[00:07.470 --> 00:12.510] We have four panelists. Myself, I'm Matthew Shuckman. I'm one of the founders of [00:12.510 --> 00:20.430] WarDrivingWorld.com. We have RenderMan, a famous hacker and a superb war driver. [00:20.550 --> 00:25.670] We have Robert Hale, who's a lawyer from San Francisco, who's written on this subject [00:25.670 --> 00:32.850] of Wi-Fi and the law. And we have Frank Thornton, who is a former law enforcement [00:32.850 --> 00:37.970] official and, as well, a great hacker. So we'll give some different perspectives. [00:42.310 --> 00:48.410] Firstly, I'm going to ask if you can hold your questions until the end. We're only going [00:48.410 --> 00:51.230] to have about 40 minutes, so we'll try to get through it so we can leave a few minutes [00:51.230 --> 00:52.630] at the end for questions. [00:53.470 --> 00:59.190] Firstly, the definition of what is war driving. And the simple definition of what is war [00:59.190 --> 01:03.250] driving and whether you're walking around. There's been a lot of play with the verbs [01:03.250 --> 01:08.910] here, whether you're driving around, whether you're walking around. It's the act of having [01:09.130 --> 01:14.910] a laptop or a PC of some form and detecting other people's Wi-Fi signals and recording [01:14.910 --> 01:19.510] some information about them. The simplest case was recording the information that the [01:19.510 --> 01:24.990] access point is there, maybe the speed of transmission, and if you have a GPS, maybe [01:24.990 --> 01:34.710] the location. So, there's been a lot of talk of whether war driving is legal. So, there [01:34.710 --> 01:41.310] was a Doonesbury cartoon which covers this. And the question of, is war driving legal? [01:41.510 --> 01:44.790] There have been a number of articles in the newspaper where you've seen that people have [01:44.790 --> 01:51.510] been arrested for war driving. However, what I'll say is, with one exception, in each of [01:51.510 --> 01:56.250] those cases, the people who were arrested for war driving were doing something else. [01:56.470 --> 02:01.970] Some other nefarious activity, some crime. In this criminal activity, for instance, in [02:01.970 --> 02:08.130] one case in Toronto, the man was spamming child pornography, but using somebody else's [02:08.130 --> 02:12.670] Wi-Fi signal to get it out. We certainly can all agree that spamming child pornography [02:12.670 --> 02:17.390] is a crime, and it's really not the war driving that's the issue, it's the other crime involved. [02:17.390 --> 02:23.170] Another case involves two people who were grabbing credit card numbers off of a Wi-Fi [02:23.170 --> 02:28.170] signal near a retail store. We'd all certainly agree they're stealing credit card information, [02:28.170 --> 02:34.370] that's separate from the war driving. There's a recent case where a man in Tampa was outside [02:34.370 --> 02:41.730] of somebody else's house, and he was caught, the man went out, the resident of the house [02:41.730 --> 02:46.330] went out, found him outside and said, hmm, what are you doing here? But didn't say anything. [02:46.330 --> 02:49.730] He then went out, drove his girlfriend home, came back, the man was still sitting there [02:49.730 --> 02:54.810] in the van with the glow of a laptop screen, as the reports in the newspaper say. He called [02:54.810 --> 02:59.510] the police, the police came by, whoever this guy was was not so smart, he didn't leave [02:59.510 --> 03:03.650] after the first two times, and the police came by and they arrested him for war driving. [03:04.030 --> 03:08.370] We're not sure what else he was doing, we're not even sure what was on the screen, but [03:08.370 --> 03:11.810] when that case comes to trial later in the fall, maybe we'll know something about it. [03:11.810 --> 03:20.910] There are a variety of laws, both at the state and federal level, which cover accessing [03:20.910 --> 03:26.750] networks, both legal accessing of networks, and accessing a network that might not be [03:26.750 --> 03:31.810] yours, where it's an illegal activity. Some of these laws have been extended and will [03:31.810 --> 03:37.230] cover Wi-Fi access of networks, but not all of them. There have been some new laws that [03:37.230 --> 03:42.590] have been brought into play, which will cover some of the distinctions with regard to Wi-Fi [03:42.590 --> 03:47.710] access, but very few of these have had the chance to be tested yet in court. As any of [03:47.710 --> 03:51.430] you who have had experience with the law knows, it's not what the law says, it's what becomes [03:51.430 --> 03:56.690] the precedent within the judicial system. So, the first question I'm going to ask our [03:56.690 --> 04:03.230] panelists is, if in the very simplest case, we're war driving, we're driving around [04:03.230 --> 04:11.490] with a laptop, and we are accessing, and we are detecting access points, using a package [04:11.490 --> 04:16.910] let's say like Marius Milner's NetStumbler, and recording the location, and something [04:16.910 --> 04:23.950] about the signal, is this a legal activity? I'll first ask my first panelist, Renderman. [04:23.950 --> 04:34.050] Just for clarification, I am from Canada, so my knowledge is mostly around Canadian [04:34.050 --> 04:40.470] law, I'm not a lawyer, but in my research I found in Canada it's a lot more sanely written [04:40.470 --> 04:47.190] laws than in the States in regards to this. Anything