9 ms·

Sniffing open WiFi networks is not wiretapping, judge says

48 points by nswanberg 14y ago

aidenn0 14y ago
Hasn't receiving radio signals sent "in the clear" always been legal? That confused me with the Google case too. There are exceptions, particularly surrounding cars (radar detectors, police scanners are both illegal in cars in some states) [edit] The issue isn't receiving, it's recording, duh!
rosser 14y ago
How is sniffing open WiFi networks different from standing in earshot of a conversation being held in public?
- aidenn0 14y ago
  Your comment made me realize why my comment was wrong: the issue isn't listening in, the issue is recording. Recording someone else's conversation without the permission of a participant is illegal in most states.
  - dmishe 14y ago
    What if you memorise it and then put on paper?
  - rosser 14y ago
    Exactly. Even in the "one-party" consent states (which is most of them), where a conversation, phone or otherwise, can be recorded if only one of the participants is aware of the recording, it's illegal almost everywhere to record a conversation you're not a party to.
  - tedunangst 14y ago
    What about recording the police beating somebody on the sidewalk?
    - rosser 14y ago
      I wasn't aware that the intersection of truncheons and skulls was a "conversation".
      - tedunangst 14y ago
        The policeman is likely to be saying something. And his focus is on the victim, and therefore unaware of the recording. So do we still think that should be illegal to record?
        dllthomas 14y ago
        A policeman operating in the course of his duties has a modified set of permissions, rights, and restrictions.
        tedunangst 14y ago
        The policeman having more restrictions does not automatically mean you have fewer restrictions. Your recording is also likely to pick up the conversation of the people nearby saying "hey look at that".
        rosser 14y ago
        What the people nearby are saying is incidental to the thing you're actually recording, though. It's the same thing as, or very similar to taking a video while you're on vacation: the police aren't going to bust down your door and haul you away because your camcorder's mic happened to pick up a conversation between the people standing three feet away from you. When you break out a parabolic mic and start recording conversations from 30 meters away — without the knowledge or consent of the people having that conversation — however, you're doing something that's at best creepy, and probably also illegal. EDIT: It would also probably be illegal to, in the course of taking your vacation video of whales breaching or whatever, instead start specifically recording a conversation happening nearby. IANAL, but I think the distinction has more to do with what you intend to record than what you happen to record. You don't have a "reasonable expectation of privacy" in public, but you do have a "reasonable expectation" of not being deliberately and specifically recorded by some random creeper while out in public. EDIT 2: Further, with as often as it happens, and pursuant to the DoJ's own statements on the subject, the police don't have a "reasonable expectation" of not being recorded when they're going about their jobs — particularly when, in the course of executing said job, they end up beating someone into unconsciousness...
  - joshAg 14y ago
    I think that it is legal to record someone else's conversation without permission if it is in public, since there is no expectation of privacy in a public place.
    - mattmanser 14y ago
      But there is in this case, you have to take extraordinary steps and specifically ask your network card to enter a special mode to start recording these conversations. They aren't public at all as there is an expectation at the protocol level that you ignore the message that aren't intended for you. And they're explicitly flagged that they're not for you. You're opening mail addressed to someone else and you know you're doing it. It's not legal to start opening other people's mail because it's lying in the same hallway as yours. This is exactly the same thing. This judge just doesn't understand that. The legal expert is right, the judge will end up with egg on his face. Why they don't just do a bit of street theatre like 'Here is a letter addressed to the judge. Because of the way the postal system works I got it as well. I am now opening it and reading it. Is this ok? No. Of course not. It's not for me. This is exactly what they deliberately did but it's just digital.'
      - anigbrowl 14y ago
        You're opening mail addressed to someone else and you know you're doing it. It's not legal to start opening other people's mail because it's lying in the same hallway as yours. This is exactly the same thing. No it isn't, because the mail is in a closed envelope whereas unencrypted activity over wifi is equivalent to a public conversation that can easily be overheard. The steps required to sniff open traffic are hardly extraordinary. Why they don't just do a bit of street theatre like 'Here is a letter addressed to the judge. Because of the way the postal system works I got it as well. I am now opening it and reading it. Is this ok? No. Of course not. It's not for me. This is exactly what they deliberately did but it's just digital.' Well, no. If traffic is not encrypted then it is public in the same manner as a postcard. It's illegal to open people's mail, but you can't practically prevent people reading what's written on a postcard.
        14y ago
- smokinjoe 14y ago
  I see this more analogous to walking into an unlocked house. While the doors are all unlocked, it's still illegal to open, enter and search.
  - laserDinosaur 14y ago
    Except this isn't a house, this is wifi. Driving around picking up wifi signals from public networks through automated systems is very different. I've seen nothing but crappy analogies since this whole thing started.
