We have four panelists. Myself, I'm Matthew Shuckman. I'm one of the founders of
WarDrivingWorld.com. We have RenderMan, a famous hacker and a superb war driver.
We have Robert Hale, who's a lawyer from San Francisco, who's written on this subject
of Wi-Fi and the law. And we have Frank Thornton, who is a former law enforcement
official and, as well, a great hacker. So we'll give some different perspectives.
Firstly, I'm going to ask if you can hold your questions until the end. We're only going
to have about 40 minutes, so we'll try to get through it so we can leave a few minutes
at the end for questions.
Firstly, the definition of what is war driving. And the simple definition of what is war
driving and whether you're walking around. There's been a lot of play with the verbs
here, whether you're driving around, whether you're walking around. It's the act of having
a laptop or a PC of some form and detecting other people's Wi-Fi signals and recording
some information about them. The simplest case was recording the information that the
access point is there, maybe the speed of transmission, and if you have a GPS, maybe
the location. So, there's been a lot of talk of whether war driving is legal. So, there
was a Doonesbury cartoon which covers this. And the question of, is war driving legal?
There have been a number of articles in the newspaper where you've seen that people have
been arrested for war driving. However, what I'll say is, with one exception, in each of
those cases, the people who were arrested for war driving were doing something else.
Some other nefarious activity, some crime. In this criminal activity, for instance, in
one case in Toronto, the man was spamming child pornography, but using somebody else's
Wi-Fi signal to get it out. We certainly can all agree that spamming child pornography
is a crime, and it's really not the war driving that's the issue, it's the other crime involved.
Another case involves two people who were grabbing credit card numbers off of a Wi-Fi
signal near a retail store. We'd all certainly agree they're stealing credit card information,
that's separate from the war driving. There's a recent case where a man in Tampa was outside
of somebody else's house, and he was caught, the man went out, the resident of the house
went out, found him outside and said, hmm, what are you doing here? But didn't say anything.
He then went out, drove his girlfriend home, came back, the man was still sitting there
in the van with the glow of a laptop screen, as the reports in the newspaper say. He called
the police, the police came by, whoever this guy was was not so smart, he didn't leave
after the first two times, and the police came by and they arrested him for war driving.
We're not sure what else he was doing, we're not even sure what was on the screen, but
when that case comes to trial later in the fall, maybe we'll know something about it.
There are a variety of laws, both at the state and federal level, which cover accessing
networks, both legal accessing of networks, and accessing a network that might not be
yours, where it's an illegal activity. Some of these laws have been extended and will
cover Wi-Fi access of networks, but not all of them. There have been some new laws that
have been brought into play, which will cover some of the distinctions with regard to Wi-Fi
access, but very few of these have had the chance to be tested yet in court. As any of
you who have had experience with the law knows, it's not what the law says, it's what becomes
the precedent within the judicial system. So, the first question I'm going to ask our
panelists is, if in the very simplest case, we're war driving, we're driving around
with a laptop, and we are accessing, and we are detecting access points, using a package
let's say like Marius Milner's NetStumbler, and recording the location, and something
about the signal, is this a legal activity? I'll first ask my first panelist, Renderman.
Just for clarification, I am from Canada, so my knowledge is mostly around Canadian
law, I'm not a lawyer, but in my research I found in Canada it's a lot more sanely written
laws than in the States in regards to this. Anything in the 2.4 gigahertz ISM band is
basically, it's public domain. It's free to transmit, free to receive, up to one watt.
Anything that is transmitted, if it's unencrypted, you can listen to legally. You cannot
disrupt, and you cannot decrypt if it is encrypted. But that's all the rules there are.
