Beware the wardriving menace
posted Jul 6th 2005 7:18PM
Now that the mainstream media have apparently run out of
bluesnarfing stories to stir up public
concern, they've turned back to an earlier "threat" — fiendish wardrivers out to purloin bandwidth for unknown and
nefarious purposes. As reported by the St. Petersburg Times, Benjamin Smith III was recently arrested in Florida for
"hacking into" an open WiFi network. According to the newspaper report, Richard Dinon, a St. Petersburg resident, saw
an SUV parked outside his home, with its driver "furtively hunched over his computer," and called the cops. Smith was
charged with unauthorized access to a computer network, a felony. While it's possible that Smith was using Dinon's WiFi
connection for some ulterior motive ("I'm mainly worried about what the guy may have uploaded or downloaded, like
kiddie porn," Dinon said. "But I'll probably never know."), the fact that he was arrested solely for using the network
should be enough to send a chill through anyone who has temporarily borrowed a neighbor's bandwidth while their own
router was being repaired. If stories like this one result in more users setting up WEP (and, yes, we know it's not
very secure, but it'll block "casual" intruders) on their machines, fine. If, however, every time we open a laptop in a
public place (some of which, like New York's City Hall Park, have public WiFi access), we're tagged as a potential
criminal, something truly valuable will have been lost.
[Via Slashdot]
I am sorry. JUST because a AP is open does not mean that:
1. The user did not mean it to be open
2. The user knows anything about it
It's wrong. Sure, they should secure thier home network, but it's still wrong.
check out some kids wardriving... it really is THAT easy...
http://joefilip.textamerica.com/?r=2765249
where does "intent" fall into this issue?
can any lawyers comment on what's wrong about using another persons wifi if it isn't secured... granted if someones door was unlocked, I wouldn't walk in -- but this is something that is broadcast and doesn't seem to apply to the notion of property?
The problem is that many people and businesses leave their routers open, intentionally allowing free access. How are you supposed to know which networks are okay to access and which aren't? Simply securing the network is like posting a big-ass "no wireless tresspassing" sign, and this guy--who invoked the "he might have used it for kiddie porn!" line simply to make himself look reasonable--did not bother to do that.
"tagged as a potential criminal, something truly valuable will have been lost."
Come on, it IS criminal. Without express permission it is criminal. You are not entitled to net service, regardless if your router is down or not. That was a rather pathetic rationalization Marc.
There is no simple way to broadcast whether or not the AP is supposed to open or if its accidently open.
When you go into your local store that advertises "free internet access" and you accidently use the guy upstairs' network, not theirs, are you still guilty?
Considering Panera Bread's (for example) Wi-Fi is prolly called Panera1 or something and the guy you accidentally hook into is prolly Linksys (or some other generic name since they weren't even wise enough to disable SSID broadcasting), yes, you are still guilty.
Christ: theft is theft. The end.
What happens when the notebook is set to auto-connect? Grandma gets arrested for connecting automatically to her neighbors wifi network.! Crazy world we live in.
If you have a wireless network and you don't want people on it, then secure it! I don't look for wireless networks but if I was out and about and did for some reason really really need to check something online, I don't think I should be arrested for tapping into an unsecured wireless network.
It is not necessarily "wrong" to "steal" bandwidth. The unanswered legal question is whether an open AP should be presumed by passers-by to be free for their use, or if it should be presumed to be secure. That presumption would be a key factor in determining the person's criminal intent. I would argue that because there are progressive service providers who do allow their customers to run open APs and there are progressive customers who do just that, we cannot expect someone on the street who sees an AP named "LINKSYS" to assume that they are committing a crime by signing on. Comparisons to breaking and entering (or even to hacking) are glib. A better (though still flawed) comparison is crossing an unmarked lot to get to your where you're going when there is no fence or signs. If someone is crossing the unmarked lot in order to rob the store in the middle of it, it's different than if that person is crossing a public park on their way home. That is, the answer depends on the circumstances, just as it does with open APs.
The policy question of whether open APs _should_ be presumed free is a separate one. There are so many benefits to and so few costs to everyone opening up their wireless APs. It is truly amazing that we can walk around on the street and be able to get information from thin air, at marginal cost. If express permission were required, we will, in fact, have lost something truly valuable.