    - smokinjoe 14y ago
      Picking up wifi signals is one thing, but I was under the impression that they were locating, connecting and looking at data on these networks. >Legal scholar Orin Kerr disagrees with Judge Holderman's reasoning. "No one suggests that unsecured wireless networks are set up with the goal that everyone on the network would be free to read the private communications of others," he wrote. "In my view, that ends the matter: the exception doesn’t apply, and the interception of the contents of wireless communications is covered by the Wiretap Act." And I don't see how automating the process makes it any better. You're still accessing someone's private (albeit unsecured) network. However, I take my analogy back if this doesn't include actual analyzing of data packets within the unsecured network.
      - laserDinosaur 14y ago
        "You're still accessing someone's private (albeit unsecured) network." I guess that's the whole issue right there - Is something that is being broadcast, possibly 40m outside my house, still private? At what point does a signal become so large that it defaults to a public broadcast? To me it makes sense that if I access your wifi, but can only get that signal by standing in your house, by all reasoning that is a private network. However if I can stand on a street corner and still access your signal, it's public. Of course I guess with strong enough hardware you could access both regardless, so I really don't know.
- deleted 14y ago
  [deleted]
- jlgreco 14y ago
  How is standing on the sidewalk watching people in their homes with a FLIR gun any different than watching people normally? The important part is what people expect to be private.
  - ddunkin 14y ago
    If you're shouting your password at your roommate loudly, and a neighbor overhears it, then how is that really snooping? Once the extremely loud signal leaves your property, I'm not sure you can be responsible for that data. It doesn't take any sort of high-end equipment to intercept this data, it's being thrown at us constantly.
    - jlgreco 14y ago
      What really is the difference between a FLIR gun and a wifi card in promiscuous mode? Both do nothing more than pick up non-visible light and are widely available, but both are still magic to the layman. Hell, a FLIR gun is even easier to use, you just point it like any other camera. Is the important difference to you really price? Yes, unprotected wifi can be trivially snooped. But that is now what people expect.
      - 001sky 14y ago
        What really is the difference between a FLIR gun and a wifi card in promiscuous mode? The person that claims a right to privacy needs to take reasonable steps. Behind a solid wall, is a reasonable step to take. As is building a wall. Failing to secure your network, that you set up to "broadcast" in open mode, is arguably different.
        jlgreco 14y ago
        To you or I, yes; securing your wireless network is obvious. Can you really say that about the general population? Certainly there is a non-trivial portion of that population, if not a majority, that lacks an understanding of the mechanics behind how wifi works. Even more technically inclined users may reasonably be under the impression that MAC filtering, hidden SSIDs, or WEP provide privacy. Why should any of these people be any less deserving of privacy than the rest of us? Knowledge of the basic properties of visible light is built into most of us. The laws were written with that in mind. However you cannot say the same about wifi.
16s 14y ago
It's a radio signal. It's broadcast and if you are in range, you can tune in and listen. There's no possible way this can be construed as "wiretapping".
- wglb 14y ago
  If you are in line with a telephone microwave tower and have the appropriate radio, you are able to tune in and listening. That does not make it not wiretapping.
- rosser 14y ago
  Intercepting cellular signals, even before they've hit the tower and are being transmitted on actual wires is still wiretapping.
  - deleted 14y ago
    [deleted]
  - joshAg 14y ago
    cell signals are encrypted, though, aren't they?
    - sp332 14y ago
      It's illegal either way. But to answer your question: GSM and CDMA have weak encryption. GSM at least has optional encryption, and your phone won't tell you if it's being sent in the clear.
      - magicalist 14y ago
        It's actually not (edit: it actually is illegal either way for cell signals in particular, see below), according to federal code. We'll have to dig up some old cordless phone interception cases, but if you weren't trying to defraud the intercepted line (like racking up a bill), you're more or less in the clear. California and other states had stricter laws about telephone conversations in particular, but as others have noted: when laws are particular about their domain, that almost always means they are not applicable by analogy elsewhere. Edit: ah, someone in the Ars comments brought up a good point: cell phone frequencies are specially regulated and auctioned by the FCC, and intercepting them is indeed prohibited (by my reading at least). Since your connection to your cordless phone base station is itself not a common carrier, though, it is considered publicly accessible (by federal code), and so it is not illegal to intercept it (when it's not encrypted).
confoosed 14y ago
So if all traffic including wifi was encrypted with very strong crytography, that's OK? If we show people using computer networks for communication (i.e. billions of people) how to use strong cryptography, that might not be good? Bad guys might use cryptography. So we should keep all traffic open to sniffing? Plus, keeping traffic unencrytpted creates jobs, doesn't it? e.g., with companies that do data mining and such. It might deny innovative companies like Google the ability to gather data and improve their services. It's all so confusing.

