start	end	text
7470	12510	We have four panelists. Myself, I'm Matthew Shuckman. I'm one of the founders of
12510	20430	WarDrivingWorld.com. We have RenderMan, a famous hacker and a superb war driver.
20550	25670	We have Robert Hale, who's a lawyer from San Francisco, who's written on this subject
25670	32850	of Wi-Fi and the law. And we have Frank Thornton, who is a former law enforcement
32850	37970	official and, as well, a great hacker. So we'll give some different perspectives.
42310	48410	Firstly, I'm going to ask if you can hold your questions until the end. We're only going
48410	51230	to have about 40 minutes, so we'll try to get through it so we can leave a few minutes
51230	52630	at the end for questions.
53470	59190	Firstly, the definition of what is war driving. And the simple definition of what is war
59190	63250	driving and whether you're walking around. There's been a lot of play with the verbs
63250	68910	here, whether you're driving around, whether you're walking around. It's the act of having
69130	74910	a laptop or a PC of some form and detecting other people's Wi-Fi signals and recording
74910	79510	some information about them. The simplest case was recording the information that the
79510	84990	access point is there, maybe the speed of transmission, and if you have a GPS, maybe
84990	94710	the location. So, there's been a lot of talk of whether war driving is legal. So, there
94710	101310	was a Doonesbury cartoon which covers this. And the question of, is war driving legal?
101510	104790	There have been a number of articles in the newspaper where you've seen that people have
104790	111510	been arrested for war driving. However, what I'll say is, with one exception, in each of
111510	116250	those cases, the people who were arrested for war driving were doing something else.
116470	121970	Some other nefarious activity, some crime. In this criminal activity, for instance, in
121970	128130	one case in Toronto, the man was spamming child pornography, but using somebody else's
128130	132670	Wi-Fi signal to get it out. We certainly can all agree that spamming child pornography
132670	137390	is a crime, and it's really not the war driving that's the issue, it's the other crime involved.
137390	143170	Another case involves two people who were grabbing credit card numbers off of a Wi-Fi
143170	148170	signal near a retail store. We'd all certainly agree they're stealing credit card information,
148170	154370	that's separate from the war driving. There's a recent case where a man in Tampa was outside
154370	161730	of somebody else's house, and he was caught, the man went out, the resident of the house
161730	166330	went out, found him outside and said, hmm, what are you doing here? But didn't say anything.
166330	169730	He then went out, drove his girlfriend home, came back, the man was still sitting there
169730	174810	in the van with the glow of a laptop screen, as the reports in the newspaper say. He called
174810	179510	the police, the police came by, whoever this guy was was not so smart, he didn't leave
179510	183650	after the first two times, and the police came by and they arrested him for war driving.
184030	188370	We're not sure what else he was doing, we're not even sure what was on the screen, but
188370	191810	when that case comes to trial later in the fall, maybe we'll know something about it.
191810	200910	There are a variety of laws, both at the state and federal level, which cover accessing
200910	206750	networks, both legal accessing of networks, and accessing a network that might not be
206750	211810	yours, where it's an illegal activity. Some of these laws have been extended and will
211810	217230	cover Wi-Fi access of networks, but not all of them. There have been some new laws that
217230	222590	have been brought into play, which will cover some of the distinctions with regard to Wi-Fi
222590	227710	access, but very few of these have had the chance to be tested yet in court. As any of
227710	231430	you who have had experience with the law knows, it's not what the law says, it's what becomes
231430	236690	the precedent within the judicial system. So, the first question I'm going to ask our
236690	243230	panelists is, if in the very simplest case, we're war driving, we're driving around
243230	251490	with a laptop, and we are accessing, and we are detecting access points, using a package
251490	256910	let's say like Marius Milner's NetStumbler, and recording the location, and something
256910	263950	about the signal, is this a legal activity? I'll first ask my first panelist, Renderman.
263950	274050	Just for clarification, I am from Canada, so my knowledge is mostly around Canadian
274050	280470	law, I'm not a lawyer, but in my research I found in Canada it's a lot more sanely written
280470	287190	laws than in the States in regards to this. Anything in the 2.4 gigahertz ISM band is
287190	293030	basically, it's public domain. It's free to transmit, free to receive, up to one watt.