in the 2.4 gigahertz ISM band is [04:47.190 --> 04:53.030] basically, it's public domain. It's free to transmit, free to receive, up to one watt. [04:53.410 --> 05:00.430] Anything that is transmitted, if it's unencrypted, you can listen to legally. You cannot [05:00.430 --> 05:06.850] disrupt, and you cannot decrypt if it is encrypted. But that's all the rules there are. [05:06.850 --> 05:13.590] This very nicely frames basic war driving, because all we're doing is passively detecting [05:13.590 --> 05:18.130] the signals from these networks, just listening to the information that they're [05:18.130 --> 05:23.310] skewing out. We're not accessing them, because then at that point we get into computer [05:23.310 --> 05:29.610] trespass laws. But the information coming in is nice and legal. Yeah, it's quite legal [05:29.610 --> 05:35.230] where I'm from. Okay, thank you. Robert Hill. Yeah, I think I would just mention two [05:35.230 --> 05:39.790] things. One quickly is, would it be a violation of the Computer Fraud and Abuse Act, which [05:39.790 --> 05:44.930] is kind of the bible of a lot of this stuff. You have to show unauthorized access, you [05:44.930 --> 05:49.970] have to show obtaining information, and you have to show damages. So, Render just nicely [05:49.970 --> 05:55.030] outlined, although it might not be in the Canadian context, you could, I think in the [05:55.030 --> 06:00.550] worst case scenario, maybe prove something there. Was the access authorized? Well, if [06:00.550 --> 06:04.750] they didn't have any kind of protection up around their access point, you might be able [06:04.750 --> 06:09.470] to squeeze that in. Obtaining information seems pretty weak. Again, what are you actually [06:09.990 --> 06:14.890] doing with the router? It's pretty minor. And then, where are the damages? So, it's [06:15.670 --> 06:21.250] pretty attenuated. However, I will say this. I think to the extent that an organized group [06:21.250 --> 06:24.950] that's setting up, and again, I said this is a worst case scenario, that's setting up [06:24.950 --> 06:30.150] kind of a, you know, showing people where a bunch of wireless access points are, it's [06:30.150 --> 06:38.070] conceivable that some very zealous or overzealous authorities might view that as a facilitation [06:39.370 --> 06:45.430] of bad acts. Although they're not doing a bad act, they might be able to say it's conspiracy [06:45.430 --> 06:52.070] or aiding and abetting. I know it sounds pretty horrible, but it's certainly not unreasonable [06:52.070 --> 06:56.450] or irrational or inconceivable. So, those are the two things I would say. [06:56.450 --> 06:58.490] Thank you. Thorne? [06:58.710 --> 07:05.510] Hi. From my standpoint, especially with my background in law enforcement, my interpretation [07:05.510 --> 07:10.090] of this, and not being an attorney, but being someone that is familiar with interpreting [07:10.090 --> 07:18.830] laws, is that this is completely legal to just detect and to record locations. I think [07:19.830 --> 07:24.770] a prosecutor would have a real hard time pushing it out to the effect that you're doing something [07:24.770 --> 07:31.530] nasty by recording this stuff. It's probably a lot more information that is publicly available [07:31.530 --> 07:37.270] in a phone book that would cause a lot more damage than someone just going down the street [07:37.270 --> 07:41.990] and detecting whether there's an access point near a particular location. [07:43.510 --> 07:55.280] Thank you. Okay, that's the simplest case. Now let's take the next case. Let's say that [07:55.280 --> 08:00.500] we have a situation where I'm still... there's a situation where we can set up something [08:00.500 --> 08:05.720] called promiscuous mode. Promiscuous mode is not as dirty as it sounds. Promiscuous [08:05.720 --> 08:12.840] mode is that some Wi-Fi devices, cards, can be set to listen to any packet coming across. [08:12.840 --> 08:16.520] And they do it passively. They don't send back an acknowledgement packet. So you're [08:16.520 --> 08:21.440] simply receiving everything that's out there in the ether. So I'm receiving these packets [08:22.020 --> 08:28.460] and I'm receiving them for the purpose of pulling them down onto my PC and what I want [08:28.460 --> 08:35.320] to do is to break... is to crack the encryption. I'm simply doing it for the sport. I'm not [08:35.320 --> 08:39.600] interested in going onto that person's network and stealing any information from them. It's [08:39.600 --> 08:43.760] for the purpose of receiving information that's being broadcast out to me in the free air [08:43.760 --> 08:50.340] waves, as Doonesbury said, but for the sport of being able to crack the web. Is that a [08:50.340 --> 09:01.140] legal activity? Renderman? In Canada, basically it's free reign and the ISM ban and capturing [09:01.140 --> 09:09.560] anything that you want within reason in that spectrum is perfectly legal. You cannot divulge [09:09.560 --> 09:18.320] to other persons what you capture and you cannot decrypt the information you do receive. [09:18.320 --> 09:24.420] Those are the only two provisions. If you're just looking at screen dumps of the packets [09:24.420 --> 09:29.720] going by, seeing what web pages people are looking at, things like that, that's all perfectly [09:29.720 --> 09:34.660] legal. It's entirely passive, you're not disrupting, you're not doing anything that I can tell [09:34.660 --> 09:39.880] is legally bad. When you start getting into cracking WEP, if it's something that is not [09:39.880 --> 09:44.320] your access point, not your property and no permission, definitely you're starting to [09:44.320 --> 09:50.840] get out of the Radio Communication Act more into the preparatory stages for computer intrusion, [09:50.840 --> 09:59.700] so computer trespass laws. You could probably argue the case that having the two tools, [09:59.700 --> 10:05.020] like Aircrack and a dump file, themselves are not illegal. However, having processed [10:05.020 --> 10:09.460] the dump file through Aircrack and having the key, then they'd probably want to speak [10:09.460 --> 10:14.080] to you. But you'd really have to get somebody's attention to have them go after that. It wouldn't [10:14.080 --> 10:18.000] be worth their time, just if you're doing it for sport. Not something I'd recommend, [10:18.000 --> 10:21.660] because if you've got the wireless gear to go out and collect this stuff anyways, you've [10:21.660 --> 10:25.280] probably got an access point at home and can tinker around in your own lab, rather than [10:25.280 --> 10:30.160] driving halfway across the city and doing it there. I'd rather sit at home in air conditioning. [10:31.100 --> 10:38.620] Thank you. Robert? I would talk to three things, mainly the CFAA elements, then, again, the [10:38.620 --> 10:42.440] sort of conspiracy enterprise theory, and then also, really, public policy. I think [10:42.440 --> 10:46.940] from the CFAA standpoint, again, we just go through our elements. We've got unauthorized [10:46.940 --> 10:52.600] access. Yes, we do have unauthorized access. Obtaining information, there's a case that [10:52.600 --> 10:59.920] controls CFAA that says even looking at information is obtaining it. Is that the right decision? [11:00.140 --> 11:03.660] Again, we could debate that, but that is the president. So if you're just looking at it, [11:03.660 --> 11:08.620] as Render said, you've satisfied that element of the CFAA. Then you have your damages. Now, [11:08.620 --> 11:15.560] through that act of cracking the encryption, the user is then led to have to spend a lot of [11:15.560 --> 11:22.160] money to reconfigure their system or something. Again, it's a stretch, but you could say that [11:22.160 --> 11:26.560] you have damages there. Now, moving on to the conspiracy part, again, if you have a group [11:26.560 --> 11:31.420] of people doing this, and again, they may, some of them, say it's for sport, but there's [11:31.420 --> 11:36.520] kind of a gray area there. I could see the feds coming in and saying, you know, you guys [11:36.520 --> 11:41.040] are aiding and abetting. You say you might not be doing anything bad, but if you know [11:41.040 --> 11:44.800] that something bad is going to occur down the line, you're aiding and abetting bad actors. [11:45.080 --> 11:50.020] The third thing I'd say is that really, since, and we're going to get to this in your third [11:50.020 --> 11:56.460] segment, the public policy aspect, you want these companies to develop tools to enable [11:56.460 --> 12:01.020] the user to protect their access point. So to the extent that you go around cracking [12:01.020 --> 12:04.540] them, I mean, it might be contrary to public policy, but you could also argue that it [12:04.540 --> 12:08.400] facilitates a good public policy. But we'll debate that next. [12:10.100 --> 12:14.680] My view on this portion of it is when you start getting into, if you're just receiving [12:14.680 --> 12:21.620] straight data without any encryption on it, you're probably completely okay. You may be [12:21.620 --> 12:28.000] treading into an area of a problem if you start reading email, which is completely, [12:28.000 --> 12:34.020] clearly illegal under a couple of different laws. However, if you're just getting a packet [12:34.020 --> 12:37.820] and you're looking at a packet, seeing what it is, you're probably all right. [12:38.040 --> 12:45.420] When you start doing the web breaking, you're crossing into a real gray area in my mind. [12:45.420 --> 12:52.480] And I think that having worked with prosecutors, that would show clear intent in their mind [12:52.480 --> 12:57.620] if they were going to try and grab someone for doing something. The fact that someone [12:57.620 --> 13:03.320] went out and was breaking web on someone that they did not know, they did not have permission, [13:04.170 --> 13:10.160] most prosecutors would say that that is a clear intent to commit a further criminal act. [13:12.000 --> 13:21.200] Thank you. Now we get to what I think is the most interesting question here, from my perspective. [13:21.200 --> 13:28.060] Which is, if you were to go out and purchase a typical Linksys or Belkin router, you'd find [13:28.060 --> 13:35.480] that the SSID, that is the name given to the router, is usually either default, or in the [13:35.480 --> 13:43.940] Linksys case, I believe it's Linksys. A consumer goes, buys that router, sets it up at home, [13:43.940 --> 13:50.100] follows all the instructions, goes into their Windows XP machine, and sets it to access [13:50.100 --> 13:57.560] their Linksys router. No protection is set, they check the box, and it links up to their [13:57.560 --> 14:03.100] router. Now, a week later, they go out and they take their laptop, and they're sitting in a park [14:03.100 --> 14:11.340] in another part of town, working on their own