1
00:00:07,470 --> 00:00:09,790
We have four panelists.

2
00:00:09,790 --> 00:00:11,590
Myself, I'm Matthew Shuckman.

3
00:00:11,590 --> 00:00:14,510
I'm one of the founders of WarDrivingWorld.com.

4
00:00:14,570 --> 00:00:20,430
We have RenderMan, a famous hacker and a superb war driver.

5
00:00:20,550 --> 00:00:28,190
We have Robert Hale, who's a lawyer from San Francisco, who's written on this subject of Wi-Fi and the law.

6
00:00:28,190 --> 00:00:35,770
And we have Frank Thornton, who is a former law enforcement official and, as well, a great hacker.

7
00:00:35,910 --> 00:00:37,970
So we'll give some different perspectives.

8
00:00:42,310 --> 00:00:47,350
Firstly, I'm going to ask if you can hold your questions until the end.

9
00:00:47,490 --> 00:00:52,630
We're only going to have about 40 minutes, so we'll try to get through it so we can leave a few minutes at the end for questions.

10
00:00:53,470 --> 00:00:56,450
Firstly, the definition of what is war driving.

11
00:00:56,930 --> 00:01:01,630
And the simple definition of what is war driving and whether you're walking around.

12
00:01:01,630 --> 00:01:06,190
There's been a lot of play with the verbs here, whether you're driving around, whether you're walking around.

13
00:01:06,190 --> 00:01:16,670
It's the act of having a laptop or a PC of some form and detecting other people's Wi-Fi signals and recording some information about them.

14
00:01:16,670 --> 00:01:26,150
The simplest case was recording the information that the access point is there, maybe the speed of transmission, and if you have a GPS, maybe the location.

15
00:01:26,870 --> 00:01:31,610
So, there's been a lot of talk of whether war driving is legal.

16
00:01:33,710 --> 00:01:37,650
So, there was a Doonesbury cartoon which covers this.

17
00:01:38,030 --> 00:01:41,310
And the question of, is war driving legal?

18
00:01:41,510 --> 00:01:47,390
There have been a number of articles in the newspaper where you've seen that people have been arrested for war driving.

19
00:01:47,490 --> 00:01:56,250
However, what I'll say is, with one exception, in each of those cases, the people who were arrested for war driving were doing something else.

20
00:01:56,470 --> 00:01:59,590
Some other nefarious activity, some crime.

21
00:01:59,830 --> 00:02:09,870
In this criminal activity, for instance, in one case in Toronto, the man was spamming child pornography, but using somebody else's Wi-Fi signal to get it out.

22
00:02:09,870 --> 00:02:17,390
We certainly can all agree that spamming child pornography is a crime, and it's really not the war driving that's the issue, it's the other crime involved.

23
00:02:17,390 --> 00:02:25,230
Another case involves two people who were grabbing credit card numbers off of a Wi-Fi signal near a retail store.

24
00:02:25,610 --> 00:02:30,370
We'd all certainly agree they're stealing credit card information, that's separate from the war driving.

25
00:02:30,470 --> 00:02:45,170
There's a recent case where a man in Tampa was outside of somebody else's house, and he was caught, the man went out, the resident of the house went out, found him outside and said, hmm, what are you doing here?

26
00:02:45,170 --> 00:02:46,330
But didn't say anything.

27
00:02:46,330 --> 00:02:54,370
He then went out, drove his girlfriend home, came back, the man was still sitting there in the van with the glow of a laptop screen, as the reports in the newspaper say.

28
00:02:54,370 --> 00:03:03,650
He called the police, the police came by, whoever this guy was was not so smart, he didn't leave after the first two times, and the police came by and they arrested him for war driving.

29
00:03:04,030 --> 00:03:11,810
We're not sure what else he was doing, we're not even sure what was on the screen, but when that case comes to trial later in the fall, maybe we'll know something about it.

30
00:03:11,810 --> 00:03:28,930
There are a variety of laws, both at the state and federal level, which cover accessing networks, both legal accessing of networks, and accessing a network that might not be yours, where it's an illegal activity.

31
00:03:29,410 --> 00:03:35,990
Some of these laws have been extended and will cover Wi-Fi access of networks, but not all of them.

32
00:03:35,990 --> 00:03:47,090
There have been some new laws that have been brought into play, which will cover some of the distinctions with regard to Wi-Fi access, but very few of these have had the chance to be tested yet in court.

33
00:03:47,230 --> 00:03:54,310
As any of you who have had experience with the law knows, it's not what the law says, it's what becomes the precedent within the judicial system.

34
00:03:54,330 --> 00:04:13,970
So, the first question I'm going to ask our panelists is, if in the very simplest case, we're war driving, we're driving around with a laptop, and we are accessing, and we are detecting access points, using a package let's say like Marius Milner's NetStumbler,

35
00:04:13,970 --> 00:04:20,090
and recording the location, and something about the signal, is this a legal activity?

36
00:04:21,210 --> 00:04:23,950
I'll first ask my first panelist, Renderman.

37
00:04:23,950 --> 00:04:43,010
Just for clarification, I am from Canada, so my knowledge is mostly around Canadian law, I'm not a lawyer, but in my research I found in Canada it's a lot more sanely written laws than in the States in regards to this.

38
00:04:43,150 --> 00:04:48,770
Anything in the 2.4 gigahertz ISM band is basically, it's public domain.

39
00:04:48,770 --> 00:04:53,030
It's free to transmit, free to receive, up to one watt.

40
00:04:53,410 --> 00:04:59,330
Anything that is transmitted, if it's unencrypted, you can listen to legally.