"Christ: theft is theft. The end."
This is the kind of simplistic thinking that gets us into trouble with virtual goods. Loosen your mind's grip on words, and you will see more clearly that things are not clear.
Although it is definitely illegal, it really puts the defendant in a difficult situation. It's like leaving a $100 bill on the sidewalk then yelling, "Don't touch it! It's mine!" to anyone who makes a move for it.
Sure that's a poor comparison, but you should be able to grasp the idea of that one.
I think you meant Bryant Park in NYC, which is where free public internet access is offered.
This wouldn't have happened at all if Bennie Smith just used a convertible tablet pc to access the network, he wouldn't have looked as suspicious if it looked like a tablet and not a conventional laptop.
well, the dude was parked outside this guy's house for hours and after repeated pointed visits out to his car(seeing the guy snap his laptop shut hiding what he was doing) i can't say as i blame him for at least calling the cops to check it out. the idiot "warparker" should have moved on to greener pastures. idiot.
We offer free wireless at many of our library locations. We welcome people to use it... even from the curb. Does this mean we are going to be responsible for possible entrapment?
I can understand if I put security on, and someone breaks it... but when it is open and available without security??? umm,yeah
if you breath the air that blows of my yard, are you stealing somthing from me?
On a recent trip I stayed in a bed and breakfast that had free wireless internet for the guests. They were using a LinkSys WRT54G just like the one I have at home and they hadn't even bothered to change the default password on the thing.
On my home network I have the MAC filtering set to only allow certain clients to connect. That should be a bit more secure than WEP. Of course in my neighborhood I am the one the other people with wireless networks should worry about. I haven't bothered trying to break my neighbors WEP yet but I can pick up 3 other wireless networks from my front porch. Sometimes I can get a 4th but 3 of them are using the same channel so the interference is pretty strong.
wow.
this is the first story i read as soon as i got some "borrowed" internet working from some unknown wifi source somewhere near my house.
haha, stupid fcukers.
"'Christ: theft is theft. The end.'
This is the kind of simplistic thinking that gets us into trouble with virtual goods. Loosen your mind's grip on words, and you will see more clearly that things are not clear."
you have have left your water pipes in your apartment unsecured. i have diverted them to my house next to your apartment building. i now have free water and you are paying for it.
are you ok with that? are you ok with it costing the landlord and the city money?
Ok, first thing the guy who owned the network should have done is secure it. Its his responsibility. If he noticed that someone was using it, turn on the protection. Second, wireless is an electromagnetic wave. And the only way to stop people from using it is to get educated. Suppose someone used the light from his house to see in the dark, is he going to have that person arrested because he paid for the light and now someone else is using it. How about smell, is he going to arrest someone because they had a whiff of his $20 steak that he bought. The point is, if the guy had a big deal about the broadcasting and knew that someone was using it without his permission, control it. If he is broadcasting without protection, then the fault lies with him.
Only Florida would make a felony out of this kind of activity. They should go back to poorly administered (and used) 1950s-technology voting systems and redefining the term "persistent vegetative state." Clearly complex technology like Wi-fi is beyond their ken.
What about the fact that this is on a open spectrum? The water pipe analogy doesnt really line up with this since those can be defined as someones property. Can you own the RF in the air?
Oh, and this guy is a dipshit for comming back for hours at a time.
I look at WiFi the same way I look at Water!
If the guy next door is watering his lawn and was CARELESS enough to set his sprinkler so that the water he PAID for waters my lawn as well, I'm going to use that water.
If the owner of an AP is CARELESS enough to just plug it in and leave it like that then I will use the bandwidth he PAID for in the same way.
I have even gone as far as attaching to their printer and printing out "SECURE YOUR NETWORK!" on AP's where everything is default including their home network settings (Translated: MSHOME).
Network security is a responsibility that you assume when you create a network. Dont take it lightly!
BTW my access point is open for any to use but don't expect screaming results on the dhcp addresses.
