WEBVTT 00:07.470 --> 00:09.790 We have four panelists. 00:09.790 --> 00:11.590 Myself, I'm Matthew Shuckman. 00:11.590 --> 00:14.510 I'm one of the founders of WarDrivingWorld.com. 00:14.570 --> 00:20.430 We have RenderMan, a famous hacker and a superb war driver. 00:20.550 --> 00:28.190 We have Robert Hale, who's a lawyer from San Francisco, who's written on this subject of Wi-Fi and the law. 00:28.190 --> 00:35.770 And we have Frank Thornton, who is a former law enforcement official and, as well, a great hacker. 00:35.910 --> 00:37.970 So we'll give some different perspectives. 00:42.310 --> 00:47.350 Firstly, I'm going to ask if you can hold your questions until the end. 00:47.490 --> 00:52.630 We're only going to have about 40 minutes, so we'll try to get through it so we can leave a few minutes at the end for questions. 00:53.470 --> 00:56.450 Firstly, the definition of what is war driving. 00:56.930 --> 01:01.630 And the simple definition of what is war driving and whether you're walking around. 01:01.630 --> 01:06.190 There's been a lot of play with the verbs here, whether you're driving around, whether you're walking around. 01:06.190 --> 01:16.670 It's the act of having a laptop or a PC of some form and detecting other people's Wi-Fi signals and recording some information about them. 01:16.670 --> 01:26.150 The simplest case was recording the information that the access point is there, maybe the speed of transmission, and if you have a GPS, maybe the location. 01:26.870 --> 01:31.610 So, there's been a lot of talk of whether war driving is legal. 01:33.710 --> 01:37.650 So, there was a Doonesbury cartoon which covers this. 01:38.030 --> 01:41.310 And the question of, is war driving legal? 01:41.510 --> 01:47.390 There have been a number of articles in the newspaper where you've seen that people have been arrested for war driving. 01:47.490 --> 01:56.250 However, what I'll say is, with one exception, in each of those cases, the people who were arrested for war driving were doing something else. 01:56.470 --> 01:59.590 Some other nefarious activity, some crime. 01:59.830 --> 02:09.870 In this criminal activity, for instance, in one case in Toronto, the man was spamming child pornography, but using somebody else's Wi-Fi signal to get it out. 02:09.870 --> 02:17.390 We certainly can all agree that spamming child pornography is a crime, and it's really not the war driving that's the issue, it's the other crime involved. 02:17.390 --> 02:25.230 Another case involves two people who were grabbing credit card numbers off of a Wi-Fi signal near a retail store. 02:25.610 --> 02:30.370 We'd all certainly agree they're stealing credit card information, that's separate from the war driving. 02:30.470 --> 02:45.170 There's a recent case where a man in Tampa was outside of somebody else's house, and he was caught, the man went out, the resident of the house went out, found him outside and said, hmm, what are you doing here? 02:45.170 --> 02:46.330 But didn't say anything. 02:46.330 --> 02:54.370 He then went out, drove his girlfriend home, came back, the man was still sitting there in the van with the glow of a laptop screen, as the reports in the newspaper say. 02:54.370 --> 03:03.650 He called the police, the police came by, whoever this guy was was not so smart, he didn't leave after the first two times, and the police came by and they arrested him for war driving. 03:04.030 --> 03:11.810 We're not sure what else he was doing, we're not even sure what was on the screen, but when that case comes to trial later in the fall, maybe we'll know something about it. 03:11.810 --> 03:28.930 There are a variety of laws, both at the state and federal level, which cover accessing networks, both legal accessing of networks, and accessing a network that might not be yours, where it's an illegal activity. 03:29.410 --> 03:35.990 Some of these laws have been extended and will cover Wi-Fi access of networks, but not all of them. 03:35.990 --> 03:47.090 There have been some new laws that have been brought into play, which will cover some of the distinctions with regard to Wi-Fi access, but very few of these have had the chance to be tested yet in court. 03:47.230 --> 03:54.310 As any of you who have had experience with the law knows, it's not what the law says, it's what becomes the precedent within the judicial system. 