41
00:04:59,410 --> 00:05:04,850
You cannot disrupt, and you cannot decrypt if it is encrypted.

42
00:05:04,870 --> 00:05:06,850
But that's all the rules there are.

43
00:05:06,850 --> 00:05:19,330
This very nicely frames basic war driving, because all we're doing is passively detecting the signals from these networks, just listening to the information that they're skewing out.

44
00:05:19,650 --> 00:05:24,810
We're not accessing them, because then at that point we get into computer trespass laws.

45
00:05:25,210 --> 00:05:27,970
But the information coming in is nice and legal.

46
00:05:28,770 --> 00:05:30,590
Yeah, it's quite legal where I'm from.

47
00:05:31,030 --> 00:05:32,530
Okay, thank you.

48
00:05:32,530 --> 00:05:33,550
Robert Hill.

49
00:05:33,550 --> 00:05:35,770
Yeah, I think I would just mention two things.

50
00:05:35,770 --> 00:05:42,430
One quickly is, would it be a violation of the Computer Fraud and Abuse Act, which is kind of the bible of a lot of this stuff.

51
00:05:42,430 --> 00:05:47,510
You have to show unauthorized access, you have to show obtaining information, and you have to show damages.

52
00:05:47,970 --> 00:05:57,950
So, Render just nicely outlined, although it might not be in the Canadian context, you could, I think in the worst case scenario, maybe prove something there.

53
00:05:58,070 --> 00:06:00,270
Was the access authorized?

54
00:06:00,270 --> 00:06:06,010
Well, if they didn't have any kind of protection up around their access point, you might be able to squeeze that in.

55
00:06:06,150 --> 00:06:08,370
Obtaining information seems pretty weak.

56
00:06:08,370 --> 00:06:11,650
Again, what are you actually doing with the router?

57
00:06:11,970 --> 00:06:13,290
It's pretty minor.

58
00:06:13,290 --> 00:06:14,570
And then, where are the damages?

59
00:06:14,570 --> 00:06:16,630
So, it's pretty attenuated.

60
00:06:16,630 --> 00:06:18,110
However, I will say this.

61
00:06:18,210 --> 00:06:40,890
I think to the extent that an organized group that's setting up, and again, I said this is a worst case scenario, that's setting up kind of a, you know, showing people where a bunch of wireless access points are, it's conceivable that some very zealous or overzealous authorities might view that as a facilitation of bad acts.

62
00:06:40,890 --> 00:06:46,570
Although they're not doing a bad act, they might be able to say it's conspiracy or aiding and abetting.

63
00:06:46,570 --> 00:06:54,450
I know it sounds pretty horrible, but it's certainly not unreasonable or irrational or inconceivable.

64
00:06:54,450 --> 00:06:56,450
So, those are the two things I would say.

65
00:06:56,450 --> 00:06:57,310
Thank you.

66
00:06:57,310 --> 00:06:58,490
Thorne?

67
00:06:58,710 --> 00:06:59,750
Hi.

68
00:06:59,750 --> 00:07:17,550
From my standpoint, especially with my background in law enforcement, my interpretation of this, and not being an attorney, but being someone that is familiar with interpreting laws, is that this is completely legal to just detect and to record locations.

69
00:07:17,930 --> 00:07:26,910
I think a prosecutor would have a real hard time pushing it out to the effect that you're doing something nasty by recording this stuff.

70
00:07:27,450 --> 00:07:41,990
It's probably a lot more information that is publicly available in a phone book that would cause a lot more damage than someone just going down the street and detecting whether there's an access point near a particular location.

71
00:07:43,510 --> 00:07:44,550
Thank you.

72
00:07:44,770 --> 00:07:47,650
Okay, that's the simplest case.

73
00:07:47,670 --> 00:07:49,510
Now let's take the next case.

74
00:07:54,360 --> 00:08:02,340
Let's say that we have a situation where I'm still... there's a situation where we can set up something called promiscuous mode.

75
00:08:02,340 --> 00:08:05,260
Promiscuous mode is not as dirty as it sounds.

76
00:08:05,260 --> 00:08:12,840
Promiscuous mode is that some Wi-Fi devices, cards, can be set to listen to any packet coming across.

77
00:08:12,840 --> 00:08:14,020
And they do it passively.

78
00:08:14,020 --> 00:08:16,200
They don't send back an acknowledgement packet.

79
00:08:16,200 --> 00:08:19,300
So you're simply receiving everything that's out there in the ether.

80
00:08:19,700 --> 00:08:32,220
So I'm receiving these packets and I'm receiving them for the purpose of pulling them down onto my PC and what I want to do is to break... is to crack the encryption.

81
00:08:32,420 --> 00:08:34,600
I'm simply doing it for the sport.

82
00:08:34,660 --> 00:08:39,200
I'm not interested in going onto that person's network and stealing any information from them.

83
00:08:39,200 --> 00:08:49,220
It's for the purpose of receiving information that's being broadcast out to me in the free air waves, as Doonesbury said, but for the sport of being able to crack the web.

84
00:08:49,520 --> 00:08:51,360
Is that a legal activity?

85
00:08:51,420 --> 00:08:53,120
Renderman?

86
00:08:53,120 --> 00:09:08,140
In Canada, basically it's free reign and the ISM ban and capturing anything that you want within reason in that spectrum is perfectly legal.

87
00:09:08,140 --> 00:09:18,320
You cannot divulge to other persons what you capture and you cannot decrypt the information you do receive.

88
00:09:18,320 --> 00:09:19,820
Those are the only two provisions.

89
00:09:19,840 --> 00:09:30,200
If you're just looking at screen dumps of the packets going by, seeing what web pages people are looking at, things like that, that's all perfectly legal.