-Obie
I live in the college student ghetto appartment with hundreds of people packed in, and flipping open my laptop finds me at least 20 networks that are not secured... mine has WEP, and i named the network with my apartment number, so anybody interested can wander by and ask to use it... several people have in the last year, and some even have been willing to slide $5 or $10 bucks under the door every month to help offset the costs... the fact is, you dont need to be getting people arrested for this stuff.
That being said, i dont like any of the examples people have used thus far to show why this IS or ISN'T stealing... is the dude a burglar? Hardly... he didn't even get on his property. Even #14's example of air in a yard is a bit off... the fact is, the guy was ON THE STREET. I think the closest example is if my sprinkler was spraying in to the street, and he decided to pull over and get a drink, or wash his car, or whatever. In such a case, it should be up to ME to make it so he doesn't have access to my water (WiFi) while he is on public property by moving the sprinkler (WEP or MAC security measures) so he can't get to it without really infringing on me.
And thats just if i care if he's running thru my sprinkler / using my Wifi... and if i did, i probably wouldn't have it spraying the street to beging with.
goin around nyc.. using peoples wifi instead of the $6/hour wifi's that are set up is quite a luxury to have.. if that's taken away so easily, it's a sad day-- but i must say, there's quite a difference between sitting in ur house and catching ur neighbor's wifi and sitting in front of their house in a van... the latter deserves some sort of punishment, just creepy.
but if you park in front of my house, in a van- using my wifi.. that's fine with me, i'll slash ur tires, but u can use my wifi..
LaTa
#7 the ssid really isn't a good excuse. Like someone else mentioned..there are tons of places providing free access that just use an off the shelf router and don't bother configuring it. I guy I went to school with just recently opened up an internet cafe downtown (I live in a small city)that offers free internet and free wifi access to anyone that walks in, you don't even have to make a purchase... I was talking to him about it one day and realized he wasn't that computer savvy when i found out he just put a linksys access point in the back and left it completly open. Sitting inside with my laptop its pretty obvious which access point is his but sitting outside at the tables there were atleast two others i picked up with default names like "netgear."
This isn't the best analogy either... but I'm gonna throw it out there anyhow. Maybe it's our smalltown mentality, but lots of places have free candy. you go to the bank or the credit union.. and they both have a bowl of candy on the counter for the kids. Go to the chinese restaurant or this other family restaurant, and they have mints on the counter when you're leaving. Oh, and the doctors office even has lollypops for the kids. Go to any of these places and they're not going to mind if you grab a piece of candy or a mint off the counter on your way out... thats what it's there for. But go to the grocery store, and they have bins of the same mints, lollypops, and mixed candy... with a price tag on them. Take candy from there w/o paying and you will get charges pressed. I'd say the WEP or other security is like the price tag on the candy... its a sign that says this internet access isn't free or isn't meant to be shared.
unless they can prove a crime was committed with the internet connection, i'd say he's off the hook.
If you have an open AP I'll use it, STFU I don't want your junky files just internet, and also if you don't want people on your network do what I do, enable WPA which (since I last checked) is not crackable like the older WEP. So :p !!!
Sorry guys, I gotta come down on the side of the homeowner on this one.
If a homeowner leaves their front door unlocked, that does not render their premises a public space. Trespassing is trespassing, irrespective of the fact that one medium is electronic and the other is physical.
Having said that, I *would* support penalties f/people that fail to secure their wireless network, much like you can/will be penalized if your car is stolen and you left the keys in the ignition.
This guy was loitering outside of a stranger's house for *hours*.
Damn straight I'd call the cops.
But oh, free internet is involved so we all have to side with the dumbass in the driveway. Open wifi or not, the dude is loitering.
I don't get how people compare car theft and (keys in the ignition or not) or entering somebody's house (door unlocked or locked) to this... the fact is, in those cases, you are on / in somebody elses property.
If this is the way the world is going, somebody could set up a cell tower on their roof, put nothing in place to prevent somebody from using it, and then have them arrested if they drive thru the area and make a call. Latching on to a signal BROADCAST on to public area like a street DOES NOT COMPARE to me walking up to your house, finding it unlocked, and walking on in.
Most APs out there today have built-in firewalls, MAC filtering, WEP preferences, and the ability to not broadcase the network name, It does not take that long to set things up, and of course one needs to RTFM!
