have no reason to complain.
Right?
Re:Not a thief (Score:4, Insightful)
Illegal versus Unethical. (Score:3, Insightful)
And if the neighbors ain't neighborly, it's time to padlock the workshed.
Re:Broadcast = Permission (Score:5, Insightful)
Complicating matters is that certain popular OSes (XP, I'm looking at you) tend to auto-connect to the strongest signal available, no matter how nicely you ask them to stop doing that. If you're closer to your next-door neighbor's WAP than your own, and Windows decides to use his without asking your permission or even telling you, then can you really be considered guilty of anything? And doesn't that mean that the world's largest OS vendor considers "default allow" to be the correct interpretation of WAP etiquette?
As little as I'm a fan of MS, I think "that's the way Windows does it automatically" would be a pretty good defense against criminal intent, even if a jury disagreed with the legality of the actions themselves.
Re:Not a thief (Score:3, Insightful)
Many of the latest consumer routers actually disable the wireless option at the factory, requiring the user to click through a simple wizard interface and explicitly choose whether to enable or disable security before the radio is turned on.
How is this any different from setting up a web server on the internet with a published domain name containing sensitive information with no password protection or other authentication? Should anybody who attempts to gain access be imprisoned? I would hope that most reasonable judges would see this deliberate act as implicitly granting permission, even if it is an act of omission.
Re:Not a thief (Score:5, Insightful)
Re:Broadcast = Permission (Score:1, Insightful)
This is crucial. The Wifi Router is NOT a person. PEOPLE grant authorization to use wireless routers, not routers. So there is an issue of intent here.
What would you say about these cases?
1) Person has linksys router, with default SSID, and open access.
2) Person has router, with SSID 'freeInterButts', and open access.
3) Person has router, with SSID 'private', and open access.
4) Person has router, with strong encryption.
Authorization is only granted BY A PERSON in case 2. Yes, the other cases are common, and 1 and 3 are stupid. I don't dispute that.
Am I guilty if my computer merely pings their router because it created a response on that router?
This is pretty interesting. If you think router users should be on the hook for what their routers do automatically, you should be on the hook for what your laptop does automatically. After all, you can configure your laptop to NOT respond to Hellos or initiate SSID lookups (which are initiated client-side).
Obviously, there is an issue of intent here too.
Re:In Germany, you are a thief (Score:3, Insightful)
Which is insane, as the DHCP reply packet was actually _addressed_ to the recipient. But why should the law be sane? Much easier to start with the conclusion (Guilty, guilty, guilty! Burn the hacker!) and come up with some plausible sounding justification for it.
Re:Not a thief (Score:5, Insightful)
Re:Not a thief (Score:5, Insightful)
That was even worse. More accurate analogy: you have a loudspeaker shouting "HI! COME IN!" to all passersby. I ring your doorbell, and a key to the house and a nametag pops out of the mail slot.
Don't want me in your house? Don't advertise free admission then give me a key and a nametag.
Even better analogy (Score:4, Insightful)
Re:Not a thief (Score:5, Insightful)
Re:Not a thief (Score:2, Insightful)
Re:Not a thief (Score:5, Insightful)
Except that you didn't enter any house. Your neighbour is transmitting their open-access signal into your own house for you to use. Your analogy is therefore broken.
Re:Not a thief (Score:5, Insightful)
The WiFi, if not secured, is simply private space because there is no sign that prohibits trespassing. Why the hell should I be a criminal if someone penetrates my apartment with WiFi signals that are not secured by password?
By breaking through the encryption, you're obviously doing something criminal. But that's something entirely different, too..
Re:Not a thief (Score:5, Insightful)
That could presumably be false if whoever is paying for the service pays for a limit GB/month allowance
Re:Not a thief (Score:3, Insightful)
I wonder if there's a case there for high population areas where there are lots of wifi signals... There are only 14 channels, 3 of which don't overlap... Can you sue for interference? (not that I'm sue happy, just curious..)
California law (Score:5, Insightful)
California Penal Code Section 502(c)(3) and 502(c)(7).