PC, and the laptop detects another consumer [14:11.340 --> 14:17.180] who's done the same thing in the area. And it, of course, thinks, oh, I have a router named Linksys, [14:17.180 --> 14:24.240] it's not protected, I've already been programmed. And what does Microsoft's operating system do? [14:24.240 --> 14:32.340] It grabs onto that signal, and connects you directly to the Internet. So, the question is, one, [14:32.340 --> 14:38.160] I've done nothing active, I've simply followed the instructions that Microsoft and Linksys gave me. [14:38.520 --> 14:45.480] Have I done anything wrong? And then the question becomes, who is responsible? Is it the person [14:45.480 --> 14:51.600] who manufactures, is it the person who is accessing the signal? Is it the consumer or the business [14:51.600 --> 14:56.840] which happened to follow Linksys' and Microsoft's instructions and set up their router that way? [14:57.180 --> 15:05.400] Is it the hardware manufacturer? Should they have set security as a default, rather than insecurity [15:05.400 --> 15:12.320] as a default? Or is it the responsibility of the operating system not to automatically jump on [15:12.320 --> 15:17.720] to somebody's router without asking permission each time? So, it's an interesting question, [15:17.720 --> 15:23.380] not only from a legal standpoint, but also from a public policy standpoint. Thank you. [15:23.380 --> 15:29.840] I don't think any sane person would want to hold a consumer responsible for an accidental [15:29.840 --> 15:33.560] connection like that. If they open up their laptop and get the little bubble that says, [15:33.560 --> 15:39.740] you're now connected, and they realize, oops, this isn't my network, and they log off or disconnect, [15:40.320 --> 15:45.740] I don't think anyone would ever try to convict somebody for that. However, if they decide, [15:45.740 --> 15:51.580] hey, I'm on a network, I want to check my email, and then they go forward, yeah, that's theft of service, [15:51.580 --> 15:57.740] plain and simple. The consumer should have enough brainpower to realize that, yeah, you've [15:57.740 --> 16:03.560] towed up to that line, let's not cross it. I personally blame a lot of the manufacturers. [16:04.680 --> 16:08.360] Linksys is probably the worst. Everybody's probably heard of the Linksys Global Network. [16:08.360 --> 16:13.940] 60% of the access points out there are Linksys. Most of them are on default. [16:16.260 --> 16:20.760] They bury the security warnings in the manuals. They're not easy to set up. [16:21.500 --> 16:26.680] Different manufacturers have different high-level encryptions and everything. [16:26.680 --> 16:30.620] They don't play nice together. It just gets really confusing for the customers. [16:30.760 --> 16:36.440] I actually, sadly, have to give props to Microsoft. When they were in the wireless gear development [16:36.440 --> 16:41.560] and stuff, and they were selling their routers and cards, their software wizard that came up, [16:41.560 --> 16:48.400] you specifically had to tell it, no, I don't want web on. By default, it would ask you for a key for [16:48.400 --> 16:56.760] your security. You had to specifically tell it, no. So just by not going for insecure by default, [16:56.760 --> 17:01.840] I think they did a really good job. However, everybody that had built-in wireless cards [17:01.840 --> 17:08.500] and had some sort of 128-bit, tried to set 128-bit encryption, because different manufacturers [17:08.500 --> 17:14.300] were using different methods to get 128-bit at the time, nobody could get on it. [17:14.300 --> 17:19.560] So if they set the security as high as they could or couldn't connect, okay, I'll just turn it off and leave it. [17:19.980 --> 17:26.220] So there's a lot of these companies that I think just need to sit down, readdress what they're doing. [17:27.200 --> 17:32.940] They're not taking care of their customers. They're intentionally putting them in harm's way. [17:32.940 --> 17:38.180] I'm just waiting for the first day that somebody is convicted for having an open access point [17:38.180 --> 17:44.820] and facilitating a crime. I don't know if that's within the realm of law, but I could see somebody [17:44.820 --> 17:51.920] even civilly, if company A gets attacked by a bad person through my access point, [17:51.920 --> 17:58.780] can company A sue me civilly for facilitating the access? It's a scary thing. [17:59.080 --> 18:00.580] Thank you. Robert? [18:00.620 --> 18:05.260] Yeah, I think with respect to the users, that that's really the risk there. [18:05.960 --> 18:12.300] But to the extent we're going to hold Linksys liable, they relate, because Linksys ships these things [18:12.300 --> 18:18.060] with the default, and they do it for a reason, because they're advertising a product [18:18.060 --> 18:22.840] that will provide ubiquitous Wi-Fi access. [18:23.180 --> 18:25.060] People just want it to work. [18:25.060 --> 18:33.820] Yeah, they really do. So you've got that smashing up against the real implications of shipping this stuff [18:33.820 --> 18:40.900] the way they do. So I think that to the extent that they start to make it easier for the users [18:40.900 --> 18:50.360] to implement quickly with some sort of restrictions, then you might get into a case, as you described, [18:50.360 --> 18:55.420] where there would be some liability on the WAP operator, even if it's someone in their house. [18:56.320 --> 19:01.820] As