293410	300430	Anything that is transmitted, if it's unencrypted, you can listen to legally. You cannot
300430	306850	disrupt, and you cannot decrypt if it is encrypted. But that's all the rules there are.
306850	313590	This very nicely frames basic war driving, because all we're doing is passively detecting
313590	318130	the signals from these networks, just listening to the information that they're
318130	323310	skewing out. We're not accessing them, because then at that point we get into computer
323310	329610	trespass laws. But the information coming in is nice and legal. Yeah, it's quite legal
329610	335230	where I'm from. Okay, thank you. Robert Hill. Yeah, I think I would just mention two
335230	339790	things. One quickly is, would it be a violation of the Computer Fraud and Abuse Act, which
339790	344930	is kind of the bible of a lot of this stuff. You have to show unauthorized access, you
344930	349970	have to show obtaining information, and you have to show damages. So, Render just nicely
349970	355030	outlined, although it might not be in the Canadian context, you could, I think in the
355030	360550	worst case scenario, maybe prove something there. Was the access authorized? Well, if
360550	364750	they didn't have any kind of protection up around their access point, you might be able
364750	369470	to squeeze that in. Obtaining information seems pretty weak. Again, what are you actually
369990	374890	doing with the router? It's pretty minor. And then, where are the damages? So, it's
375670	381250	pretty attenuated. However, I will say this. I think to the extent that an organized group
381250	384950	that's setting up, and again, I said this is a worst case scenario, that's setting up
384950	390150	kind of a, you know, showing people where a bunch of wireless access points are, it's
390150	398070	conceivable that some very zealous or overzealous authorities might view that as a facilitation
399370	405430	of bad acts. Although they're not doing a bad act, they might be able to say it's conspiracy
405430	412070	or aiding and abetting. I know it sounds pretty horrible, but it's certainly not unreasonable
412070	416450	or irrational or inconceivable. So, those are the two things I would say.
416450	418490	Thank you. Thorne?
418710	425510	Hi. From my standpoint, especially with my background in law enforcement, my interpretation
425510	430090	of this, and not being an attorney, but being someone that is familiar with interpreting
430090	438830	laws, is that this is completely legal to just detect and to record locations. I think
439830	444770	a prosecutor would have a real hard time pushing it out to the effect that you're doing something
444770	451530	nasty by recording this stuff. It's probably a lot more information that is publicly available
451530	457270	in a phone book that would cause a lot more damage than someone just going down the street
457270	461990	and detecting whether there's an access point near a particular location.
463510	475280	Thank you. Okay, that's the simplest case. Now let's take the next case. Let's say that
475280	480500	we have a situation where I'm still... there's a situation where we can set up something
480500	485720	called promiscuous mode. Promiscuous mode is not as dirty as it sounds. Promiscuous
485720	492840	mode is that some Wi-Fi devices, cards, can be set to listen to any packet coming across.
492840	496520	And they do it passively. They don't send back an acknowledgement packet. So you're
496520	501440	simply receiving everything that's out there in the ether. So I'm receiving these packets
502020	508460	and I'm receiving them for the purpose of pulling them down onto my PC and what I want
508460	515320	to do is to break... is to crack the encryption. I'm simply doing it for the sport. I'm not
515320	519600	interested in going onto that person's network and stealing any information from them. It's
519600	523760	for the purpose of receiving information that's being broadcast out to me in the free air
523760	530340	waves, as Doonesbury said, but for the sport of being able to crack the web. Is that a
530340	541140	legal activity? Renderman? In Canada, basically it's free reign and the ISM ban and capturing
541140	549560	anything that you want within reason in that spectrum is perfectly legal. You cannot divulge
549560	558320	to other persons what you capture and you cannot decrypt the information you do receive.