This very nicely frames basic war driving, because all we're doing is passively detecting
the signals from these networks, just listening to the information that they're
skewing out. We're not accessing them, because then at that point we get into computer
trespass laws. But the information coming in is nice and legal. Yeah, it's quite legal
where I'm from. Okay, thank you. Robert Hill. Yeah, I think I would just mention two
things. One quickly is, would it be a violation of the Computer Fraud and Abuse Act, which
is kind of the bible of a lot of this stuff. You have to show unauthorized access, you
have to show obtaining information, and you have to show damages. So, Render just nicely
outlined, although it might not be in the Canadian context, you could, I think in the
worst case scenario, maybe prove something there. Was the access authorized? Well, if
they didn't have any kind of protection up around their access point, you might be able
to squeeze that in. Obtaining information seems pretty weak. Again, what are you actually
doing with the router? It's pretty minor. And then, where are the damages? So, it's
pretty attenuated. However, I will say this. I think to the extent that an organized group
that's setting up, and again, I said this is a worst case scenario, that's setting up
kind of a, you know, showing people where a bunch of wireless access points are, it's
conceivable that some very zealous or overzealous authorities might view that as a facilitation
of bad acts. Although they're not doing a bad act, they might be able to say it's conspiracy
or aiding and abetting. I know it sounds pretty horrible, but it's certainly not unreasonable
or irrational or inconceivable. So, those are the two things I would say.
Thank you. Thorne?
Hi. From my standpoint, especially with my background in law enforcement, my interpretation
of this, and not being an attorney, but being someone that is familiar with interpreting
laws, is that this is completely legal to just detect and to record locations. I think
a prosecutor would have a real hard time pushing it out to the effect that you're doing something
nasty by recording this stuff. It's probably a lot more information that is publicly available
in a phone book that would cause a lot more damage than someone just going down the street
and detecting whether there's an access point near a particular location.
Thank you. Okay, that's the simplest case. Now let's take the next case. Let's say that
we have a situation where I'm still... there's a situation where we can set up something
called promiscuous mode. Promiscuous mode is not as dirty as it sounds. Promiscuous
mode is that some Wi-Fi devices, cards, can be set to listen to any packet coming across.
And they do it passively. They don't send back an acknowledgement packet. So you're
simply receiving everything that's out there in the ether. So I'm receiving these packets
and I'm receiving them for the purpose of pulling them down onto my PC and what I want
to do is to break... is to crack the encryption. I'm simply doing it for the sport. I'm not
interested in going onto that person's network and stealing any information from them. It's
for the purpose of receiving information that's being broadcast out to me in the free air
waves, as Doonesbury said, but for the sport of being able to crack the web. Is that a
legal activity? Renderman? In Canada, basically it's free reign and the ISM ban and capturing
anything that you want within reason in that spectrum is perfectly legal. You cannot divulge
to other persons what you capture and you cannot decrypt the information you do receive.
Those are the only two provisions. If you're just looking at screen dumps of the packets
going by, seeing what web pages people are looking at, things like that, that's all perfectly
legal. It's entirely passive, you're not disrupting, you're not doing anything that I can tell
is legally bad. When you start getting into cracking WEP, if it's something that is not
your access point, not your property and no permission, definitely you're starting to
get out of the Radio Communication Act more into the preparatory stages for computer intrusion,
so computer trespass laws. You could probably argue the case that having the two tools,
like Aircrack and a dump file, themselves are not illegal. However, having processed
the dump file through Aircrack and having the key, then they'd probably want to speak
to you. But you'd really have to get somebody's attention to have them go after that. It wouldn't
be worth their time, just if you're doing it for sport. Not something I'd recommend,
because if you've got the wireless gear to go out and collect this stuff anyways, you've
probably got an access point at home and can tinker around in your own lab, rather than
driving halfway across the city and doing it there. I'd rather sit at home in air conditioning.
Thank you. Robert? I would talk to three things, mainly the CFAA elements, then, again, the
sort of conspiracy enterprise theory, and then also, really, public policy. I think
from the CFAA standpoint, again, we just go through our elements. We've got unauthorized
access. Yes, we do have unauthorized access. Obtaining information, there's a case that
controls CFAA that says even looking at information is obtaining it. Is that the right decision?
Again, we could debate that, but that is the president. So if you're just looking at it,
as Render said, you've satisfied that element of the CFAA. Then you have your damages. Now,
through that act of cracking the encryption, the user is then led to have to spend a lot of
money to reconfigure their system or something. Again, it's a stretch, but you could say that
you have damages there. Now, moving on to the conspiracy part, again, if you have a group
of people doing this, and again, they may, some of them, say it's for sport, but there's
kind of a gray area there. I could see the feds coming in and saying, you know, you guys
are aiding and abetting. You say you might not be doing anything bad, but if you know
that something bad is going to occur down the line, you're aiding and abetting bad actors.