And for all of the idiots stating that the "router" gave them permission, give me a break. The router isn't a legal entity, and only works in the way you interact with it. Just like the door knob.
I twisted the doorknob (initiated association with the accesspoint), and the doorknob gave me permission to enter by retracting the latch (allowing me to associate and giving me a DHCP lease). The owner of the door could have configured the door differently, by engaging the lock mechanism (using WEP or WPA), so since he didn't I'm free to enter and watch his HBO (use his broadband internet access). I'm not "stealing" from him, because it's not like he has less HBO (internet) now that I've viewed some of his HBO (internet).
A big part of what a lot of people are missing is, even if you had a point regarding associating with his wireless network because it is open (which you don't), that only gives you authorization to access his LAN. You still have no right to use his paid broadband internet services. You don't have that right, because you aren't paying the ISP, and because the owner of the access point doesn't have the right to share or transfer his right to use his internet service with all of his neighbors, just like I don't have the right to share my HBO programming with all of my neighbors. It's called theft of service. Even if you claim the right to access the wireless owner's network, you certainly do not have permission to access the ISP's network. And even if I run coax down my lawn, and put a coax jack at the end of my property so that people on the sidewalk can screw into it and watch HBO, that doesn't mean I have any right to share my HBO or that you have any right to leech service that you're not paying for.
Using someone else's wifi is a crime, because you're not just accessing their network, you're accessing their ISP's network without permission. Giving away your wifi by intentionally hosting open access points is very likely a breach of your contract with your ISP.
Re:Not a thief (Score:3, Insightful)
The case of wifi is very particular because the user pays a FIXED FEE. Not even plugging your tv on your neighbor's house would be equivalent.
Re:Not a thief (Score:3, Insightful)
What do you mean you don't have an unlimited gasoline supply? You pay per gallon? What?
Satellite internet providers will throttle a user down siginificantly if their use exceeds so many GB per month. By using their wireless network, you are consuming bandwidth they pay for and causing them to be throttled when they might not be if you hadn't connected. Not to mention people who actually do pay per MB/GB.
An unsecure wireless network is NOT an invitation, and negotiating a network connection does not equate implied permission to use the network. Just because you can do something unimpeded does not make it okay. I've seen malfunctioning routers that SHOULD be using encryption fail do to so. The configuration showed encryption as being active, but it worked as an open access point.
Re:Not a thief (Score:1, Insightful)
Never mind the obvious stupidity in leaving myself open like that. That's not the issue. The issue is you are saying leaving myself open makes it not stealing. Computers/routers can't give you permission to access them in the legal sense as computers and routers do not have the capacity to reason. They can give you permission to access them no more than the wall of a building can give you permission to paint graffiti on it. They are only doing what they are designed to do based on the original designers intent, not the intent of the owner, and certainly not their own intent since they can't have intent.
If the router came pre-secured and the owner had intentional removed such protections it could be argued, likely without success, that they were giving every one implied permission to use the device. However, since such devices typically come with all such safeguards turned off and since most users do not understand nor care to understand the implications of such the courts will rule the such permission is not implied.
The permission you speak of is purely an IT concept and is different from the permission required by the law the same way a bank that you place your money in is different from a bank that helps you maintain speed through a curve on the freeway. One means that access has been granted by one computer to another computer and does not imply that you, the person at the computer, are supposed to have permission to use it, simply that you successfully gained access but not necessarily not authorized access. The other means that you were expressly given permission to use something... and worth noting is that that permission applies even if for some reason you CAN'T access it because of, for example, the inability to authenticate (ie you are authorized but you don't have access).
Re:Not a thief (Score:5, Insightful)
Did you check your email this morning? If so, did you call up Google or Yahoo or your ISP or whoever provides it and ask them if you had permission to connect to their server?
Did you call the person hosting TFA before clicking on the link asking if you had permission to access their server?
Of course not. That's preposterous. Because the nature of a computer network is DEFAULT ALLOW. If it were not, the internet as we know it today would be impossible. Quite literally, the fact that I _can_ connect to a webserver makes it okay. The fact that I _can_ connect to an SMTP or POP3 server implies I have permission. And the fact that a wireless router grants my laptop an IP address is literally the router saying "Feel free to use me however you want."