558320	564420	Those are the only two provisions. If you're just looking at screen dumps of the packets
564420	569720	going by, seeing what web pages people are looking at, things like that, that's all perfectly
569720	574660	legal. It's entirely passive, you're not disrupting, you're not doing anything that I can tell
574660	579880	is legally bad. When you start getting into cracking WEP, if it's something that is not
579880	584320	your access point, not your property and no permission, definitely you're starting to
584320	590840	get out of the Radio Communication Act more into the preparatory stages for computer intrusion,
590840	599700	so computer trespass laws. You could probably argue the case that having the two tools,
599700	605020	like Aircrack and a dump file, themselves are not illegal. However, having processed
605020	609460	the dump file through Aircrack and having the key, then they'd probably want to speak
609460	614080	to you. But you'd really have to get somebody's attention to have them go after that. It wouldn't
614080	618000	be worth their time, just if you're doing it for sport. Not something I'd recommend,
618000	621660	because if you've got the wireless gear to go out and collect this stuff anyways, you've
621660	625280	probably got an access point at home and can tinker around in your own lab, rather than
625280	630160	driving halfway across the city and doing it there. I'd rather sit at home in air conditioning.
631100	638620	Thank you. Robert? I would talk to three things, mainly the CFAA elements, then, again, the
638620	642440	sort of conspiracy enterprise theory, and then also, really, public policy. I think
642440	646940	from the CFAA standpoint, again, we just go through our elements. We've got unauthorized
646940	652600	access. Yes, we do have unauthorized access. Obtaining information, there's a case that
652600	659920	controls CFAA that says even looking at information is obtaining it. Is that the right decision?
660140	663660	Again, we could debate that, but that is the president. So if you're just looking at it,
663660	668620	as Render said, you've satisfied that element of the CFAA. Then you have your damages. Now,
668620	675560	through that act of cracking the encryption, the user is then led to have to spend a lot of
675560	682160	money to reconfigure their system or something. Again, it's a stretch, but you could say that
682160	686560	you have damages there. Now, moving on to the conspiracy part, again, if you have a group
686560	691420	of people doing this, and again, they may, some of them, say it's for sport, but there's
691420	696520	kind of a gray area there. I could see the feds coming in and saying, you know, you guys
696520	701040	are aiding and abetting. You say you might not be doing anything bad, but if you know
701040	704800	that something bad is going to occur down the line, you're aiding and abetting bad actors.
705080	710020	The third thing I'd say is that really, since, and we're going to get to this in your third
710020	716460	segment, the public policy aspect, you want these companies to develop tools to enable
716460	721020	the user to protect their access point. So to the extent that you go around cracking
721020	724540	them, I mean, it might be contrary to public policy, but you could also argue that it
724540	728400	facilitates a good public policy. But we'll debate that next.
730100	734680	My view on this portion of it is when you start getting into, if you're just receiving
734680	741620	straight data without any encryption on it, you're probably completely okay. You may be
741620	748000	treading into an area of a problem if you start reading email, which is completely,
748000	754020	clearly illegal under a couple of different laws. However, if you're just getting a packet
754020	757820	and you're looking at a packet, seeing what it is, you're probably all right.
758040	765420	When you start doing the web breaking, you're crossing into a real gray area in my mind.
765420	772480	And I think that having worked with prosecutors, that would show clear intent in their mind
772480	777620	if they were going to try and grab someone for doing something. The fact that someone
777620	783320	went out and was breaking web on someone that they did not know, they did not have permission,
784170	790160	most prosecutors would say that that is a clear intent to commit a further criminal act.
792000	801200	Thank you. Now we get to what I think is the most interesting question here, from my perspective.
801200	808060	Which is, if you were to go out and purchase a typical Linksys or Belkin router, you'd find
808060	815480	that the SSID, that is the name given to the router, is usually either default, or in the
815480	823940	Linksys case, I believe it's Linksys. A consumer goes, buys that router, sets it up at home,
823940	830100	follows all the instructions, goes into their Windows XP machine, and sets it to access
830100	837560	their Linksys router. No protection is set, they check the box, and it links up to their
837560	843100	router. Now, a week later, they go out and they take their laptop, and they're sitting in a park
843100	851340	in another part of town, working on their own PC, and the laptop detects another consumer
851340	857180	who's done the same thing in the area. And it, of course, thinks, oh, I have a router named Linksys,
857180	864240	it's not protected, I've already been programmed. And what does Microsoft's operating system do?
864240	872340	It grabs onto that signal, and connects you directly to the Internet. So, the question is, one,
872340	878160	I've done nothing active, I've simply followed the instructions that Microsoft and Linksys gave me.