far as holding Linksys liable, I certainly think pressure is coming onto them. [19:02.660 --> 19:07.380] I mentioned in my paper that there's a consortium to develop some kind of product [19:07.380 --> 19:13.780] that's going to add onto the router to make it easier for people to implement security. [19:13.780 --> 19:18.040] Whether that's going to be any good, I don't know anyway. [19:18.040 --> 19:25.800] And again, the efforts to hold ISPs and manufacturers liable in the past [19:27.160 --> 19:33.040] haven't gone really anywhere, except for when they're going after monopoly-type situations. [19:33.040 --> 19:37.080] So that would be my view at this time. [19:39.000 --> 19:48.500] You know, a lot of this has come about because 802.11 has been a victim of its own success. [19:48.880 --> 19:54.780] I think a lot of the manufacturers originally envisioned setting these things [19:54.780 --> 19:59.140] basically as a very short-range item that would work only in a house. [20:00.580 --> 20:05.460] And people are going out using them in places they never dreamed of. [20:05.520 --> 20:07.360] The manufacturers never dreamed of. [20:07.360 --> 20:12.300] So it's going out, it's being used a lot more than it was ever anticipated, [20:12.300 --> 20:17.420] and the technology implemented was never intended to be used this way. [20:17.420 --> 20:20.740] So we've got kind of conflicting things going on here. [20:21.400 --> 20:25.440] On the other hand, I think there's a certain amount of responsibility of the operator. [20:25.440 --> 20:30.800] There's this very old thing that I think you've probably all heard called RTFM. [20:31.200 --> 20:35.480] You have to be able to operate your own equipment properly. [20:35.480 --> 20:38.460] You're supposed to be able to figure out what's going on with it. [20:38.460 --> 20:44.120] While I would agree that the manufacturers owe responsibility to the general public to get this stuff right, [20:44.120 --> 20:49.760] the operators do have some responsibility in getting it right themselves. [20:51.280 --> 20:52.460] Thank you. [20:52.460 --> 21:00.460] I think the questions that we begin to ask ourselves as fellow hackers are, [21:01.380 --> 21:05.820] although it's not totally independent of what the law requires of us, is [21:05.820 --> 21:11.780] what is the definition of ethical war driving? [21:12.080 --> 21:17.300] And that's something which our friend RenderMan here has given a first stab at. [21:18.080 --> 21:24.520] But it becomes a question of, in a sense, the law hasn't quite caught up with Wi-Fi, as you can see. [21:24.520 --> 21:29.680] So the question is, how do we, as hackers, act in an ethical manner? [21:29.980 --> 21:36.100] Now in the first step, we do, kind of like John Muir said, [21:36.100 --> 21:40.880] we have to walk softly and not leave too many footprints in the sand. [21:40.880 --> 21:45.720] On the other hand, the act of cracking a web, we're pretty soft. [21:45.720 --> 21:49.580] No one really knows we're there until we've actually cracked the web. [21:49.640 --> 21:51.980] So it's a very interesting question. [21:52.540 --> 21:54.840] Are there any questions? [22:17.980 --> 22:23.120] If it's the one I'm thinking of, what I've heard is it's basically [22:23.120 --> 22:31.680] the telecoms are trying to fight municipalities from getting in to what they consider their business. [22:33.820 --> 22:41.060] It's one of these private enterprise versus giving away something on a municipal level. [22:42.520 --> 22:45.120] I've got mixed feelings about some of that stuff. [22:45.120 --> 22:52.300] As much as I'd like to have free access everywhere, I don't particularly want my tax dollars going for it. [22:52.300 --> 22:56.120] I'm one of those people that I hate paying taxes. [22:56.800 --> 23:00.660] And where I am, I get minimal services anyways for what I get. [23:01.140 --> 23:04.900] I'm not sure I want to pay more for something I may not use. [23:06.480 --> 23:12.140] I just think that we can all agree that this sort of stuff would be really nice if it was like a utility. [23:12.140 --> 23:15.940] Like phone, power, water. You turn it on, it's there. [23:16.360 --> 23:21.840] I think it's a good step for municipalities to realize that internet access is not just going to go away. [23:21.840 --> 23:23.940] You might as well start providing it for everybody. [23:24.220 --> 23:26.600] There's already enough internet access. [23:26.600 --> 23:30.740] If one wanted to do really bad things with wireless, you could get internet access anywhere. [23:30.740 --> 23:34.140] Let's just organize it and do this sanely. [23:34.140 --> 23:38.640] It is just a money grab by the telcos trying to hold on to their old school monopoly. [23:39.140 --> 23:41.760] Because now they don't have the wires to control. [23:42.140 --> 23:44.100] There's a limit that they can do. [23:44.100 --> 23:47.640] They're just trying to stem the tide as long as they possibly can. [23:48.080 --> 23:50.260] I don't know of anything like this in Canada. [23:50.360 --> 23:52.600] I honestly hope it doesn't go through down here. [23:52.600 --> 24:00.300] I would just add that I think an interesting legal concept comes into view if you do move toward a municipality model. [24:00.300 --> 24:07.100] It's called sovereign immunity, which the government essentially can't be held liable even for negligence. [24:07.320 --> 24:12.940] Something to think about for