The third thing I'd say is that really, since, and we're going to get to this in your third
segment, the public policy aspect, you want these companies to develop tools to enable
the user to protect their access point. So to the extent that you go around cracking
them, I mean, it might be contrary to public policy, but you could also argue that it
facilitates a good public policy. But we'll debate that next.
My view on this portion of it is when you start getting into, if you're just receiving
straight data without any encryption on it, you're probably completely okay. You may be
treading into an area of a problem if you start reading email, which is completely,
clearly illegal under a couple of different laws. However, if you're just getting a packet
and you're looking at a packet, seeing what it is, you're probably all right.
When you start doing the web breaking, you're crossing into a real gray area in my mind.
And I think that having worked with prosecutors, that would show clear intent in their mind
if they were going to try and grab someone for doing something. The fact that someone
went out and was breaking web on someone that they did not know, they did not have permission,
most prosecutors would say that that is a clear intent to commit a further criminal act.
Thank you. Now we get to what I think is the most interesting question here, from my perspective.
Which is, if you were to go out and purchase a typical Linksys or Belkin router, you'd find
that the SSID, that is the name given to the router, is usually either default, or in the
Linksys case, I believe it's Linksys. A consumer goes, buys that router, sets it up at home,
follows all the instructions, goes into their Windows XP machine, and sets it to access
their Linksys router. No protection is set, they check the box, and it links up to their
router. Now, a week later, they go out and they take their laptop, and they're sitting in a park
in another part of town, working on their own PC, and the laptop detects another consumer
who's done the same thing in the area. And it, of course, thinks, oh, I have a router named Linksys,
it's not protected, I've already been programmed. And what does Microsoft's operating system do?
It grabs onto that signal, and connects you directly to the Internet. So, the question is, one,
I've done nothing active, I've simply followed the instructions that Microsoft and Linksys gave me.
Have I done anything wrong? And then the question becomes, who is responsible? Is it the person
who manufactures, is it the person who is accessing the signal? Is it the consumer or the business
which happened to follow Linksys' and Microsoft's instructions and set up their router that way?
Is it the hardware manufacturer? Should they have set security as a default, rather than insecurity
as a default? Or is it the responsibility of the operating system not to automatically jump on
to somebody's router without asking permission each time? So, it's an interesting question,
not only from a legal standpoint, but also from a public policy standpoint. Thank you.
I don't think any sane person would want to hold a consumer responsible for an accidental
connection like that. If they open up their laptop and get the little bubble that says,
you're now connected, and they realize, oops, this isn't my network, and they log off or disconnect,
I don't think anyone would ever try to convict somebody for that. However, if they decide,
hey, I'm on a network, I want to check my email, and then they go forward, yeah, that's theft of service,
plain and simple. The consumer should have enough brainpower to realize that, yeah, you've
towed up to that line, let's not cross it. I personally blame a lot of the manufacturers.
Linksys is probably the worst. Everybody's probably heard of the Linksys Global Network.
60% of the access points out there are Linksys. Most of them are on default.
They bury the security warnings in the manuals. They're not easy to set up.
Different manufacturers have different high-level encryptions and everything.
They don't play nice together. It just gets really confusing for the customers.
I actually, sadly, have to give props to Microsoft. When they were in the wireless gear development
and stuff, and they were selling their routers and cards, their software wizard that came up,
you specifically had to tell it, no, I don't want web on. By default, it would ask you for a key for
your security. You had to specifically tell it, no. So just by not going for insecure by default,
I think they did a really good job. However, everybody that had built-in wireless cards
and had some sort of 128-bit, tried to set 128-bit encryption, because different manufacturers
were using different methods to get 128-bit at the time, nobody could get on it.
So if they set the security as high as they could or couldn't connect, okay, I'll just turn it off and leave it.
So there's a lot of these companies that I think just need to sit down, readdress what they're doing.
They're not taking care of their customers. They're intentionally putting them in harm's way.
I'm just waiting for the first day that somebody is convicted for having an open access point
and facilitating a crime. I don't know if that's within the realm of law, but I could see somebody
even civilly, if company A gets attacked by a bad person through my access point,
can company A sue me civilly for facilitating the access? It's a scary thing.
