4 ms·

Legal arguments based on geometry are not particularly solid. My phone antenna technically catches a lot of wifi traffic, the difference is that most of it is

by afiori 6y ago

Legal arguments based on geometry are not particularly solid. My phone antenna technically catches a lot of wifi traffic, the difference is that most of it is not retained/analyzed. Overall, again, it comes to expectations, and in this case to massive indiscriminate surveillance. A lot of thing changes if in the previous analogies "one neighbor" is replace by "an army of drones/employees patrolling the streets" Moreover passive monitoring is an attack from a cybersecurity perspective, that wifi makes it possible is a vulnerability of the protocol and it is not nice for google to exploit said vulnerability.

shadowgovt 6y ago
I'm talking about the moral / "common sense" space. If you want to get into the legal space, the FCC's finding in Google's case is that it can't be considered "wiretapping" to observe and record publicly-broadcast, unencrypted data. Discussion on the topic: https://www.wired.com/2012/05/google-wifi-fcc-investigation/ https://www.wired.com/2012/05/google-wifi-fcc-investigation/ The relevant section of law: https://www.law.cornell.edu/uscode/text/18/2511 https://www.law.cornell.edu/uscode/text/18/2511 "It shall not be unlawful under this chapter or chapter 121 of this title for any person... to intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public." The FCC interpreted unencrypted broadcast wifi to be such signals. ... and at least when I was a young hacker, learning at my mentor's knee, the expectation was to assume that if one neighbor could do it, an army of drones could. After all, we didn't put firewalls on our home routers because our neighbors could access our poorly-configured Windows defaults to back-door our machines; we did it because such machines would be co-opted into a bot-net by random anonymous hackers. Data being dumped out of your house into the street is in the commons. If one doesn't like that, one should probably take the most basic measures to stop doing that. It's naive to expect either the law or society to step in and stop people from picking it up; there's a whole radio hobby around what a person can hear with an antenna and a bit of quartz crystal, and both American law and American culture have been extremely consistent that it's not the listener's fault if they pick up something interesting.
- afiori 6y ago
  I am also talking about my common sense. The fact that we should expect something to happen is orthogonal to whether the one who made it happen was justified. In my common sense there are many factors in this story that play against Google: 1) the said army of drones 2) it is unreasonable for users to force exclusively encrypted communication 3) they clearly operated in a "let's collect as much as possible" rather than having a clear objective like for the SSID 4.1) they have collected potentially sensitive data from businesses connections not intended for the public space 4.2) they have collected private data from personal connection not intended for the public space. Overall what I see is that wifi is not as secure as I expected and Google (lawfully) exploited said lack of security with complete disregard to other's privacy. Many other points of view might be possible, but I believe this is a reasonable/valid way to interpret what happened.
  - shadowgovt 6y ago
    > it is unreasonable for users to force exclusively encrypted communication Hard disagree. That's like saying it's unreasonable to expect cable modem routers to come with firewalls or websites to default to HTTPS. I think it's rather unconscionable that the opposite is the case: we had too many years of wifi routers come to market that were unencrypted by default. 4.1 doesn't agree with the law or common sense. Don't broadcast cleartext data if you don't intend it for the public space. TCP/IP packets or Morse code, the principle is the same. Expecting every radio receiver to know whether broadcast cleartext was "intended for the public space" is impractical, and both law and radio culture reflect that impracticality. Expecting the radio recipient to decide whether your data is intended for public space or not would be like replacing telephones with megaphones and then fining people for listening to conversations.
    - afiori 6y ago
      > Expecting every radio receiver to know whether broadcast cleartext was "intended for the public space" is impractical, and both law and radio culture reflect that impracticality. I agree, but I cannot agree that this can apply to google sniffing wifi packets. Google knew they were wifi packets, they knew those packets where intended for the "internet", they knew they were not addressed to them; it was not a generic radio transmission. It is a good argument for why it should be legal anyway. >> it is unreasonable for users to force exclusively encrypted communication >Hard disagree. That's like saying it's unreasonable to expect cable modem routers to come with firewalls or websites to default to HTTPS. I think it's rather unconscionable that the opposite is the case: we had too many years of wifi routers come to market that were unencrypted by default. This is no justification for the methodical exploitation of this lack of security. This is only relevant to whether also OSs and ISPs/router manufacturers should have done better.