those of you who await government control of the internet. [24:13.040 --> 24:15.440] So government control of the internet would actually be a positive. [24:15.440 --> 24:19.360] It might be if you're looking to have a good time. [24:19.360 --> 24:22.340] I think a lot of it depends on how it's set up, who's running it. [24:22.340 --> 24:25.020] Thank you. [24:25.020 --> 24:27.470] Before we get to the next question, I wanted Robert... [24:28.080 --> 24:30.320] Robert Hale has written an article on this. [24:30.320 --> 24:36.020] If you look in the CD that you got with Defcon, there are some pieces written by RenderMan on a first stab, [24:36.020 --> 24:40.240] which I think is great, at a hacker code of ethics for war driving. [24:40.320 --> 24:46.680] As well as Robert Hale has an article on this, which delves into some of the issues. [24:47.040 --> 24:51.120] But I wanted Robert to comment on the Computer Fraud and Abuse Act. [24:51.120 --> 24:57.660] Because if I recall reading, there's a part in the CFAA which basically says that [24:57.660 --> 25:03.800] it shall not be a crime to access a Wi-Fi signal that is unencrypted. [25:03.820 --> 25:05.900] Can you comment on that? [25:06.320 --> 25:13.780] You know, what I will focus in on, that makes sense. [25:13.780 --> 25:18.840] That seems consistent with a lot of the things that I've read and what we've been talking about. [25:18.840 --> 25:26.440] I think probably the biggest unknown there is what the definition of unauthorized access is. [25:27.300 --> 25:30.100] There's a huge disparity of opinion. [25:30.660 --> 25:34.760] The Act doesn't define it, as anybody who's delved into it knows. [25:35.120 --> 25:39.440] And they really left it up to the courts to come up with a definition. [25:39.440 --> 25:45.640] And as a result, there is a very, very wide spectrum of views on what that unauthorized access is. [25:45.640 --> 25:50.360] And the crux of it is that, is the user, when they approach the Internet, [25:50.360 --> 25:55.000] are they in the default position of being unauthorized? [25:55.640 --> 25:58.040] Or is it the exact opposite? [25:58.040 --> 26:06.860] That unless something on the Internet end gives some kind of a signal to the user that you can't come in here, [26:06.860 --> 26:12.380] is the default of the user coming in, actually, I have open access? [26:12.380 --> 26:17.120] So it really comes down to a policy debate about whether the Internet's open or not. [26:18.220 --> 26:20.820] And there's a paper that I refer to in my paper. [26:20.820 --> 26:26.440] If you want to get into excruciating detail on the status of what unauthorized access means, [26:26.440 --> 26:29.200] I would point you to that for further detail. [26:29.300 --> 26:35.060] But irrespective of what some commentary on the CFA may say, [26:35.060 --> 26:38.140] I really think that the future of where this is going to go, at least at that level, [26:38.140 --> 26:39.940] is going to come down to unauthorized access. [26:41.580 --> 26:42.460] Yes? [26:43.220 --> 26:44.100] I've heard... [26:44.660 --> 26:46.840] Can you stand up? I can't hear. Sorry. [26:46.900 --> 27:15.370] I've heard. [27:15.570 --> 27:21.390] So your question is that if you're broadcasting it and it's unencrypted, [27:21.390 --> 27:24.410] you don't have the right of privacy to what you're broadcasting? [27:24.830 --> 27:26.870] I don't know. Anyone want to comment on that? [27:29.110 --> 27:34.510] Basically, I think you're correct in that you don't have a right as far as the reception goes. [27:34.930 --> 27:36.350] You've sent it out there. [27:36.350 --> 27:40.170] However, there are some laws that will conflict with that directly, [27:40.170 --> 27:42.370] specifically the one regarding e-mail. [27:43.590 --> 27:48.330] It's illegal to intercept e-mail if you're not the recipient, [27:48.330 --> 27:52.610] if you're not one of the carriers, or you're not the one that's transmitting it. [27:56.920 --> 27:59.140] And that's the real gray area. [27:59.140 --> 28:06.200] If you capture it and you realize it's an e-mail, where are you crossing the line? [28:06.200 --> 28:09.360] Because if you just get a header and it's an e-mail header, [28:09.360 --> 28:13.900] and you say, oh jeez, I'm not going to read anymore, have you crossed the line? [28:14.340 --> 28:16.400] I'd say maybe, maybe not. [28:16.600 --> 28:21.160] If you go through the whole thing, you've probably definitely gone way past where you should have gone. [28:23.100 --> 28:28.340] But if someone's just broadcasting everything that's going out there that they've been getting, [28:28.340 --> 28:31.360] all their web surfing and all that, a lot of that's completely open. [28:31.360 --> 28:32.680] That's their own problem. [28:33.320 --> 28:37.740] I would add that I discuss this a little bit in my paper. [28:38.060 --> 28:41.500] If you want to push the Computer Fraud and Abuse Act aside for a minute [28:41.500 --> 28:44.680] and get down to common law issues like trespass, [28:45.280 --> 28:52.300] there have been cases in which they've likened unauthorized access to trespass. [28:54.480 --> 28:59.680] The views that come down there are if you're not protecting your access point [28:59.680 --> 29:01.740] and taking steps to protect it, [29:01.740 --> 29:05.220] then there's an implied authorization you're giving to the user. [29:05.600 --> 29:13.700] And again, that relates to the point I made earlier