Thank you. Robert?
Yeah, I think with respect to the users, that that's really the risk there.
But to the extent we're going to hold Linksys liable, they relate, because Linksys ships these things
with the default, and they do it for a reason, because they're advertising a product
that will provide ubiquitous Wi-Fi access.
People just want it to work.
Yeah, they really do. So you've got that smashing up against the real implications of shipping this stuff
the way they do. So I think that to the extent that they start to make it easier for the users
to implement quickly with some sort of restrictions, then you might get into a case, as you described,
where there would be some liability on the WAP operator, even if it's someone in their house.
As far as holding Linksys liable, I certainly think pressure is coming onto them.
I mentioned in my paper that there's a consortium to develop some kind of product
that's going to add onto the router to make it easier for people to implement security.
Whether that's going to be any good, I don't know anyway.
And again, the efforts to hold ISPs and manufacturers liable in the past
haven't gone really anywhere, except for when they're going after monopoly-type situations.
So that would be my view at this time.
You know, a lot of this has come about because 802.11 has been a victim of its own success.
I think a lot of the manufacturers originally envisioned setting these things
basically as a very short-range item that would work only in a house.
And people are going out using them in places they never dreamed of.
The manufacturers never dreamed of.
So it's going out, it's being used a lot more than it was ever anticipated,
and the technology implemented was never intended to be used this way.
So we've got kind of conflicting things going on here.
On the other hand, I think there's a certain amount of responsibility of the operator.
There's this very old thing that I think you've probably all heard called RTFM.
You have to be able to operate your own equipment properly.
You're supposed to be able to figure out what's going on with it.
While I would agree that the manufacturers owe responsibility to the general public to get this stuff right,
the operators do have some responsibility in getting it right themselves.
Thank you.
I think the questions that we begin to ask ourselves as fellow hackers are,
although it's not totally independent of what the law requires of us, is
what is the definition of ethical war driving?
And that's something which our friend RenderMan here has given a first stab at.
But it becomes a question of, in a sense, the law hasn't quite caught up with Wi-Fi, as you can see.
So the question is, how do we, as hackers, act in an ethical manner?
Now in the first step, we do, kind of like John Muir said,
we have to walk softly and not leave too many footprints in the sand.
On the other hand, the act of cracking a web, we're pretty soft.
No one really knows we're there until we've actually cracked the web.
So it's a very interesting question.
Are there any questions?
If it's the one I'm thinking of, what I've heard is it's basically
the telecoms are trying to fight municipalities from getting in to what they consider their business.
It's one of these private enterprise versus giving away something on a municipal level.
I've got mixed feelings about some of that stuff.
As much as I'd like to have free access everywhere, I don't particularly want my tax dollars going for it.
I'm one of those people that I hate paying taxes.
And where I am, I get minimal services anyways for what I get.
I'm not sure I want to pay more for something I may not use.
I just think that we can all agree that this sort of stuff would be really nice if it was like a utility.
Like phone, power, water. You turn it on, it's there.
I think it's a good step for municipalities to realize that internet access is not just going to go away.
You might as well start providing it for everybody.
There's already enough internet access.
If one wanted to do really bad things with wireless, you could get internet access anywhere.
Let's just organize it and do this sanely.
It is just a money grab by the telcos trying to hold on to their old school monopoly.
Because now they don't have the wires to control.
There's a limit that they can do.
They're just trying to stem the tide as long as they possibly can.
I don't know of anything like this in Canada.
I honestly hope it doesn't go through down here.
I would just add that I think an interesting legal concept comes into view if you do move toward a municipality model.
It's called sovereign immunity, which the government essentially can't be held liable even for negligence.
Something to think about for those of you who await government control of the internet.
So government control of the internet would actually be a positive.
It might be if you're looking to have a good time.
I think a lot of it depends on how it's set up, who's running it.
Thank you.
Before we get to the next question, I wanted Robert...
Robert Hale has written an article on this.
If you look in the CD that you got with Defcon, there are some pieces written by RenderMan on a first stab,
which I think is great, at a hacker code of ethics for war driving.
As well as Robert Hale has an article on this, which delves into some of the issues.
But I wanted Robert to comment on the Computer Fraud and Abuse Act.