If you do not take steps to secure your property (which you paid for) then it's your problem.
The way that I see it is like this: If I am standing on the sidewalk - a publilc place, and I get your signal - I will use it. I will not come onto your lawn or come into your house - that is tresspassing. I will not access your computers on the network, or your networked printer - but I will use your bandwidth because I am in a public place, it is free and you are broadcasting beyond your property - period.
Andrew: That's a false analogy. An unsecured WiFi network is still a *private* home network. A cellular tower facilitates access to a public network (unless, of course, it's a private cellular network, in which case accessing it w/o permission *would* be trespassing).
In the simplest terms, the radio waves are analogous to the sidewalk outside of someboby's house, and the WiFi router is analogous to their walkway/front door. The minute you step onto their walkway or enter their front door (WiFi router) univited, you are *trespassing*. Get it? It's not the radio waves that you're disallowed from using, it's the person's *hardware* that you trespassing on.
mini-me: I bet you'd be talking out the other side of your face if you arrived home one day to be confronted with a total stranger sitting in your livingroom watching TV. Their rationale? "Hey, I can miss my soaps, now, can I? Look, the door was unlocked. It's not like I'm stealing anything! If you leave your front door unlocked, you deserve to have complete weirdos trespass on your property and squat in your home." Don't be an idiot.
I'm glad someone else pointed out that entering your house through an unlocked door is trespassing. And I liked the sprinkler scenario; as far as the signal goes, it's being accessed beyond your property lines, and it's going beyond your property lines due to your neglect.
What bothers me is a wire-tap scenario. An older idea of this same concept is someone climbing a phone pole and hooking a split onto your cable line. Does anyone know if that's a felony? Or even a crime? It occurs off your property, and it's using bandwidth that you paid for.
#18:
"you have have left your water pipes in your apartment unsecured. i have diverted them to my house next to your apartment building. i now have free water and you are paying for it.
are you ok with that? are you ok with it costing the landlord and the city money?"
Your argument is fundamentally flawed, in that you are comparing a physical substance to electronic media. In your example, the presumption is that the person you're stealing water from pays for their water per usage. This isn't the case with most broadband ISPs.
The point I'm making is this: What exactly are you stealing, when you "steal" internet access? Assuming the intention is benign, and the "purpetrator" is simply using the internet for innocuous reasons, no one is harmed from these "thefts" of bytes.
The only way I could justify convicting someone of "theft" is if the "thief" accessed private documents on the network he connectect to. Even then it's not really theft; more like invasion of privacy. And, depending on the nature of their invasion, it might go from there to other computer crimes.
But... Theft?
I can't believe how short sighted some people posting here are. Water, unlocked car, unlocked house, etc. These people are broadcasting their network into the street and neighboring homes. You don't need to encroach on their property to use it.
I can access my neighbor's network from INSIDE my house. I helped him secure it but he had problems adding another laptop so now it's open again. Not my fault! A few weeks ago, I upgraded to Tiger and my laptop automatically picked his AP instead of mine. Again, not my fault!
In legal terms, quantum meruit means implied consent. If you go outside and see someone mowing your lawn with Joe's Lawn Service on the side of their truck and they see you see them and you don't tell them to stop, you are obligated to pay them...by law.
If some dumbass leaves his network open, he is giving implied consent to use it. Now if someone is using it for illegal activity, they should be prosecuted for the illegal activity.
Eventually, the courts will come to the same conclusion and the responsibility will then fall on the homeowner to secure their networks.
Setting up an open AP is like putting a webserver on the Internet. Can there be a reasonable expectation that no one will connect to a publicly available service?
Furthermore, I would argue that Mr. Smith was specifically granted permission to access Mr. Dinon's network. Technically speaking, Mr. Smith's laptop requested access to the network in question and the AP responded by giving him an IP address and allowing him to associate. It is the digital equivalent of, "Come on in!"