878520	885480	Have I done anything wrong? And then the question becomes, who is responsible? Is it the person
885480	891600	who manufactures, is it the person who is accessing the signal? Is it the consumer or the business
891600	896840	which happened to follow Linksys' and Microsoft's instructions and set up their router that way?
897180	905400	Is it the hardware manufacturer? Should they have set security as a default, rather than insecurity
905400	912320	as a default? Or is it the responsibility of the operating system not to automatically jump on
912320	917720	to somebody's router without asking permission each time? So, it's an interesting question,
917720	923380	not only from a legal standpoint, but also from a public policy standpoint. Thank you.
923380	929840	I don't think any sane person would want to hold a consumer responsible for an accidental
929840	933560	connection like that. If they open up their laptop and get the little bubble that says,
933560	939740	you're now connected, and they realize, oops, this isn't my network, and they log off or disconnect,
940320	945740	I don't think anyone would ever try to convict somebody for that. However, if they decide,
945740	951580	hey, I'm on a network, I want to check my email, and then they go forward, yeah, that's theft of service,
951580	957740	plain and simple. The consumer should have enough brainpower to realize that, yeah, you've
957740	963560	towed up to that line, let's not cross it. I personally blame a lot of the manufacturers.
964680	968360	Linksys is probably the worst. Everybody's probably heard of the Linksys Global Network.
968360	973940	60% of the access points out there are Linksys. Most of them are on default.
976260	980760	They bury the security warnings in the manuals. They're not easy to set up.
981500	986680	Different manufacturers have different high-level encryptions and everything.
986680	990620	They don't play nice together. It just gets really confusing for the customers.
990760	996440	I actually, sadly, have to give props to Microsoft. When they were in the wireless gear development
996440	1001560	and stuff, and they were selling their routers and cards, their software wizard that came up,
1001560	1008400	you specifically had to tell it, no, I don't want web on. By default, it would ask you for a key for
1008400	1016760	your security. You had to specifically tell it, no. So just by not going for insecure by default,
1016760	1021840	I think they did a really good job. However, everybody that had built-in wireless cards
1021840	1028500	and had some sort of 128-bit, tried to set 128-bit encryption, because different manufacturers
1028500	1034300	were using different methods to get 128-bit at the time, nobody could get on it.
1034300	1039560	So if they set the security as high as they could or couldn't connect, okay, I'll just turn it off and leave it.
1039980	1046220	So there's a lot of these companies that I think just need to sit down, readdress what they're doing.
1047200	1052940	They're not taking care of their customers. They're intentionally putting them in harm's way.
1052940	1058180	I'm just waiting for the first day that somebody is convicted for having an open access point
1058180	1064820	and facilitating a crime. I don't know if that's within the realm of law, but I could see somebody
1064820	1071920	even civilly, if company A gets attacked by a bad person through my access point,
1071920	1078780	can company A sue me civilly for facilitating the access? It's a scary thing.
1079080	1080580	Thank you. Robert?
1080620	1085260	Yeah, I think with respect to the users, that that's really the risk there.
1085960	1092300	But to the extent we're going to hold Linksys liable, they relate, because Linksys ships these things
1092300	1098060	with the default, and they do it for a reason, because they're advertising a product
1098060	1102840	that will provide ubiquitous Wi-Fi access.
1103180	1105060	People just want it to work.
1105060	1113820	Yeah, they really do. So you've got that smashing up against the real implications of shipping this stuff
1113820	1120900	the way they do. So I think that to the extent that they start to make it easier for the users
1120900	1130360	to implement quickly with some sort of restrictions, then you might get into a case, as you described,
1130360	1135420	where there would be some liability on the WAP operator, even if it's someone in their house.
1136320	1141820	As far as holding Linksys liable, I certainly think pressure is coming onto them.
1142660	1147380	I mentioned in my paper that there's a consortium to develop some kind of product
1147380	1153780	that's going to add onto the router to make it easier for people to implement security.
1153780	1158040	Whether that's going to be any good, I don't know anyway.
1158040	1165800	And again, the efforts to hold ISPs and manufacturers liable in the past
1167160	1173040	haven't gone really anywhere, except for when they're going after monopoly-type situations.