48 points by nswanberg 14y ago

Hasn't receiving radio signals sent "in the clear" always been legal? That confused me with the Google case too. There are exceptions, particularly surrounding cars (radar detectors, police scanners are both illegal in cars in some states) [edit] The issue isn't receiving, it's recording, duh!

rosser 14y ago

How is sniffing open WiFi networks different from standing in earshot of a conversation being held in public?

aidenn0 14y ago
Your comment made me realize why my comment was wrong: the issue isn't listening in, the issue is recording. Recording someone else's conversation without the permission of a participant is illegal in most states.
- dmishe 14y ago
  What if you memorise it and then put on paper?
- rosser 14y ago
  Exactly. Even in the "one-party" consent states (which is most of them), where a conversation, phone or otherwise, can be recorded if only one of the participants is aware of the recording, it's illegal almost everywhere to record a conversation you're not a party to.
- tedunangst 14y ago
  What about recording the police beating somebody on the sidewalk?
  - rosser 14y ago
    I wasn't aware that the intersection of truncheons and skulls was a "conversation".
    - tedunangst 14y ago
      The policeman is likely to be saying something. And his focus is on the victim, and therefore unaware of the recording. So do we still think that should be illegal to record?
      - dllthomas 14y ago
        A policeman operating in the course of his duties has a modified set of permissions, rights, and restrictions.
        tedunangst 14y ago
        The policeman having more restrictions does not automatically mean you have fewer restrictions. Your recording is also likely to pick up the conversation of the people nearby saying "hey look at that".
        rosser 14y ago
        What the people nearby are saying is incidental to the thing you're actually recording, though. It's the same thing as, or very similar to taking a video while you're on vacation: the police aren't going to bust down your door and haul you away because your camcorder's mic happened to pick up a conversation between the people standing three feet away from you. When you break out a parabolic mic and start recording conversations from 30 meters away — without the knowledge or consent of the people having that conversation — however, you're doing something that's at best creepy, and probably also illegal. EDIT: It would also probably be illegal to, in the course of taking your vacation video of whales breaching or whatever, instead start specifically recording a conversation happening nearby. IANAL, but I think the distinction has more to do with what you intend to record than what you happen to record. You don't have a "reasonable expectation of privacy" in public, but you do have a "reasonable expectation" of not being deliberately and specifically recorded by some random creeper while out in public. EDIT 2: Further, with as often as it happens, and pursuant to the DoJ's own statements on the subject, the police don't have a "reasonable expectation" of not being recorded when they're going about their jobs — particularly when, in the course of executing said job, they end up beating someone into unconsciousness...
- joshAg 14y ago
  I think that it is legal to record someone else's conversation without permission if it is in public, since there is no expectation of privacy in a public place.
  - mattmanser 14y ago
    But there is in this case, you have to take extraordinary steps and specifically ask your network card to enter a special mode to start recording these conversations. They aren't public at all as there is an expectation at the protocol level that you ignore the message that aren't intended for you. And they're explicitly flagged that they're not for you. You're opening mail addressed to someone else and you know you're doing it. It's not legal to start opening other people's mail because it's lying in the same hallway as yours. This is exactly the same thing. This judge just doesn't understand that. The legal expert is right, the judge will end up with egg on his face. Why they don't just do a bit of street theatre like 'Here is a letter addressed to the judge. Because of the way the postal system works I got it as well. I am now opening it and reading it. Is this ok? No. Of course not. It's not for me. This is exactly what they deliberately did but it's just digital.'
    - anigbrowl 14y ago
      You're opening mail addressed to someone else and you know you're doing it. It's not legal to start opening other people's mail because it's lying in the same hallway as yours. This is exactly the same thing. No it isn't, because the mail is in a closed envelope whereas unencrypted activity over wifi is equivalent to a public conversation that can easily be overheard. The steps required to sniff open traffic are hardly extraordinary. Why they don't just do a bit of street theatre like 'Here is a letter addressed to the judge. Because of the way the postal system works I got it as well. I am now opening it and reading it. Is this ok? No. Of course not. It's not for me. This is exactly what they deliberately did but it's just digital.' Well, no. If traffic is not encrypted then it is public in the same manner as a postcard. It's illegal to open people's mail, but you can't practically prevent people reading what's written on a postcard.
      - 14y ago
smokinjoe 14y ago
I see this more analogous to walking into an unlocked house. While the doors are all unlocked, it's still illegal to open, enter and search.
- laserDinosaur 14y ago
  Except this isn't a house, this is wifi. Driving around picking up wifi signals from public networks through automated systems is very different. I've seen nothing but crappy analogies since this whole thing started.
  - smokinjoe 14y ago
    Picking up wifi signals is one thing, but I was under the impression that they were locating, connecting and looking at data on these networks. >Legal scholar Orin Kerr disagrees with Judge Holderman's reasoning. "No one suggests that unsecured wireless networks are set up with the goal that everyone on the network would be free to read the private communications of others," he wrote. "In my view, that ends the matter: the exception doesn’t apply, and the interception of the contents of wireless communications is covered by the Wiretap Act." And I don't see how automating the process makes it any better. You're still accessing someone's private (albeit unsecured) network. However, I take my analogy back if this doesn't include actual analyzing of data packets within the unsecured network.
    - laserDinosaur 14y ago
      "You're still accessing someone's private (albeit unsecured) network." I guess that's the whole issue right there - Is something that is being broadcast, possibly 40m outside my house, still private? At what point does a signal become so large that it defaults to a public broadcast? To me it makes sense that if I access your wifi, but can only get that signal by standing in your house, by all reasoning that is a private network. However if I can stand on a street corner and still access your signal, it's public. Of course I guess with strong enough hardware you could access both regardless, so I really don't know.
deleted 14y ago
[deleted]
jlgreco 14y ago
How is standing on the sidewalk watching people in their homes with a FLIR gun any different than watching people normally? The important part is what people expect to be private.
- ddunkin 14y ago
  If you're shouting your password at your roommate loudly, and a neighbor overhears it, then how is that really snooping? Once the extremely loud signal leaves your property, I'm not sure you can be responsible for that data. It doesn't take any sort of high-end equipment to intercept this data, it's being thrown at us constantly.
  - jlgreco 14y ago
    What really is the difference between a FLIR gun and a wifi card in promiscuous mode? Both do nothing more than pick up non-visible light and are widely available, but both are still magic to the layman. Hell, a FLIR gun is even easier to use, you just point it like any other camera. Is the important difference to you really price? Yes, unprotected wifi can be trivially snooped. But that is now what people expect.
    - 001sky 14y ago
      What really is the difference between a FLIR gun and a wifi card in promiscuous mode? The person that claims a right to privacy needs to take reasonable steps. Behind a solid wall, is a reasonable step to take. As is building a wall. Failing to secure your network, that you set up to "broadcast" in open mode, is arguably different.
      - jlgreco 14y ago
        To you or I, yes; securing your wireless network is obvious. Can you really say that about the general population? Certainly there is a non-trivial portion of that population, if not a majority, that lacks an understanding of the mechanics behind how wifi works. Even more technically inclined users may reasonably be under the impression that MAC filtering, hidden SSIDs, or WEP provide privacy. Why should any of these people be any less deserving of privacy than the rest of us? Knowledge of the basic properties of visible light is built into most of us. The laws were written with that in mind. However you cannot say the same about wifi.