Not only that, but there's really three levels of permission explicitly being granted here:
1. Laptop "sees" AP broadcasting it's availability to the world.
2. Laptop "asks" the AP for access.
3. AP grants access to to the wireless network (explicitly granted permission #1).
4. Laptop "asks" AP for an IP address.
5. AP responds to the laptop's request by granting it an IP address (explicit permission #2).
6. Laptop "asks" for it's packets to be routed through the gateway (usually the same device as the AP).
7. Gateway allows the laptop access to the Internet (explicit permission #3).
Enabling the most basic form of security is trivial for a wireless access point. By not taking this simple step, Mr. Dinon explicitly granted permission to use his network and any suggestion that Mr. Smith was trespassing or "stealing" is simply unfounded.
Ignorance is not a reasonable excuse. Even if it were, the responsibility lies in the hands of the AP owner, not the passer-by.
It does not matter that the homeowner did not set up his AP with any encryption or MAC filtering, because most people would not or do not set it up either for whatever reasons they have. The only thing that matters is that there was someone outside his house loitering.
I can not side with the homeowner with regard to protecting his AP because he chose not to set it up with encryption.
If you live at a neighborhood intersection and someone passes by your house and stops at the stop sign, you may not think anything of it, as long as their vehicle is still running. Maybe they're fumbling for a different CD or sunglasses or something. If they have a laptop with them, by default Windows (if that's what they're using) will try to auto-associate with the network. It is for that reason that I can not side with the homeowner.
Prosecute him for loitering, trespassing, or whatever you want, but remove the computer crime bit; it's getting a bit ridiculous. And secure your wireless networks!
I think that stealing wifi--i.e. taking it without some sort of explicit permission--counts as stealing from a moral point of view, and should count from a legal point of view as well. However, it is a very slight crime, whose analogousness to other kinds of property and trespassing crimes is weakened by several considerations:
(1) Why do I think it counts as stealing/trespassing? I think it is something like #10's comparison with walking through a vacant lot. Of course, this is trespassing in a legal sense. Moreover, I think most people have a sense that it's unethical as well, as witnessed by the fact that most adults will take the sidewalk instead as long as it's not too much further. However, as #10 says, no one thinks that this is a very heinous offense. Wifi trespassing is like this, except even less egregious. This is because, with a vacant lot, the reasonableness of the presumption "The owner won't mind if I cut across!" is mitigated by the knowledge that the owner MIGHT mind but just can't afford a fence. On the other hand, every wireless router comes with your choice of very easy-to-erect electronic fences. So, when one is not up, I think that the "The owner won't mind if I borrow some wifi!" is even more reasonable than in the vacant lot case.
(2) Stealing wifi is not like stealing water, as #18 says, because the wifi subscriber pays a flat fee whether he uses 1% or 99% of his allotted bandwidth, while the water "subscriber" will have a higher bill if the tap is on all day. By this token, we ought to frown upon someone who steals so much bandwidth from a single subscriber that the subscriber has to pay the ISP more money. But I think everyone would agree on this policy, regardless of what you think in more extreme cases.
(3) Most people don't even come close to using all their allotted bandwidth most of the time. This is especially true for those individuals who aren't even savvy enough to set up some rudimentary security on their wireless router. So you're just taking something that would, in essence, be "throwing away" anyway. Is my local hobo stealing from me when he digs for aluminum cans through the bag of recyclables I left at the curb? Well, legally I'm not sure (see http://www.fightidentitytheft.com/shred_supreme_court.html). Morally? Only in a very limited sense. I don't care if he violates my Ownership Rights in this way if he doesn't make a mess. Likewise, a reasonable individual won't mind if internet-bums take his bandwidth-garbage, as long as they don't make a kiddie-porn-mess.
Some people might want to conclude, from the kinds of considerations in (2) and (3), that wifi borrowing is not morally reprehensible at all. I think this is outweighed in part by the considerations in (1). What's more, I think we would surely all agree that running a server, or some other bandwidth-hungry activity, on borrowed wifi. Since it's impossible to decide where to draw the line between egregious and reasonable borrowing, it makes the most sense to draw it at zero. Thus even taking a little bit of bandwidth should count as theft. But this is a very petty and probably victimless crime that ought to be enforced something like speed limit laws--where 1 mph over the limit rarely gets you a ticket in isolation. Except without the quotas.
xVariable, The router is the walkway. The door is an attempt at security. Just using the walkway is not trespassing. Passing the door is.