1173040	1177080	So that would be my view at this time.
1179000	1188500	You know, a lot of this has come about because 802.11 has been a victim of its own success.
1188880	1194780	I think a lot of the manufacturers originally envisioned setting these things
1194780	1199140	basically as a very short-range item that would work only in a house.
1200580	1205460	And people are going out using them in places they never dreamed of.
1205520	1207360	The manufacturers never dreamed of.
1207360	1212300	So it's going out, it's being used a lot more than it was ever anticipated,
1212300	1217420	and the technology implemented was never intended to be used this way.
1217420	1220740	So we've got kind of conflicting things going on here.
1221400	1225440	On the other hand, I think there's a certain amount of responsibility of the operator.
1225440	1230800	There's this very old thing that I think you've probably all heard called RTFM.
1231200	1235480	You have to be able to operate your own equipment properly.
1235480	1238460	You're supposed to be able to figure out what's going on with it.
1238460	1244120	While I would agree that the manufacturers owe responsibility to the general public to get this stuff right,
1244120	1249760	the operators do have some responsibility in getting it right themselves.
1251280	1252460	Thank you.
1252460	1260460	I think the questions that we begin to ask ourselves as fellow hackers are,
1261380	1265820	although it's not totally independent of what the law requires of us, is
1265820	1271780	what is the definition of ethical war driving?
1272080	1277300	And that's something which our friend RenderMan here has given a first stab at.
1278080	1284520	But it becomes a question of, in a sense, the law hasn't quite caught up with Wi-Fi, as you can see.
1284520	1289680	So the question is, how do we, as hackers, act in an ethical manner?
1289980	1296100	Now in the first step, we do, kind of like John Muir said,
1296100	1300880	we have to walk softly and not leave too many footprints in the sand.
1300880	1305720	On the other hand, the act of cracking a web, we're pretty soft.
1305720	1309580	No one really knows we're there until we've actually cracked the web.
1309640	1311980	So it's a very interesting question.
1312540	1314840	Are there any questions?
1337980	1343120	If it's the one I'm thinking of, what I've heard is it's basically
1343120	1351680	the telecoms are trying to fight municipalities from getting in to what they consider their business.
1353820	1361060	It's one of these private enterprise versus giving away something on a municipal level.
1362520	1365120	I've got mixed feelings about some of that stuff.
1365120	1372300	As much as I'd like to have free access everywhere, I don't particularly want my tax dollars going for it.
1372300	1376120	I'm one of those people that I hate paying taxes.
1376800	1380660	And where I am, I get minimal services anyways for what I get.
1381140	1384900	I'm not sure I want to pay more for something I may not use.
1386480	1392140	I just think that we can all agree that this sort of stuff would be really nice if it was like a utility.
1392140	1395940	Like phone, power, water. You turn it on, it's there.
1396360	1401840	I think it's a good step for municipalities to realize that internet access is not just going to go away.
1401840	1403940	You might as well start providing it for everybody.
1404220	1406600	There's already enough internet access.
1406600	1410740	If one wanted to do really bad things with wireless, you could get internet access anywhere.
1410740	1414140	Let's just organize it and do this sanely.
1414140	1418640	It is just a money grab by the telcos trying to hold on to their old school monopoly.
1419140	1421760	Because now they don't have the wires to control.
1422140	1424100	There's a limit that they can do.
1424100	1427640	They're just trying to stem the tide as long as they possibly can.
1428080	1430260	I don't know of anything like this in Canada.
1430360	1432600	I honestly hope it doesn't go through down here.
1432600	1440300	I would just add that I think an interesting legal concept comes into view if you do move toward a municipality model.
1440300	1447100	It's called sovereign immunity, which the government essentially can't be held liable even for negligence.
1447320	1452940	Something to think about for those of you who await government control of the internet.
1453040	1455440	So government control of the internet would actually be a positive.
1455440	1459360	It might be if you're looking to have a good time.
1459360	1462340	I think a lot of it depends on how it's set up, who's running it.
1462340	1465020	Thank you.
1465020	1467470	Before we get to the next question, I wanted Robert...
1468080	1470320	Robert Hale has written an article on this.