90
00:09:30,200 --> 00:09:35,840
It's entirely passive, you're not disrupting, you're not doing anything that I can tell is legally bad.

91
00:09:36,240 --> 00:09:50,840
When you start getting into cracking WEP, if it's something that is not your access point, not your property and no permission, definitely you're starting to get out of the Radio Communication Act more into the preparatory stages for computer intrusion,

92
00:09:50,840 --> 00:09:53,260
so computer trespass laws.

93
00:09:53,260 --> 00:10:03,380
You could probably argue the case that having the two tools, like Aircrack and a dump file, themselves are not illegal.

94
00:10:03,380 --> 00:10:09,940
However, having processed the dump file through Aircrack and having the key, then they'd probably want to speak to you.

95
00:10:09,940 --> 00:10:13,900
But you'd really have to get somebody's attention to have them go after that.

96
00:10:13,900 --> 00:10:16,400
It wouldn't be worth their time, just if you're doing it for sport.

97
00:10:16,580 --> 00:10:28,200
Not something I'd recommend, because if you've got the wireless gear to go out and collect this stuff anyways, you've probably got an access point at home and can tinker around in your own lab, rather than driving halfway across the city and doing it there.

98
00:10:28,200 --> 00:10:30,160
I'd rather sit at home in air conditioning.

99
00:10:31,100 --> 00:10:31,980
Thank you.

100
00:10:31,980 --> 00:10:32,580
Robert?

101
00:10:32,580 --> 00:10:42,260
I would talk to three things, mainly the CFAA elements, then, again, the sort of conspiracy enterprise theory, and then also, really, public policy.

102
00:10:42,260 --> 00:10:45,660
I think from the CFAA standpoint, again, we just go through our elements.

103
00:10:45,660 --> 00:10:47,440
We've got unauthorized access.

104
00:10:47,440 --> 00:10:49,380
Yes, we do have unauthorized access.

105
00:10:49,840 --> 00:10:58,440
Obtaining information, there's a case that controls CFAA that says even looking at information is obtaining it.

106
00:10:58,440 --> 00:10:59,920
Is that the right decision?

107
00:11:00,140 --> 00:11:02,480
Again, we could debate that, but that is the president.

108
00:11:02,480 --> 00:11:07,300
So if you're just looking at it, as Render said, you've satisfied that element of the CFAA.

109
00:11:07,300 --> 00:11:08,380
Then you have your damages.

110
00:11:08,380 --> 00:11:18,920
Now, through that act of cracking the encryption, the user is then led to have to spend a lot of money to reconfigure their system or something.

111
00:11:19,100 --> 00:11:23,040
Again, it's a stretch, but you could say that you have damages there.

112
00:11:23,040 --> 00:11:33,180
Now, moving on to the conspiracy part, again, if you have a group of people doing this, and again, they may, some of them, say it's for sport, but there's kind of a gray area there.

113
00:11:33,440 --> 00:11:37,760
I could see the feds coming in and saying, you know, you guys are aiding and abetting.

114
00:11:37,920 --> 00:11:44,800
You say you might not be doing anything bad, but if you know that something bad is going to occur down the line, you're aiding and abetting bad actors.

115
00:11:45,080 --> 00:11:58,920
The third thing I'd say is that really, since, and we're going to get to this in your third segment, the public policy aspect, you want these companies to develop tools to enable the user to protect their access point.

116
00:11:59,320 --> 00:12:06,600
So to the extent that you go around cracking them, I mean, it might be contrary to public policy, but you could also argue that it facilitates a good public policy.

117
00:12:06,600 --> 00:12:08,400
But we'll debate that next.

118
00:12:10,100 --> 00:12:19,560
My view on this portion of it is when you start getting into, if you're just receiving straight data without any encryption on it, you're probably completely okay.

119
00:12:20,740 --> 00:12:30,680
You may be treading into an area of a problem if you start reading email, which is completely, clearly illegal under a couple of different laws.

120
00:12:31,800 --> 00:12:37,820
However, if you're just getting a packet and you're looking at a packet, seeing what it is, you're probably all right.

121
00:12:38,040 --> 00:12:45,420
When you start doing the web breaking, you're crossing into a real gray area in my mind.

122
00:12:45,420 --> 00:12:56,580
And I think that having worked with prosecutors, that would show clear intent in their mind if they were going to try and grab someone for doing something.

123
00:12:56,580 --> 00:13:10,160
The fact that someone went out and was breaking web on someone that they did not know, they did not have permission, most prosecutors would say that that is a clear intent to commit a further criminal act.

124
00:13:12,000 --> 00:13:13,480
Thank you.

125
00:13:13,480 --> 00:13:21,200
Now we get to what I think is the most interesting question here, from my perspective.

126
00:13:21,200 --> 00:13:37,860
Which is, if you were to go out and purchase a typical Linksys or Belkin router, you'd find that the SSID, that is the name given to the router, is usually either default, or in the Linksys case, I believe it's Linksys.

127
00:13:39,600 --> 00:13:51,740
A consumer goes, buys that router, sets it up at home, follows all the instructions, goes into their Windows XP machine, and sets it to access their Linksys router.

128
00:13:51,920 --> 00:13:58,060
No protection is set, they check the box, and it links up to their router.

129
00:13:58,580 --> 00:14:13,880
Now, a week later, they go out and they take their laptop, and they're sitting in a park in another part of town, working on their own PC, and the laptop detects another consumer who's done the same thing in the area.

130
00:14:13,920 --> 00:14:20,000
And it, of course, thinks, oh, I have a router named Linksys, it's not protected, I've already been programmed.