about the debates about this unauthorized access business. [29:13.700 --> 29:17.920] I would also add that I think that if you really boil it down to the bone right now, [29:17.920 --> 29:20.320] the Feds can tap into the Internet without a warrant. [29:20.320 --> 29:22.760] I mean, that's basically the way it stands right now. [29:22.760 --> 29:24.940] So we can debate that endlessly. [29:24.940 --> 29:28.640] But I think that if you really boil it down, that's really what's the bottom line. [29:28.640 --> 29:32.640] So the Feds could tap into the Wi-Fi network without... [29:33.540 --> 29:35.300] That's my current understanding. [29:35.300 --> 29:38.820] But again, there's a lot of conflicting views about that. [29:38.940 --> 29:41.760] Okay. Thank you. Any other questions? [29:44.340 --> 29:49.920] Okay. One other issue I'm going to bring up again is this issue of who's responsible. [29:50.220 --> 29:54.520] So I think what we've talked about here is the problem, [29:54.520 --> 29:58.280] which is they try to make it easy for you to use Wi-Fi. [29:58.280 --> 30:01.380] At the same point, they make it insecure. [30:01.960 --> 30:05.760] So one of the things that I've talked about with several of the members of the panel here [30:05.760 --> 30:10.060] is, in a sense, that we believe there needs to be a much stronger effort [30:10.060 --> 30:13.960] on the part of the software and the hardware manufacturers [30:13.960 --> 30:19.380] to change, in a sense, not only their marketing literature, [30:19.380 --> 30:22.800] but change the way they ship this equipment and this software [30:22.800 --> 30:26.200] so that, in a sense, security becomes the default. [30:26.200 --> 30:29.660] I know we addressed that a little bit, but I'm asking that specific question. [30:29.660 --> 30:32.280] Do they believe that if a case were to happen, [30:32.940 --> 30:35.460] that we did have unauthorized access, [30:35.460 --> 30:38.460] do you believe that the software and the hardware manufacturers [30:38.460 --> 30:40.720] share some responsibility? [30:42.140 --> 30:47.020] I don't think that the software and hardware manufacturers could be held directly liable. [30:47.560 --> 30:51.420] The end user, you know, stupidity is not a valid defense. [30:51.420 --> 30:53.700] If you didn't secure your access point, [30:53.700 --> 31:00.900] and somebody ends up accidentally being on there intentionally, [31:00.900 --> 31:04.720] my personal opinion is that if you leave it open [31:05.580 --> 31:09.060] and you specify in the SSID that it's free access, [31:09.060 --> 31:10.160] then go for it. [31:10.160 --> 31:13.980] If it is not specifically telling you free access, [31:13.980 --> 31:16.000] you know, surf me, anything like that, [31:16.000 --> 31:17.520] take some pity on these people. [31:17.520 --> 31:19.020] You've probably got high-speed internet at home. [31:19.020 --> 31:20.640] You don't need to mooch off of other people. [31:20.640 --> 31:23.040] Hotels have Wi-Fi, usually. [31:24.100 --> 31:26.660] There are much better ways of doing it [31:26.660 --> 31:29.620] than, you know, trouncing around in this legal gray area [31:29.620 --> 31:31.080] and get yourself in trouble. [31:31.780 --> 31:35.500] At some point or another, it's going to be ubiquitous. [31:35.500 --> 31:37.000] You know, we're just going to be able to open things up [31:37.000 --> 31:39.620] and it's there, all nice and legal. [31:39.620 --> 31:42.700] But for now, yeah, drive the two blocks down to the Kinko's or wherever [31:42.700 --> 31:44.300] and use theirs. [31:44.840 --> 31:46.360] Just cover your butt. [31:46.440 --> 31:49.340] I just really wish I could have smacked Linksys around [31:49.700 --> 31:51.960] a couple of years ago when they were putting this stuff out [31:51.960 --> 31:54.080] because they just... [31:54.080 --> 31:56.140] they seem to be the biggest part of the problem. [31:56.140 --> 31:57.840] Their manuals are getting better, [31:57.840 --> 32:00.700] but I still hold them responsible for so much of this [32:00.700 --> 32:03.200] because they're making it so easy. [32:03.700 --> 32:05.140] It's not even like you're having... [32:05.140 --> 32:08.360] the tools are out there to break a lot of the security that's in place, [32:08.360 --> 32:11.060] but they just make it so much easier for everybody. [32:11.380 --> 32:15.220] As he said, if you have a Linksys at home, [32:15.220 --> 32:17.820] Linksys out in the park, it just hops on there. [32:17.820 --> 32:21.180] And suddenly people can suddenly commit a felony on their own. [32:21.180 --> 32:23.400] The software and everything helps them. [32:23.520 --> 32:25.740] They could very easily go too far [32:25.740 --> 32:28.640] and start checking email, start realizing, [32:28.640 --> 32:31.720] hey, I can use this as a launching point for other things. [32:32.520 --> 32:33.800] Thank you. Robert? [32:33.800 --> 32:36.720] I would just say that it's the job of the plaintiff's bar [32:36.720 --> 32:42.660] to come up with a lot of these outlandish and bizarre theories of liability. [32:42.660 --> 32:46.060] As any of you know from buying appliances like toasters and hairdryers [32:46.060 --> 32:49.800] and pretty much anything nowadays, it's got warnings all over it, [32:49.800 --> 32:53.060] that you, you know, really stupid stuff like, you know... [32:53.060 --> 32:55.420] Do not iron pants while wearing... [32:55.420 --> 32:57.840] Yeah, yeah. I