16s 14y ago

It's a radio signal. It's broadcast and if you are in range, you can tune in and listen. There's no possible way this can be construed as "wiretapping".

wglb 14y ago
If you are in line with a telephone microwave tower and have the appropriate radio, you are able to tune in and listening. That does not make it not wiretapping.
rosser 14y ago
Intercepting cellular signals, even before they've hit the tower and are being transmitted on actual wires is still wiretapping.
- deleted 14y ago
  [deleted]
- joshAg 14y ago
  cell signals are encrypted, though, aren't they?
  - sp332 14y ago
    It's illegal either way. But to answer your question: GSM and CDMA have weak encryption. GSM at least has optional encryption, and your phone won't tell you if it's being sent in the clear.
    - magicalist 14y ago
      It's actually not (edit: it actually is illegal either way for cell signals in particular, see below), according to federal code. We'll have to dig up some old cordless phone interception cases, but if you weren't trying to defraud the intercepted line (like racking up a bill), you're more or less in the clear. California and other states had stricter laws about telephone conversations in particular, but as others have noted: when laws are particular about their domain, that almost always means they are not applicable by analogy elsewhere. Edit: ah, someone in the Ars comments brought up a good point: cell phone frequencies are specially regulated and auctioned by the FCC, and intercepting them is indeed prohibited (by my reading at least). Since your connection to your cordless phone base station is itself not a common carrier, though, it is considered publicly accessible (by federal code), and so it is not illegal to intercept it (when it's not encrypted).

confoosed 14y ago

So if all traffic including wifi was encrypted with very strong crytography, that's OK? If we show people using computer networks for communication (i.e. billions of people) how to use strong cryptography, that might not be good? Bad guys might use cryptography. So we should keep all traffic open to sniffing? Plus, keeping traffic unencrytpted creates jobs, doesn't it? e.g., with companies that do data mining and such. It might deny innovative companies like Google the ability to gather data and improve their services. It's all so confusing.