131
00:14:20,540 --> 00:14:24,240
And what does Microsoft's operating system do?

132
00:14:24,240 --> 00:14:28,100
It grabs onto that signal, and connects you directly to the Internet.

133
00:14:29,040 --> 00:14:38,160
So, the question is, one, I've done nothing active, I've simply followed the instructions that Microsoft and Linksys gave me.

134
00:14:38,520 --> 00:14:40,700
Have I done anything wrong?

135
00:14:41,160 --> 00:14:44,540
And then the question becomes, who is responsible?

136
00:14:44,780 --> 00:14:49,800
Is it the person who manufactures, is it the person who is accessing the signal?

137
00:14:49,800 --> 00:14:56,840
Is it the consumer or the business which happened to follow Linksys' and Microsoft's instructions and set up their router that way?

138
00:14:57,180 --> 00:15:00,460
Is it the hardware manufacturer?

139
00:15:00,500 --> 00:15:07,160
Should they have set security as a default, rather than insecurity as a default?

140
00:15:07,440 --> 00:15:16,040
Or is it the responsibility of the operating system not to automatically jump on to somebody's router without asking permission each time?

141
00:15:16,040 --> 00:15:21,940
So, it's an interesting question, not only from a legal standpoint, but also from a public policy standpoint.

142
00:15:22,420 --> 00:15:23,380
Thank you.

143
00:15:23,380 --> 00:15:31,300
I don't think any sane person would want to hold a consumer responsible for an accidental connection like that.

144
00:15:31,300 --> 00:15:44,040
If they open up their laptop and get the little bubble that says, you're now connected, and they realize, oops, this isn't my network, and they log off or disconnect, I don't think anyone would ever try to convict somebody for that.

145
00:15:44,060 --> 00:15:52,640
However, if they decide, hey, I'm on a network, I want to check my email, and then they go forward, yeah, that's theft of service, plain and simple.

146
00:15:52,880 --> 00:16:00,780
The consumer should have enough brainpower to realize that, yeah, you've towed up to that line, let's not cross it.

147
00:16:01,060 --> 00:16:03,560
I personally blame a lot of the manufacturers.

148
00:16:04,680 --> 00:16:06,000
Linksys is probably the worst.

149
00:16:06,000 --> 00:16:08,360
Everybody's probably heard of the Linksys Global Network.

150
00:16:08,360 --> 00:16:11,640
60% of the access points out there are Linksys.

151
00:16:12,040 --> 00:16:13,940
Most of them are on default.

152
00:16:16,260 --> 00:16:19,060
They bury the security warnings in the manuals.

153
00:16:19,060 --> 00:16:20,760
They're not easy to set up.

154
00:16:21,500 --> 00:16:26,680
Different manufacturers have different high-level encryptions and everything.

155
00:16:26,680 --> 00:16:28,160
They don't play nice together.

156
00:16:28,160 --> 00:16:30,620
It just gets really confusing for the customers.

157
00:16:30,760 --> 00:16:33,560
I actually, sadly, have to give props to Microsoft.

158
00:16:33,560 --> 00:16:45,780
When they were in the wireless gear development and stuff, and they were selling their routers and cards, their software wizard that came up, you specifically had to tell it, no, I don't want web on.

159
00:16:45,780 --> 00:16:50,020
By default, it would ask you for a key for your security.

160
00:16:50,020 --> 00:16:52,400
You had to specifically tell it, no.

161
00:16:52,440 --> 00:16:58,320
So just by not going for insecure by default, I think they did a really good job.

162
00:16:58,320 --> 00:17:14,300
However, everybody that had built-in wireless cards and had some sort of 128-bit, tried to set 128-bit encryption, because different manufacturers were using different methods to get 128-bit at the time, nobody could get on it.

163
00:17:14,300 --> 00:17:19,560
So if they set the security as high as they could or couldn't connect, okay, I'll just turn it off and leave it.

164
00:17:19,980 --> 00:17:26,220
So there's a lot of these companies that I think just need to sit down, readdress what they're doing.

165
00:17:27,200 --> 00:17:30,100
They're not taking care of their customers.

166
00:17:30,100 --> 00:17:32,940
They're intentionally putting them in harm's way.

167
00:17:32,940 --> 00:17:40,160
I'm just waiting for the first day that somebody is convicted for having an open access point and facilitating a crime.

168
00:17:40,240 --> 00:17:56,860
I don't know if that's within the realm of law, but I could see somebody even civilly, if company A gets attacked by a bad person through my access point, can company A sue me civilly for facilitating the access?

169
00:17:57,560 --> 00:17:58,780
It's a scary thing.

170
00:17:59,080 --> 00:17:59,840
Thank you.

171
00:17:59,840 --> 00:18:00,580
Robert?

172
00:18:00,620 --> 00:18:05,260
Yeah, I think with respect to the users, that that's really the risk there.

173
00:18:05,960 --> 00:18:22,840
But to the extent we're going to hold Linksys liable, they relate, because Linksys ships these things with the default, and they do it for a reason, because they're advertising a product that will provide ubiquitous Wi-Fi access.

174
00:18:23,180 --> 00:18:25,060
People just want it to work.

175
00:18:25,060 --> 00:18:26,360
Yeah, they really do.

176
00:18:26,360 --> 00:18:35,560
So you've got that smashing up against the real implications of shipping this stuff the way they do.

177
00:18:35,560 --> 00:18:55,420
So I think that to the extent that they start to make it easier for the users to implement quickly with some sort of restrictions, then you might get into a case, as you described, where there would be some liability on the WAP operator, even if it's someone in their house.