mean, really, that's all there [32:57.840 --> 33:02.520] because there's enough books to fill this room about product liability. [33:02.520 --> 33:05.980] And the reason I mention that is that the whole idea here is to make... [33:05.980 --> 33:08.520] well, maybe not everybody would agree with this, [33:08.520 --> 33:11.160] but they're trying to make computers a newer appliance, right? [33:11.160 --> 33:16.880] So to the extent that that keeps getting pushed, [33:16.880 --> 33:21.240] it's not inconceivable that you could come up with some kind of theory like that. [33:21.240 --> 33:23.980] So I think it's extremely unlikely that Linksys or other companies [33:23.980 --> 33:28.220] ever come under any kind of liability, but it's not impossible, [33:28.220 --> 33:32.200] given the history of litigation within the product liability space. [33:32.200 --> 33:37.180] But I completely agree with the points made that they really need to do more. [33:37.180 --> 33:39.320] Doesn't mean we can't yell at them still, though. [33:39.860 --> 33:41.960] Yeah, I would agree with that. [33:42.020 --> 33:45.760] Like I said earlier, there's a certain amount of RTFM. [33:45.760 --> 33:48.960] However, I also think the companies, as companies, [33:48.960 --> 33:51.920] owe us something to get their product right. [33:52.120 --> 33:55.320] And for all the abuse Microsoft takes on a lot of different things [33:55.320 --> 33:59.200] that they absolutely deserve, the one thing they did right, in my opinion, [33:59.200 --> 34:01.780] was with their Wi-Fi appliances. [34:01.800 --> 34:05.980] They went to a default encrypted mode. [34:06.240 --> 34:08.640] They were the first and the only product to do that. [34:09.120 --> 34:12.600] I'd like to see the other products do that. I'd love to see it. [34:13.640 --> 34:18.440] Thank you. Before we finish, I just want to know if any of you saw this article in the newspaper, [34:18.440 --> 34:22.000] which we have up at our booth, that 10 more commandments were found. [34:22.400 --> 34:27.100] And I'm not sure that anybody is aware of it, so we made up a T-shirt about it, [34:27.100 --> 34:31.160] which I think really talks on what we're going for ethical war driving. [34:31.160 --> 34:32.660] The 11th commandment. [34:32.700 --> 34:35.520] Thou shalt not covet thy neighbor's Wi-Fi. [34:36.000 --> 34:36.440] So... [34:39.980 --> 34:42.160] Thank you all very much for coming. [34:59.240 --> 35:03.440] If you're actually hoping to have some level of security by hiding your SSID, [35:03.440 --> 35:07.120] I don't think that anyone would actually say that works as security. [35:07.940 --> 35:12.340] You could make an argument, but it's just a matter of using a different tool to find it. [35:12.860 --> 35:17.740] I don't think there would be enough there for anybody to complain [35:20.680 --> 35:24.620] that I was trying to secure my stuff, why are you on here? [35:27.360 --> 35:29.760] Do we have any other opinions on that question? [35:31.380 --> 35:31.740] Okay. [35:32.320 --> 35:34.200] Thank you all very much for coming. [35:34.200 --> 35:37.400] Alright, we've got time for two more. Go ahead. [35:53.160 --> 35:55.420] I really wish that they would. [35:55.540 --> 35:59.380] I'm not a lawyer, but I've seen cases where companies will go in, [35:59.380 --> 36:02.740] install wireless access all over the place in a business, [36:02.740 --> 36:04.880] leave it wide open and walk away. [36:04.940 --> 36:07.680] I don't think it's due diligence and it's not very professional. [36:08.300 --> 36:12.460] The companies, I think, would probably be best sued civilly if something did happen. [36:13.760 --> 36:17.080] Ethically, who are these people that are setting these things up insecurely? [36:17.080 --> 36:19.220] They're supposed to be... you're hiring the expert. [36:19.220 --> 36:22.940] Why aren't they reading the manual? Why aren't they doing what their job is? [36:23.240 --> 36:27.500] I'd say two points. It's conceivable they would be held liable civilly, maybe. [36:27.560 --> 36:31.680] The second thing I'd say is most of these laws have loopholes for... [36:33.460 --> 36:42.220] you could say information security or technical loopholes to allow for these types of things. [36:42.220 --> 36:45.040] So it's conceivable they could get immunity under something like that. [36:47.060 --> 36:47.820] Yes. [36:56.300 --> 36:58.540] Does that count as wiretapping? [36:58.780 --> 37:02.760] It's conceivable? That's a topic I mentioned briefly in my paper. [37:02.760 --> 37:07.320] Certainly, again, if you're going to find liability under CFAA, under the facts you described, [37:07.320 --> 37:10.100] there's no reason why you wouldn't find it under the wiretap laws. [37:10.200 --> 37:13.780] One of the points that we make in the beginning here is that [37:14.580 --> 37:19.720] we know what we interpret some of these state and federal laws to be. [37:19.720 --> 37:24.160] The question remains over the next few years how the courts will interpret them. [37:24.400 --> 37:29.000] And we need to walk, as hackers and as people who advise people out in the field, [37:29.000 --> 37:33.400] we need to walk a fine line and make sure that we're not going into an area which is gray [37:33.400 --> 37:36.080] without knowing that we're going into a gray area. [37:36.080 --> 37:38.260] Any other questions? [37:39.340 --> 37:43.160] Okay. Thank you all very much. Enjoy DAPTCON.