1470320	1476020	If you look in the CD that you got with Defcon, there are some pieces written by RenderMan on a first stab,
1476020	1480240	which I think is great, at a hacker code of ethics for war driving.
1480320	1486680	As well as Robert Hale has an article on this, which delves into some of the issues.
1487040	1491120	But I wanted Robert to comment on the Computer Fraud and Abuse Act.
1491120	1497660	Because if I recall reading, there's a part in the CFAA which basically says that
1497660	1503800	it shall not be a crime to access a Wi-Fi signal that is unencrypted.
1503820	1505900	Can you comment on that?
1506320	1513780	You know, what I will focus in on, that makes sense.
1513780	1518840	That seems consistent with a lot of the things that I've read and what we've been talking about.
1518840	1526440	I think probably the biggest unknown there is what the definition of unauthorized access is.
1527300	1530100	There's a huge disparity of opinion.
1530660	1534760	The Act doesn't define it, as anybody who's delved into it knows.
1535120	1539440	And they really left it up to the courts to come up with a definition.
1539440	1545640	And as a result, there is a very, very wide spectrum of views on what that unauthorized access is.
1545640	1550360	And the crux of it is that, is the user, when they approach the Internet,
1550360	1555000	are they in the default position of being unauthorized?
1555640	1558040	Or is it the exact opposite?
1558040	1566860	That unless something on the Internet end gives some kind of a signal to the user that you can't come in here,
1566860	1572380	is the default of the user coming in, actually, I have open access?
1572380	1577120	So it really comes down to a policy debate about whether the Internet's open or not.
1578220	1580820	And there's a paper that I refer to in my paper.
1580820	1586440	If you want to get into excruciating detail on the status of what unauthorized access means,
1586440	1589200	I would point you to that for further detail.
1589300	1595060	But irrespective of what some commentary on the CFA may say,
1595060	1598140	I really think that the future of where this is going to go, at least at that level,
1598140	1599940	is going to come down to unauthorized access.
1601580	1602460	Yes?
1603220	1604100	I've heard...
1604660	1606840	Can you stand up? I can't hear. Sorry.
1606900	1635370	I've heard.
1635570	1641390	So your question is that if you're broadcasting it and it's unencrypted,
1641390	1644410	you don't have the right of privacy to what you're broadcasting?
1644830	1646870	I don't know. Anyone want to comment on that?
1649110	1654510	Basically, I think you're correct in that you don't have a right as far as the reception goes.
1654930	1656350	You've sent it out there.
1656350	1660170	However, there are some laws that will conflict with that directly,
1660170	1662370	specifically the one regarding e-mail.
1663590	1668330	It's illegal to intercept e-mail if you're not the recipient,
1668330	1672610	if you're not one of the carriers, or you're not the one that's transmitting it.
1676920	1679140	And that's the real gray area.
1679140	1686200	If you capture it and you realize it's an e-mail, where are you crossing the line?
1686200	1689360	Because if you just get a header and it's an e-mail header,
1689360	1693900	and you say, oh jeez, I'm not going to read anymore, have you crossed the line?
1694340	1696400	I'd say maybe, maybe not.
1696600	1701160	If you go through the whole thing, you've probably definitely gone way past where you should have gone.
1703100	1708340	But if someone's just broadcasting everything that's going out there that they've been getting,
1708340	1711360	all their web surfing and all that, a lot of that's completely open.
1711360	1712680	That's their own problem.
1713320	1717740	I would add that I discuss this a little bit in my paper.
1718060	1721500	If you want to push the Computer Fraud and Abuse Act aside for a minute
1721500	1724680	and get down to common law issues like trespass,
1725280	1732300	there have been cases in which they've likened unauthorized access to trespass.
1734480	1739680	The views that come down there are if you're not protecting your access point
1739680	1741740	and taking steps to protect it,
1741740	1745220	then there's an implied authorization you're giving to the user.
1745600	1753700	And again, that relates to the point I made earlier about the debates about this unauthorized access business.
1753700	1757920	I would also add that I think that if you really boil it down to the bone right now,
1757920	1760320	the Feds can tap into the Internet without a warrant.
1760320	1762760	I mean, that's basically the way it stands right now.
1762760	1764940	So we can debate that endlessly.