Because if I recall reading, there's a part in the CFAA which basically says that
it shall not be a crime to access a Wi-Fi signal that is unencrypted.
Can you comment on that?
You know, what I will focus in on, that makes sense.
That seems consistent with a lot of the things that I've read and what we've been talking about.
I think probably the biggest unknown there is what the definition of unauthorized access is.
There's a huge disparity of opinion.
The Act doesn't define it, as anybody who's delved into it knows.
And they really left it up to the courts to come up with a definition.
And as a result, there is a very, very wide spectrum of views on what that unauthorized access is.
And the crux of it is that, is the user, when they approach the Internet,
are they in the default position of being unauthorized?
Or is it the exact opposite?
That unless something on the Internet end gives some kind of a signal to the user that you can't come in here,
is the default of the user coming in, actually, I have open access?
So it really comes down to a policy debate about whether the Internet's open or not.
And there's a paper that I refer to in my paper.
If you want to get into excruciating detail on the status of what unauthorized access means,
I would point you to that for further detail.
But irrespective of what some commentary on the CFA may say,
I really think that the future of where this is going to go, at least at that level,
is going to come down to unauthorized access.
Yes?
I've heard...
Can you stand up? I can't hear. Sorry.
I've heard.
So your question is that if you're broadcasting it and it's unencrypted,
you don't have the right of privacy to what you're broadcasting?
I don't know. Anyone want to comment on that?
Basically, I think you're correct in that you don't have a right as far as the reception goes.
You've sent it out there.
However, there are some laws that will conflict with that directly,
specifically the one regarding e-mail.
It's illegal to intercept e-mail if you're not the recipient,
if you're not one of the carriers, or you're not the one that's transmitting it.
And that's the real gray area.
If you capture it and you realize it's an e-mail, where are you crossing the line?
Because if you just get a header and it's an e-mail header,
and you say, oh jeez, I'm not going to read anymore, have you crossed the line?
I'd say maybe, maybe not.
If you go through the whole thing, you've probably definitely gone way past where you should have gone.
But if someone's just broadcasting everything that's going out there that they've been getting,
all their web surfing and all that, a lot of that's completely open.
That's their own problem.
I would add that I discuss this a little bit in my paper.
If you want to push the Computer Fraud and Abuse Act aside for a minute
and get down to common law issues like trespass,
there have been cases in which they've likened unauthorized access to trespass.
The views that come down there are if you're not protecting your access point
and taking steps to protect it,
then there's an implied authorization you're giving to the user.
And again, that relates to the point I made earlier about the debates about this unauthorized access business.
I would also add that I think that if you really boil it down to the bone right now,
the Feds can tap into the Internet without a warrant.
I mean, that's basically the way it stands right now.
So we can debate that endlessly.
But I think that if you really boil it down, that's really what's the bottom line.
So the Feds could tap into the Wi-Fi network without...
That's my current understanding.
But again, there's a lot of conflicting views about that.
Okay. Thank you. Any other questions?
Okay. One other issue I'm going to bring up again is this issue of who's responsible.
So I think what we've talked about here is the problem,
which is they try to make it easy for you to use Wi-Fi.
At the same point, they make it insecure.
So one of the things that I've talked about with several of the members of the panel here
is, in a sense, that we believe there needs to be a much stronger effort
on the part of the software and the hardware manufacturers
to change, in a sense, not only their marketing literature,
but change the way they ship this equipment and this software
so that, in a sense, security becomes the default.
I know we addressed that a little bit, but I'm asking that specific question.
Do they believe that if a case were to happen,
that we did have unauthorized access,
do you believe that the software and the hardware manufacturers
share some responsibility?
I don't think that the software and hardware manufacturers could be held directly liable.
The end user, you know, stupidity is not a valid defense.
If you didn't secure your access point,
and somebody ends up accidentally being on there intentionally,
my personal opinion is that if you leave it open
and you specify in the SSID that it's free access,
then go for it.
If it is not specifically telling you free access,
you know, surf me, anything like that,
take some pity on these people.
You've probably got high-speed internet at home.
You don't need to mooch off of other people.
Hotels have Wi-Fi, usually.
There are much better ways of doing it
than, you know, trouncing around in this legal gray area
and get yourself in trouble.