"If a homeowner leaves their front door unlocked, that does not render their premises a public space. Trespassing is trespassing, irrespective of the fact that one medium is electronic and the other is physical."
Although it is true that can't walk into someone's open home, you absolutely have the right to look through their door/window into their home from the street. Just as it is legal to sip their water that lands on the street, smell the scent of their roses on the street, use their radiowaves/wifi on the street, etc.
BTW the loiteing issue is a separate issue from the "theft".
The minute you encroach on someone's property (whether it's their house, their car, or their computer network - it IS physical property) w/o permission you are, by legal definition, trespassing. That reality doesn't even factor in related computer crimes, which CAN be a federal offense in the US.
You guys can believe whatever you like. Personally, I can't wait to see the laws on this issue enforced as they should be. That is, seeing freaks that somehow think they can rationalize trespassing on someone's private property for their own warped, nefarious purposes, come smack-up against the bitch-slapping, cold hard reality of the law enforced. What makes you guys think all that's required to get away with immoral/unethical/illegal behavior is to make some illogical, undefensible rationalization, and suddenly it's A-OK? It really IS no wonder the world is so f*cked-up, given how apparently easy it is for so many people to turn off their conciences whenever it suits them.
If it is dark outside and I use the light from your door step to read the time off my watch, which I am reading from the sidewalk, am I stealing electricity from you?
I think of it as growing a fruit tree. If my lemon tree grows to the sidewalk, and someone can pick the fruit, it's not stealing. If I see a lemon tree in the middle of an open field, and no one claims it, it is not stealing.
If I post a sign that says no picking, or, if I lock the gate and grow the tree in a farm, then it is stealing.
Air specturm is free, just like the fruits that grows on a tree, unless someone specifically protects it.
Obie: the router is someone's PHYSICAL property. The moment you access it w/o permission, you are trespassing. Your analogy is false since in it, you aren't actually physically accessthe walkway (just looking up it, whereas with the router, you ARE gaining actual physical access to it Honestly, the complete lack of respect for the rule of law you guys are displaying is the most anti-social, repugnant BS I've seen in a while. It's pretty pathetic that you don't see where your logic falls flat.
Heres my perpesctive (oh goody!):
Loitering is bad and the guy shouldnt have done that, but i dont think him using the guys open internet is theft or even hacking as the article says. OK. And another analogy:::
If you put your social security # in your trash can and then put your trash can at ur curb, anyone can legally go to your trash can and take your ssn, but its a crime to use it fraduantly (ident theft).
So, if you put your internet out there, anyone should be able to legally use it, but doing anything illegal (kiddie porn) is a crime.
also, lets say a 7 year old with a psp is sitting in his grass and his parents have no internet. Well he finds that he can play his game on the internet and the psp says there is a internet connection close by and that he can use it to play his game. Did the kid break the law by using someone elses internet?
Hm... using the fruits analogy, I'm reminded of the tragedy of the commons. http://en.wikipedia.org/wiki/Tragedy_of_the_commons
But really, if you are really afraid that someone is going to steal your bandwidth, just lock it up. Otherwise, it does the world a lot of good if we all share a litte.
It's going to be amusing watching these dumb excuses fail in court.
"But judge, it's just like picking fruit from the sidewalk!"
Yeah, that'll work... Not. Guilty! Next! Enjoy jail, thieving scum.
xVariable, yes the router is the owners physical property. If you break into the house and steal it, you've broken the law.
They have the option to tell the router (physical property) to reject any user that does not know the password but instead give the router permission to allow any computer. They, in essence, have given anybody permission to use their network. It's called 'implied consent.'
This guy in the van, if not convicted of a computer crime, will go free on appeal. It is the responsibility of the network owner to secure the bandwidth or prevent the bandwidth from extending into public property.
/Not guilty...
#6, jcblack - "There is no simple way to broadcast whether or not the AP is supposed to open or if its accidently open," but why not? It would be easy enough to add a tag that by default says, "this was a mistake." If the user switches it to say "feel free," then you know you're okay.