1764940	1768640	But I think that if you really boil it down, that's really what's the bottom line.
1768640	1772640	So the Feds could tap into the Wi-Fi network without...
1773540	1775300	That's my current understanding.
1775300	1778820	But again, there's a lot of conflicting views about that.
1778940	1781760	Okay. Thank you. Any other questions?
1784340	1789920	Okay. One other issue I'm going to bring up again is this issue of who's responsible.
1790220	1794520	So I think what we've talked about here is the problem,
1794520	1798280	which is they try to make it easy for you to use Wi-Fi.
1798280	1801380	At the same point, they make it insecure.
1801960	1805760	So one of the things that I've talked about with several of the members of the panel here
1805760	1810060	is, in a sense, that we believe there needs to be a much stronger effort
1810060	1813960	on the part of the software and the hardware manufacturers
1813960	1819380	to change, in a sense, not only their marketing literature,
1819380	1822800	but change the way they ship this equipment and this software
1822800	1826200	so that, in a sense, security becomes the default.
1826200	1829660	I know we addressed that a little bit, but I'm asking that specific question.
1829660	1832280	Do they believe that if a case were to happen,
1832940	1835460	that we did have unauthorized access,
1835460	1838460	do you believe that the software and the hardware manufacturers
1838460	1840720	share some responsibility?
1842140	1847020	I don't think that the software and hardware manufacturers could be held directly liable.
1847560	1851420	The end user, you know, stupidity is not a valid defense.
1851420	1853700	If you didn't secure your access point,
1853700	1860900	and somebody ends up accidentally being on there intentionally,
1860900	1864720	my personal opinion is that if you leave it open
1865580	1869060	and you specify in the SSID that it's free access,
1869060	1870160	then go for it.
1870160	1873980	If it is not specifically telling you free access,
1873980	1876000	you know, surf me, anything like that,
1876000	1877520	take some pity on these people.
1877520	1879020	You've probably got high-speed internet at home.
1879020	1880640	You don't need to mooch off of other people.
1880640	1883040	Hotels have Wi-Fi, usually.
1884100	1886660	There are much better ways of doing it
1886660	1889620	than, you know, trouncing around in this legal gray area
1889620	1891080	and get yourself in trouble.
1891780	1895500	At some point or another, it's going to be ubiquitous.
1895500	1897000	You know, we're just going to be able to open things up
1897000	1899620	and it's there, all nice and legal.
1899620	1902700	But for now, yeah, drive the two blocks down to the Kinko's or wherever
1902700	1904300	and use theirs.
1904840	1906360	Just cover your butt.
1906440	1909340	I just really wish I could have smacked Linksys around
1909700	1911960	a couple of years ago when they were putting this stuff out
1911960	1914080	because they just...
1914080	1916140	they seem to be the biggest part of the problem.
1916140	1917840	Their manuals are getting better,
1917840	1920700	but I still hold them responsible for so much of this
1920700	1923200	because they're making it so easy.
1923700	1925140	It's not even like you're having...
1925140	1928360	the tools are out there to break a lot of the security that's in place,
1928360	1931060	but they just make it so much easier for everybody.
1931380	1935220	As he said, if you have a Linksys at home,
1935220	1937820	Linksys out in the park, it just hops on there.
1937820	1941180	And suddenly people can suddenly commit a felony on their own.
1941180	1943400	The software and everything helps them.
1943520	1945740	They could very easily go too far
1945740	1948640	and start checking email, start realizing,
1948640	1951720	hey, I can use this as a launching point for other things.
1952520	1953800	Thank you. Robert?
1953800	1956720	I would just say that it's the job of the plaintiff's bar
1956720	1962660	to come up with a lot of these outlandish and bizarre theories of liability.
1962660	1966060	As any of you know from buying appliances like toasters and hairdryers
1966060	1969800	and pretty much anything nowadays, it's got warnings all over it,
1969800	1973060	that you, you know, really stupid stuff like, you know...
1973060	1975420	Do not iron pants while wearing...
1975420	1977840	Yeah, yeah. I mean, really, that's all there
1977840	1982520	because there's enough books to fill this room about product liability.
1982520	1985980	And the reason I mention that is that the whole idea here is to make...