At some point or another, it's going to be ubiquitous.
You know, we're just going to be able to open things up
and it's there, all nice and legal.
But for now, yeah, drive the two blocks down to the Kinko's or wherever
and use theirs.
Just cover your butt.
I just really wish I could have smacked Linksys around
a couple of years ago when they were putting this stuff out
because they just...
they seem to be the biggest part of the problem.
Their manuals are getting better,
but I still hold them responsible for so much of this
because they're making it so easy.
It's not even like you're having...
the tools are out there to break a lot of the security that's in place,
but they just make it so much easier for everybody.
As he said, if you have a Linksys at home,
Linksys out in the park, it just hops on there.
And suddenly people can suddenly commit a felony on their own.
The software and everything helps them.
They could very easily go too far
and start checking email, start realizing,
hey, I can use this as a launching point for other things.
Thank you. Robert?
I would just say that it's the job of the plaintiff's bar
to come up with a lot of these outlandish and bizarre theories of liability.
As any of you know from buying appliances like toasters and hairdryers
and pretty much anything nowadays, it's got warnings all over it,
that you, you know, really stupid stuff like, you know...
Do not iron pants while wearing...
Yeah, yeah. I mean, really, that's all there
because there's enough books to fill this room about product liability.
And the reason I mention that is that the whole idea here is to make...
well, maybe not everybody would agree with this,
but they're trying to make computers a newer appliance, right?
So to the extent that that keeps getting pushed,
it's not inconceivable that you could come up with some kind of theory like that.
So I think it's extremely unlikely that Linksys or other companies
ever come under any kind of liability, but it's not impossible,
given the history of litigation within the product liability space.
But I completely agree with the points made that they really need to do more.
Doesn't mean we can't yell at them still, though.
Yeah, I would agree with that.
Like I said earlier, there's a certain amount of RTFM.
However, I also think the companies, as companies,
owe us something to get their product right.
And for all the abuse Microsoft takes on a lot of different things
that they absolutely deserve, the one thing they did right, in my opinion,
was with their Wi-Fi appliances.
They went to a default encrypted mode.
They were the first and the only product to do that.
I'd like to see the other products do that. I'd love to see it.
Thank you. Before we finish, I just want to know if any of you saw this article in the newspaper,
which we have up at our booth, that 10 more commandments were found.
And I'm not sure that anybody is aware of it, so we made up a T-shirt about it,
which I think really talks on what we're going for ethical war driving.
The 11th commandment.
Thou shalt not covet thy neighbor's Wi-Fi.
So...
Thank you all very much for coming.
If you're actually hoping to have some level of security by hiding your SSID,
I don't think that anyone would actually say that works as security.
You could make an argument, but it's just a matter of using a different tool to find it.
I don't think there would be enough there for anybody to complain
that I was trying to secure my stuff, why are you on here?
Do we have any other opinions on that question?
Okay.
Thank you all very much for coming.
Alright, we've got time for two more. Go ahead.
I really wish that they would.
I'm not a lawyer, but I've seen cases where companies will go in,
install wireless access all over the place in a business,
leave it wide open and walk away.
I don't think it's due diligence and it's not very professional.
The companies, I think, would probably be best sued civilly if something did happen.
Ethically, who are these people that are setting these things up insecurely?
They're supposed to be... you're hiring the expert.
Why aren't they reading the manual? Why aren't they doing what their job is?
I'd say two points. It's conceivable they would be held liable civilly, maybe.
The second thing I'd say is most of these laws have loopholes for...
you could say information security or technical loopholes to allow for these types of things.
So it's conceivable they could get immunity under something like that.
Yes.
Does that count as wiretapping?
It's conceivable? That's a topic I mentioned briefly in my paper.
Certainly, again, if you're going to find liability under CFAA, under the facts you described,
there's no reason why you wouldn't find it under the wiretap laws.
One of the points that we make in the beginning here is that
we know what we interpret some of these state and federal laws to be.
The question remains over the next few years how the courts will interpret them.
And we need to walk, as hackers and as people who advise people out in the field,
we need to walk a fine line and make sure that we're not going into an area which is gray
without knowing that we're going into a gray area.
Any other questions?
Okay. Thank you all very much. Enjoy DAPTCON.