178
00:18:56,320 --> 00:19:01,820
As far as holding Linksys liable, I certainly think pressure is coming onto them.

179
00:19:02,660 --> 00:19:13,780
I mentioned in my paper that there's a consortium to develop some kind of product that's going to add onto the router to make it easier for people to implement security.

180
00:19:13,780 --> 00:19:18,040
Whether that's going to be any good, I don't know anyway.

181
00:19:18,040 --> 00:19:33,040
And again, the efforts to hold ISPs and manufacturers liable in the past haven't gone really anywhere, except for when they're going after monopoly-type situations.

182
00:19:33,040 --> 00:19:37,080
So that would be my view at this time.

183
00:19:39,000 --> 00:19:48,500
You know, a lot of this has come about because 802.11 has been a victim of its own success.

184
00:19:48,880 --> 00:19:59,140
I think a lot of the manufacturers originally envisioned setting these things basically as a very short-range item that would work only in a house.

185
00:20:00,580 --> 00:20:05,460
And people are going out using them in places they never dreamed of.

186
00:20:05,520 --> 00:20:07,360
The manufacturers never dreamed of.

187
00:20:07,360 --> 00:20:17,420
So it's going out, it's being used a lot more than it was ever anticipated, and the technology implemented was never intended to be used this way.

188
00:20:17,420 --> 00:20:20,740
So we've got kind of conflicting things going on here.

189
00:20:21,400 --> 00:20:25,440
On the other hand, I think there's a certain amount of responsibility of the operator.

190
00:20:25,440 --> 00:20:30,800
There's this very old thing that I think you've probably all heard called RTFM.

191
00:20:31,200 --> 00:20:35,480
You have to be able to operate your own equipment properly.

192
00:20:35,480 --> 00:20:38,460
You're supposed to be able to figure out what's going on with it.

193
00:20:38,460 --> 00:20:49,760
While I would agree that the manufacturers owe responsibility to the general public to get this stuff right, the operators do have some responsibility in getting it right themselves.

194
00:20:51,280 --> 00:20:52,460
Thank you.

195
00:20:52,460 --> 00:21:11,780
I think the questions that we begin to ask ourselves as fellow hackers are, although it's not totally independent of what the law requires of us, is what is the definition of ethical war driving?

196
00:21:12,080 --> 00:21:17,300
And that's something which our friend RenderMan here has given a first stab at.

197
00:21:18,080 --> 00:21:24,520
But it becomes a question of, in a sense, the law hasn't quite caught up with Wi-Fi, as you can see.

198
00:21:24,520 --> 00:21:29,680
So the question is, how do we, as hackers, act in an ethical manner?

199
00:21:29,980 --> 00:21:40,880
Now in the first step, we do, kind of like John Muir said, we have to walk softly and not leave too many footprints in the sand.

200
00:21:40,880 --> 00:21:45,720
On the other hand, the act of cracking a web, we're pretty soft.

201
00:21:45,720 --> 00:21:49,580
No one really knows we're there until we've actually cracked the web.

202
00:21:49,640 --> 00:21:51,980
So it's a very interesting question.

203
00:21:52,540 --> 00:21:54,840
Are there any questions?

204
00:22:17,980 --> 00:22:31,680
If it's the one I'm thinking of, what I've heard is it's basically the telecoms are trying to fight municipalities from getting in to what they consider their business.

205
00:22:33,820 --> 00:22:41,060
It's one of these private enterprise versus giving away something on a municipal level.

206
00:22:42,520 --> 00:22:45,120
I've got mixed feelings about some of that stuff.

207
00:22:45,120 --> 00:22:52,300
As much as I'd like to have free access everywhere, I don't particularly want my tax dollars going for it.

208
00:22:52,300 --> 00:22:56,120
I'm one of those people that I hate paying taxes.

209
00:22:56,800 --> 00:23:00,660
And where I am, I get minimal services anyways for what I get.

210
00:23:01,140 --> 00:23:04,900
I'm not sure I want to pay more for something I may not use.

211
00:23:06,480 --> 00:23:12,140
I just think that we can all agree that this sort of stuff would be really nice if it was like a utility.

212
00:23:12,140 --> 00:23:13,760
Like phone, power, water.

213
00:23:13,760 --> 00:23:15,940
You turn it on, it's there.

214
00:23:16,360 --> 00:23:21,840
I think it's a good step for municipalities to realize that internet access is not just going to go away.

215
00:23:21,840 --> 00:23:23,940
You might as well start providing it for everybody.

216
00:23:24,220 --> 00:23:26,600
There's already enough internet access.

217
00:23:26,600 --> 00:23:30,740
If one wanted to do really bad things with wireless, you could get internet access anywhere.

218
00:23:30,740 --> 00:23:34,140
Let's just organize it and do this sanely.

219
00:23:34,140 --> 00:23:38,640
It is just a money grab by the telcos trying to hold on to their old school monopoly.

220
00:23:39,140 --> 00:23:41,760
Because now they don't have the wires to control.

221
00:23:42,140 --> 00:23:44,100
There's a limit that they can do.

222
00:23:44,100 --> 00:23:47,640
They're just trying to stem the tide as long as they possibly can.

223
00:23:48,080 --> 00:23:50,260
I don't know of anything like this in Canada.

224
00:23:50,360 --> 00:23:52,600
I honestly hope it doesn't go through down here.

225
00:23:52,600 --> 00:24:00,300
I would just add that I think an interesting legal concept comes into view if you do move toward a municipality model.

226
00:24:00,300 --> 00:24:07,100
It's called sovereign immunity, which the government essentially can't be held liable even for negligence.