1985980	1988520	well, maybe not everybody would agree with this,
1988520	1991160	but they're trying to make computers a newer appliance, right?
1991160	1996880	So to the extent that that keeps getting pushed,
1996880	2001240	it's not inconceivable that you could come up with some kind of theory like that.
2001240	2003980	So I think it's extremely unlikely that Linksys or other companies
2003980	2008220	ever come under any kind of liability, but it's not impossible,
2008220	2012200	given the history of litigation within the product liability space.
2012200	2017180	But I completely agree with the points made that they really need to do more.
2017180	2019320	Doesn't mean we can't yell at them still, though.
2019860	2021960	Yeah, I would agree with that.
2022020	2025760	Like I said earlier, there's a certain amount of RTFM.
2025760	2028960	However, I also think the companies, as companies,
2028960	2031920	owe us something to get their product right.
2032120	2035320	And for all the abuse Microsoft takes on a lot of different things
2035320	2039200	that they absolutely deserve, the one thing they did right, in my opinion,
2039200	2041780	was with their Wi-Fi appliances.
2041800	2045980	They went to a default encrypted mode.
2046240	2048640	They were the first and the only product to do that.
2049120	2052600	I'd like to see the other products do that. I'd love to see it.
2053640	2058440	Thank you. Before we finish, I just want to know if any of you saw this article in the newspaper,
2058440	2062000	which we have up at our booth, that 10 more commandments were found.
2062400	2067100	And I'm not sure that anybody is aware of it, so we made up a T-shirt about it,
2067100	2071160	which I think really talks on what we're going for ethical war driving.
2071160	2072660	The 11th commandment.
2072700	2075520	Thou shalt not covet thy neighbor's Wi-Fi.
2076000	2076440	So...
2079980	2082160	Thank you all very much for coming.
2099240	2103440	If you're actually hoping to have some level of security by hiding your SSID,
2103440	2107120	I don't think that anyone would actually say that works as security.
2107940	2112340	You could make an argument, but it's just a matter of using a different tool to find it.
2112860	2117740	I don't think there would be enough there for anybody to complain
2120680	2124620	that I was trying to secure my stuff, why are you on here?
2127360	2129760	Do we have any other opinions on that question?
2131380	2131740	Okay.
2132320	2134200	Thank you all very much for coming.
2134200	2137400	Alright, we've got time for two more. Go ahead.
2153160	2155420	I really wish that they would.
2155540	2159380	I'm not a lawyer, but I've seen cases where companies will go in,
2159380	2162740	install wireless access all over the place in a business,
2162740	2164880	leave it wide open and walk away.
2164940	2167680	I don't think it's due diligence and it's not very professional.
2168300	2172460	The companies, I think, would probably be best sued civilly if something did happen.
2173760	2177080	Ethically, who are these people that are setting these things up insecurely?
2177080	2179220	They're supposed to be... you're hiring the expert.
2179220	2182940	Why aren't they reading the manual? Why aren't they doing what their job is?
2183240	2187500	I'd say two points. It's conceivable they would be held liable civilly, maybe.
2187560	2191680	The second thing I'd say is most of these laws have loopholes for...
2193460	2202220	you could say information security or technical loopholes to allow for these types of things.
2202220	2205040	So it's conceivable they could get immunity under something like that.
2207060	2207820	Yes.
2216300	2218540	Does that count as wiretapping?
2218780	2222760	It's conceivable? That's a topic I mentioned briefly in my paper.
2222760	2227320	Certainly, again, if you're going to find liability under CFAA, under the facts you described,
2227320	2230100	there's no reason why you wouldn't find it under the wiretap laws.
2230200	2233780	One of the points that we make in the beginning here is that
2234580	2239720	we know what we interpret some of these state and federal laws to be.
2239720	2244160	The question remains over the next few years how the courts will interpret them.
2244400	2249000	And we need to walk, as hackers and as people who advise people out in the field,
2249000	2253400	we need to walk a fine line and make sure that we're not going into an area which is gray
2253400	2256080	without knowing that we're going into a gray area.
2256080	2258260	Any other questions?
2259340	2263160	Okay. Thank you all very much. Enjoy DAPTCON.