by afiori 6y ago

shadowgovt 6y ago

I'm talking about the moral / "common sense" space. If you want to get into the legal space, the FCC's finding in Google's case is that it can't be considered "wiretapping" to observe and record publicly-broadcast, unencrypted data. Discussion on the topic: https://www.wired.com/2012/05/google-wifi-fcc-investigation/ https://www.wired.com/2012/05/google-wifi-fcc-investigation/ The relevant section of law: https://www.law.cornell.edu/uscode/text/18/2511 https://www.law.cornell.edu/uscode/text/18/2511 "It shall not be unlawful under this chapter or chapter 121 of this title for any person... to intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public." The FCC interpreted unencrypted broadcast wifi to be such signals. ... and at least when I was a young hacker, learning at my mentor's knee, the expectation was to assume that if one neighbor could do it, an army of drones could. After all, we didn't put firewalls on our home routers because our neighbors could access our poorly-configured Windows defaults to back-door our machines; we did it because such machines would be co-opted into a bot-net by random anonymous hackers. Data being dumped out of your house into the street is in the commons. If one doesn't like that, one should probably take the most basic measures to stop doing that. It's naive to expect either the law or society to step in and stop people from picking it up; there's a whole radio hobby around what a person can hear with an antenna and a bit of quartz crystal, and both American law and American culture have been extremely consistent that it's not the listener's fault if they pick up something interesting.

afiori 6y ago
I am also talking about my common sense. The fact that we should expect something to happen is orthogonal to whether the one who made it happen was justified. In my common sense there are many factors in this story that play against Google: 1) the said army of drones 2) it is unreasonable for users to force exclusively encrypted communication 3) they clearly operated in a "let's collect as much as possible" rather than having a clear objective like for the SSID 4.1) they have collected potentially sensitive data from businesses connections not intended for the public space 4.2) they have collected private data from personal connection not intended for the public space. Overall what I see is that wifi is not as secure as I expected and Google (lawfully) exploited said lack of security with complete disregard to other's privacy. Many other points of view might be possible, but I believe this is a reasonable/valid way to interpret what happened.
- shadowgovt 6y ago
  > it is unreasonable for users to force exclusively encrypted communication Hard disagree. That's like saying it's unreasonable to expect cable modem routers to come with firewalls or websites to default to HTTPS. I think it's rather unconscionable that the opposite is the case: we had too many years of wifi routers come to market that were unencrypted by default. 4.1 doesn't agree with the law or common sense. Don't broadcast cleartext data if you don't intend it for the public space. TCP/IP packets or Morse code, the principle is the same. Expecting every radio receiver to know whether broadcast cleartext was "intended for the public space" is impractical, and both law and radio culture reflect that impracticality. Expecting the radio recipient to decide whether your data is intended for public space or not would be like replacing telephones with megaphones and then fining people for listening to conversations.
  - afiori 6y ago
    > Expecting every radio receiver to know whether broadcast cleartext was "intended for the public space" is impractical, and both law and radio culture reflect that impracticality. I agree, but I cannot agree that this can apply to google sniffing wifi packets. Google knew they were wifi packets, they knew those packets where intended for the "internet", they knew they were not addressed to them; it was not a generic radio transmission. It is a good argument for why it should be legal anyway. >> it is unreasonable for users to force exclusively encrypted communication >Hard disagree. That's like saying it's unreasonable to expect cable modem routers to come with firewalls or websites to default to HTTPS. I think it's rather unconscionable that the opposite is the case: we had too many years of wifi routers come to market that were unencrypted by default. This is no justification for the methodical exploitation of this lack of security. This is only relevant to whether also OSs and ISPs/router manufacturers should have done better.