227
00:24:07,320 --> 00:24:12,940
Something to think about for those of you who await government control of the internet.

228
00:24:13,040 --> 00:24:15,440
So government control of the internet would actually be a positive.

229
00:24:15,440 --> 00:24:19,360
It might be if you're looking to have a good time.

230
00:24:19,360 --> 00:24:22,340
I think a lot of it depends on how it's set up, who's running it.

231
00:24:22,340 --> 00:24:25,020
Thank you.

232
00:24:25,020 --> 00:24:27,470
Before we get to the next question, I wanted Robert...

233
00:24:28,080 --> 00:24:30,320
Robert Hale has written an article on this.

234
00:24:30,320 --> 00:24:40,240
If you look in the CD that you got with Defcon, there are some pieces written by RenderMan on a first stab, which I think is great, at a hacker code of ethics for war driving.

235
00:24:40,320 --> 00:24:46,680
As well as Robert Hale has an article on this, which delves into some of the issues.

236
00:24:47,040 --> 00:24:51,120
But I wanted Robert to comment on the Computer Fraud and Abuse Act.

237
00:24:51,120 --> 00:25:03,800
Because if I recall reading, there's a part in the CFAA which basically says that it shall not be a crime to access a Wi-Fi signal that is unencrypted.

238
00:25:03,820 --> 00:25:05,900
Can you comment on that?

239
00:25:06,320 --> 00:25:13,780
You know, what I will focus in on, that makes sense.

240
00:25:13,780 --> 00:25:18,840
That seems consistent with a lot of the things that I've read and what we've been talking about.

241
00:25:18,840 --> 00:25:26,440
I think probably the biggest unknown there is what the definition of unauthorized access is.

242
00:25:27,300 --> 00:25:30,100
There's a huge disparity of opinion.

243
00:25:30,660 --> 00:25:34,760
The Act doesn't define it, as anybody who's delved into it knows.

244
00:25:35,120 --> 00:25:39,440
And they really left it up to the courts to come up with a definition.

245
00:25:39,440 --> 00:25:45,640
And as a result, there is a very, very wide spectrum of views on what that unauthorized access is.

246
00:25:45,640 --> 00:25:55,000
And the crux of it is that, is the user, when they approach the Internet, are they in the default position of being unauthorized?

247
00:25:55,640 --> 00:25:58,040
Or is it the exact opposite?

248
00:25:58,040 --> 00:26:12,380
That unless something on the Internet end gives some kind of a signal to the user that you can't come in here, is the default of the user coming in, actually, I have open access?

249
00:26:12,380 --> 00:26:17,120
So it really comes down to a policy debate about whether the Internet's open or not.

250
00:26:18,220 --> 00:26:20,820
And there's a paper that I refer to in my paper.

251
00:26:20,820 --> 00:26:29,200
If you want to get into excruciating detail on the status of what unauthorized access means, I would point you to that for further detail.

252
00:26:29,300 --> 00:26:39,940
But irrespective of what some commentary on the CFA may say, I really think that the future of where this is going to go, at least at that level, is going to come down to unauthorized access.

253
00:26:41,580 --> 00:26:42,460
Yes?

254
00:26:43,220 --> 00:26:44,100
I've heard...

255
00:26:44,660 --> 00:26:45,820
Can you stand up?

256
00:26:45,820 --> 00:26:46,400
I can't hear.

257
00:26:46,400 --> 00:26:46,840
Sorry.

258
00:26:46,900 --> 00:26:47,360
I've heard

259
00:27:14,930 --> 00:27:15,370
.

260
00:27:15,570 --> 00:27:24,410
So your question is that if you're broadcasting it and it's unencrypted, you don't have the right of privacy to what you're broadcasting?

261
00:27:24,830 --> 00:27:25,430
I don't know.

262
00:27:25,430 --> 00:27:26,870
Anyone want to comment on that?

263
00:27:29,110 --> 00:27:34,510
Basically, I think you're correct in that you don't have a right as far as the reception goes.

264
00:27:34,930 --> 00:27:36,350
You've sent it out there.

265
00:27:36,350 --> 00:27:42,370
However, there are some laws that will conflict with that directly, specifically the one regarding e-mail.

266
00:27:43,590 --> 00:27:52,610
It's illegal to intercept e-mail if you're not the recipient, if you're not one of the carriers, or you're not the one that's transmitting it.

267
00:27:56,920 --> 00:27:59,140
And that's the real gray area.

268
00:27:59,140 --> 00:28:06,200
If you capture it and you realize it's an e-mail, where are you crossing the line?

269
00:28:06,200 --> 00:28:13,900
Because if you just get a header and it's an e-mail header, and you say, oh jeez, I'm not going to read anymore, have you crossed the line?

270
00:28:14,340 --> 00:28:16,400
I'd say maybe, maybe not.

271
00:28:16,600 --> 00:28:21,160
If you go through the whole thing, you've probably definitely gone way past where you should have gone.

272
00:28:23,100 --> 00:28:31,360
But if someone's just broadcasting everything that's going out there that they've been getting, all their web surfing and all that, a lot of that's completely open.

273
00:28:31,360 --> 00:28:32,680
That's their own problem.

274
00:28:33,320 --> 00:28:37,740
I would add that I discuss this a little bit in my paper.

275
00:28:38,060 --> 00:28:52,300
If you want to push the Computer Fraud and Abuse Act aside for a minute and get down to common law issues like trespass, there have been cases in which they've likened unauthorized access to trespass.

276
00:28:54,480 --> 00:29:05,220
The views that come down there are if you're not protecting your access point and taking steps to protect it, then there's an implied authorization you're giving to the user.