Just because people don't realize this fact doesn't make it any less the case. Otherwise, I could set up a webserver, buy a domain, then sue anyone who connects to my webserver for accessing my computer without my permission. I pay per GB of bandwidth the server uses, how dare you connect to _my_ webserver and use _my_ bandwidth.
Re:California law (Score:4, Insightful)
What if they tell me it's OK? Surely, if I'm visiting someone's house, there's no meaningful difference between them sharing their Internet with my laptop, or inviting me to use their computer.
For that matter, if SSID broadcast, working DHCP, working DNS, and a working gateway aren't enough to authorize someone, is there any technological means by which I can declare a wireless network to be open and legal?
Wrong on both counts. When I go to the coffee shops in this town, they have public wifi set up, deliberately, explicitly as free for their customers -- one of them has a sign in the window from their ISP which advertises it.
And copyrighted music, of course, is entirely legal to share if you have permission of the copyright holder to do so.
Re:Not a thief (Score:3, Insightful)
Obviously not, any more than I asked permission to enter a store. A web server is a lot different than a WAP in function and in intent. An unlocked door at a business and an unlocked door at a residence are similar.
Pedant? (Score:3, Insightful)
Pedant.... Pedant.... pedant.pedant.pedant...
Re:Not a thief (Score:5, Insightful)
Wait wait, better -- you bulk mail out the invitation to "Occupant", but it doesn't include the key. Instead of getting the cars rekeyed, you just have a giant rack of keys, and you hire a guy, Vito Linksysio, to hand out the keys as needed. Now, you *could* give Vito pictures of people who are allowed to borrow the cars, but that's too much trouble. You *could* tell him that people have to know a password to get a car, but that's too much trouble. So you just tell him to hand a key to whoever shows up.
And even though you've mailed the invitation to the entire zip code, you're still shocked, shocked to find that strangers are borrowing the cars. How forward of them!
Comment removed (Score:3, Insightful)
Re:Not a thief (Score:4, Insightful)
Reasonable? If every person required one new IP address every millisecond it would still take 1.58444 x 10^18 years to exhaust them.
And I meant it jokingly here. IMO IPv6 gets it right by setting a very unreasonable (-ly high) limit. But, since you didn't laugh, I have to be serious now.
With developments today, I wouldn't be surprised if someone finds a reason to consume huge swaths of IP addresses rapidly. Maybe not by assigning every RFID tag a unique IPv6 address, but who knows how many may actually be in a single product. Or maybe, taking your figure of 5x10^28 IP addresses per person, that's a big address space in which to randomly route packets to prevent their reassembly by an outside party. You may just have to do that to protect your privacy against the ubiquitous microscopic self-replicating cameras floating around everywhere like grains of dust, each with their own IP addresses as well.
There's another phrase, I think it goes, "Programs will expand to fill available memory." If you give a huge space for IP addresses, expect IP assignments to grow to fill that address space. Even to waste it by doing sparse allocation.
There are programmers out there today that think not consuming a processor 100% all the time is a waste of processing power, so they write wastefully inefficient code all the time to utilize the processor all the time, ignoring the needs of other concurrent proceses.
Re:Not a thief (Score:4, Insightful)
During business hours, you're a business invitee to the property. You have tacit permission to enter, but the owner can still ask you to leave.
There is no such license to enter private property. If the owner hasn't expressly authorized your presence, you're trespassing.
The only way these are similar is that if you use an unsecured wifi network, you must take responsibility for the fact that you may be trespassing. Locked or unlocked, it's still their network. You don't get to enter the house just because the door's open. And before anyone complains about "unsolicited radio waves"--guess what? Radio waves aren't actionable as a nuisance, nor are scents (apart from those indicative of health code violations), nor are the damn photons flying into your eyes. If you want to be certain you're not doing anything improper, seek permission and don't use unsecured networks unless you know you've been authorized. Otherwise, you bear the risk of being at fault for unauthorized access, just like when you go berrypicking in the woods.