277
00:29:05,600 --> 00:29:13,700
And again, that relates to the point I made earlier about the debates about this unauthorized access business.

278
00:29:13,700 --> 00:29:20,320
I would also add that I think that if you really boil it down to the bone right now, the Feds can tap into the Internet without a warrant.

279
00:29:20,320 --> 00:29:22,760
I mean, that's basically the way it stands right now.

280
00:29:22,760 --> 00:29:24,940
So we can debate that endlessly.

281
00:29:24,940 --> 00:29:28,640
But I think that if you really boil it down, that's really what's the bottom line.

282
00:29:28,640 --> 00:29:32,640
So the Feds could tap into the Wi-Fi network without...

283
00:29:33,540 --> 00:29:35,300
That's my current understanding.

284
00:29:35,300 --> 00:29:38,820
But again, there's a lot of conflicting views about that.

285
00:29:38,940 --> 00:29:39,600
Okay.

286
00:29:39,600 --> 00:29:40,380
Thank you.

287
00:29:40,380 --> 00:29:41,760
Any other questions?

288
00:29:44,340 --> 00:29:45,140
Okay.

289
00:29:45,140 --> 00:29:49,920
One other issue I'm going to bring up again is this issue of who's responsible.

290
00:29:50,220 --> 00:29:58,280
So I think what we've talked about here is the problem, which is they try to make it easy for you to use Wi-Fi.

291
00:29:58,280 --> 00:30:01,380
At the same point, they make it insecure.

292
00:30:01,960 --> 00:30:19,380
So one of the things that I've talked about with several of the members of the panel here is, in a sense, that we believe there needs to be a much stronger effort on the part of the software and the hardware manufacturers to change, in a sense, not only their marketing literature,

293
00:30:19,380 --> 00:30:26,200
but change the way they ship this equipment and this software so that, in a sense, security becomes the default.

294
00:30:26,200 --> 00:30:29,660
I know we addressed that a little bit, but I'm asking that specific question.

295
00:30:29,660 --> 00:30:40,720
Do they believe that if a case were to happen, that we did have unauthorized access, do you believe that the software and the hardware manufacturers share some responsibility?

296
00:30:42,140 --> 00:30:47,020
I don't think that the software and hardware manufacturers could be held directly liable.

297
00:30:47,560 --> 00:30:51,420
The end user, you know, stupidity is not a valid defense.

298
00:30:51,420 --> 00:31:10,160
If you didn't secure your access point, and somebody ends up accidentally being on there intentionally, my personal opinion is that if you leave it open and you specify in the SSID that it's free access, then go for it.

299
00:31:10,160 --> 00:31:17,520
If it is not specifically telling you free access, you know, surf me, anything like that, take some pity on these people.

300
00:31:17,520 --> 00:31:19,020
You've probably got high-speed internet at home.

301
00:31:19,020 --> 00:31:20,640
You don't need to mooch off of other people.

302
00:31:20,640 --> 00:31:23,040
Hotels have Wi-Fi, usually.

303
00:31:24,100 --> 00:31:31,080
There are much better ways of doing it than, you know, trouncing around in this legal gray area and get yourself in trouble.

304
00:31:31,780 --> 00:31:35,500
At some point or another, it's going to be ubiquitous.

305
00:31:35,500 --> 00:31:39,620
You know, we're just going to be able to open things up and it's there, all nice and legal.

306
00:31:39,620 --> 00:31:44,300
But for now, yeah, drive the two blocks down to the Kinko's or wherever and use theirs.

307
00:31:44,840 --> 00:31:46,360
Just cover your butt.

308
00:31:46,440 --> 00:31:54,080
I just really wish I could have smacked Linksys around a couple of years ago when they were putting this stuff out because they just...

309
00:31:54,080 --> 00:31:56,140
they seem to be the biggest part of the problem.

310
00:31:56,140 --> 00:32:03,200
Their manuals are getting better, but I still hold them responsible for so much of this because they're making it so easy.

311
00:32:03,700 --> 00:32:05,140
It's not even like you're having...

312
00:32:05,140 --> 00:32:11,060
the tools are out there to break a lot of the security that's in place, but they just make it so much easier for everybody.

313
00:32:11,380 --> 00:32:17,820
As he said, if you have a Linksys at home, Linksys out in the park, it just hops on there.

314
00:32:17,820 --> 00:32:21,180
And suddenly people can suddenly commit a felony on their own.

315
00:32:21,180 --> 00:32:23,400
The software and everything helps them.

316
00:32:23,520 --> 00:32:31,720
They could very easily go too far and start checking email, start realizing, hey, I can use this as a launching point for other things.

317
00:32:32,520 --> 00:32:33,260
Thank you.

318
00:32:33,260 --> 00:32:33,800
Robert?

319
00:32:33,800 --> 00:32:42,660
I would just say that it's the job of the plaintiff's bar to come up with a lot of these outlandish and bizarre theories of liability.

320
00:32:42,660 --> 00:32:53,060
As any of you know from buying appliances like toasters and hairdryers and pretty much anything nowadays, it's got warnings all over it, that you, you know, really stupid stuff like, you know...

321
00:32:53,060 --> 00:32:55,420
Do not iron pants while wearing...

322
00:32:55,420 --> 00:32:55,940
Yeah, yeah.

323
00:32:55,940 --> 00:33:02,520
I mean, really, that's all there because there's enough books to fill this room about product liability.

324
00:33:02,520 --> 00:33:05,980
And the reason I mention that is that the whole idea here is to make...

325
00:33:05,980 --> 00:33:11,160
well, maybe not everybody would agree with this, but they're trying to make computers a newer appliance, right?

326
00:33:11,160 --> 00:33:21,240
So to the extent that that keeps getting pushed, it's not inconceivable that you could come up with some kind of theory like that.

327
00:33:21,240 --> 00:33:32,200
So I think it's extremely unlikely that Linksys or other companies ever come under any kind of liability, but it's not impossible, given the history of litigation within the product liability space.

328
00:33:32,200 --> 00:33:37,180
But I completely agree with the points made that they really need to do more.

329
00:33:37,180 --> 00:33:39,320
Doesn't mean we can't yell at them still, though.

330
00:33:39,860 --> 00:33:41,960
Yeah, I would agree with that.

331
00:33:42,020 --> 00:33:45,760
Like I said earlier, there's a certain amount of RTFM.

332
00:33:45,760 --> 00:33:51,920
However, I also think the companies, as companies, owe us something to get their product right.

333
00:33:52,120 --> 00:34:01,780
And for all the abuse Microsoft takes on a lot of different things that they absolutely deserve, the one thing they did right, in my opinion, was with their Wi-Fi appliances.

334
00:34:01,800 --> 00:34:05,980
They went to a default encrypted mode.

335
00:34:06,240 --> 00:34:08,640
They were the first and the only product to do that.

336
00:34:09,120 --> 00:34:11,440
I'd like to see the other products do that.

337
00:34:11,620 --> 00:34:12,600
I'd love to see it.

338
00:34:13,640 --> 00:34:14,560
Thank you.

339
00:34:14,560 --> 00:34:22,000
Before we finish, I just want to know if any of you saw this article in the newspaper, which we have up at our booth, that 10 more commandments were found.

340
00:34:22,400 --> 00:34:31,160
And I'm not sure that anybody is aware of it, so we made up a T-shirt about it, which I think really talks on what we're going for ethical war driving.

341
00:34:31,160 --> 00:34:32,660
The 11th commandment.

342
00:34:32,700 --> 00:34:35,520
Thou shalt not covet thy neighbor's Wi-Fi.

343
00:34:36,000 --> 00:34:36,440
So...

344
00:34:39,980 --> 00:34:42,160
Thank you all very much for coming.

345
00:34:59,240 --> 00:35:07,120
If you're actually hoping to have some level of security by hiding your SSID, I don't think that anyone would actually say that works as security.

346
00:35:07,940 --> 00:35:12,340
You could make an argument, but it's just a matter of using a different tool to find it.

347
00:35:12,860 --> 00:35:24,620
I don't think there would be enough there for anybody to complain that I was trying to secure my stuff, why are you on here?

348
00:35:27,360 --> 00:35:29,760
Do we have any other opinions on that question?

349
00:35:31,380 --> 00:35:31,740
Okay.

350
00:35:32,320 --> 00:35:34,200
Thank you all very much for coming.

351
00:35:34,200 --> 00:35:37,020
Alright, we've got time for two more.

352
00:35:37,020 --> 00:35:37,400
Go ahead.

353
00:35:53,160 --> 00:35:55,420
I really wish that they would.

354
00:35:55,540 --> 00:36:04,880
I'm not a lawyer, but I've seen cases where companies will go in, install wireless access all over the place in a business, leave it wide open and walk away.

355
00:36:04,940 --> 00:36:07,680
I don't think it's due diligence and it's not very professional.

356
00:36:08,300 --> 00:36:12,460
The companies, I think, would probably be best sued civilly if something did happen.

357
00:36:13,760 --> 00:36:17,080
Ethically, who are these people that are setting these things up insecurely?

358
00:36:17,080 --> 00:36:19,220
They're supposed to be... you're hiring the expert.

359
00:36:19,220 --> 00:36:20,620
Why aren't they reading the manual?

360
00:36:20,620 --> 00:36:22,940
Why aren't they doing what their job is?

361
00:36:23,240 --> 00:36:24,320
I'd say two points.

362
00:36:24,320 --> 00:36:27,500
It's conceivable they would be held liable civilly, maybe.

363
00:36:27,560 --> 00:36:31,680
The second thing I'd say is most of these laws have loopholes for...

364
00:36:33,460 --> 00:36:42,220
you could say information security or technical loopholes to allow for these types of things.

365
00:36:42,220 --> 00:36:45,040
So it's conceivable they could get immunity under something like that.

366
00:36:47,060 --> 00:36:47,820
Yes.

367
00:36:56,300 --> 00:36:58,540
Does that count as wiretapping?

368
00:36:58,780 --> 00:37:00,060
It's conceivable?

369
00:37:00,060 --> 00:37:02,760
That's a topic I mentioned briefly in my paper.

370
00:37:02,760 --> 00:37:10,100
Certainly, again, if you're going to find liability under CFAA, under the facts you described, there's no reason why you wouldn't find it under the wiretap laws.

371
00:37:10,200 --> 00:37:19,720
One of the points that we make in the beginning here is that we know what we interpret some of these state and federal laws to be.

372
00:37:19,720 --> 00:37:24,160
The question remains over the next few years how the courts will interpret them.

373
00:37:24,400 --> 00:37:36,080
And we need to walk, as hackers and as people who advise people out in the field, we need to walk a fine line and make sure that we're not going into an area which is gray without knowing that we're going into a gray area.

374
00:37:36,080 --> 00:37:38,260
Any other questions?

375
00:37:39,340 --> 00:37:40,620
Okay.

376
00:37:40,620 --> 00:37:42,220
Thank you all very much.

377
00:37:42,220 --> 00:37:43,160
Enjoy DAPTCON.