03:54.330 --> 04:13.970 So, the first question I'm going to ask our panelists is, if in the very simplest case, we're war driving, we're driving around with a laptop, and we are accessing, and we are detecting access points, using a package let's say like Marius Milner's NetStumbler, 04:13.970 --> 04:20.090 and recording the location, and something about the signal, is this a legal activity? 04:21.210 --> 04:23.950 I'll first ask my first panelist, Renderman. 04:23.950 --> 04:43.010 Just for clarification, I am from Canada, so my knowledge is mostly around Canadian law, I'm not a lawyer, but in my research I found in Canada it's a lot more sanely written laws than in the States in regards to this. 04:43.150 --> 04:48.770 Anything in the 2.4 gigahertz ISM band is basically, it's public domain. 04:48.770 --> 04:53.030 It's free to transmit, free to receive, up to one watt. 04:53.410 --> 04:59.330 Anything that is transmitted, if it's unencrypted, you can listen to legally. 04:59.410 --> 05:04.850 You cannot disrupt, and you cannot decrypt if it is encrypted. 05:04.870 --> 05:06.850 But that's all the rules there are. 05:06.850 --> 05:19.330 This very nicely frames basic war driving, because all we're doing is passively detecting the signals from these networks, just listening to the information that they're skewing out. 05:19.650 --> 05:24.810 We're not accessing them, because then at that point we get into computer trespass laws. 05:25.210 --> 05:27.970 But the information coming in is nice and legal. 05:28.770 --> 05:30.590 Yeah, it's quite legal where I'm from. 05:31.030 --> 05:32.530 Okay, thank you. 05:32.530 --> 05:33.550 Robert Hill. 05:33.550 --> 05:35.770 Yeah, I think I would just mention two things. 05:35.770 --> 05:42.430 One quickly is, would it be a violation of the Computer Fraud and Abuse Act, which is kind of the bible of a lot of this stuff. 05:42.430 --> 05:47.510 You have to show unauthorized access, you have to show obtaining information, and you have to show damages. 05:47.970 --> 05:57.950 So, Render just nicely outlined, although it might not be in the Canadian context, you could, I think in the worst case scenario, maybe prove something there. 05:58.070 --> 06:00.270 Was the access authorized? 06:00.270 --> 06:06.010 Well, if they didn't have any kind of protection up around their access point, you might be able to squeeze that in. 06:06.150 --> 06:08.370 Obtaining information seems pretty weak. 06:08.370 --> 06:11.650 Again, what are you actually doing with the router? 06:11.970 --> 06:13.290 It's pretty minor. 06:13.290 --> 06:14.570 And then, where are the damages? 06:14.570 --> 06:16.630 So, it's pretty attenuated. 06:16.630 --> 06:18.110 However, I will say this. 06:18.210 --> 06:40.890 I think to the extent that an organized group that's setting up, and again, I said this is a worst case scenario, that's setting up kind of a, you know, showing people where a bunch of wireless access points are, it's conceivable that some very zealous or overzealous authorities might view that as a facilitation of bad acts. 06:40.890 --> 06:46.570 Although they're not doing a bad act, they might be able to say it's conspiracy or aiding and abetting. 06:46.570 --> 06:54.450 I know it sounds pretty horrible, but it's certainly not unreasonable or irrational or inconceivable. 06:54.450 --> 06:56.450 So, those are the two things I would say. 06:56.450 --> 06:57.310 Thank you. 06:57.310 --> 06:58.490 Thorne? 06:58.710 --> 06:59.750 Hi. 06:59.750 --> 07:17.550 From my standpoint, especially with my background in law enforcement, my interpretation of this, and not being an attorney, but being someone that is familiar with interpreting laws, is that this is completely legal to just detect and to record locations. 07:17.930 --> 07:26.910 I think a prosecutor would have a real hard time pushing it out to the effect that you're doing something nasty by recording this stuff. 07:27.450 --> 07:41.990 It's probably a lot more information that is publicly available in a phone book that would cause a lot more damage than someone just going down the street and detecting whether there's an access point near a particular location. 07:43.510 --> 07:44.550 Thank you. 07:44.770 --> 07:47.650 Okay, that's the simplest case. 07:47.670 --> 07:49.510 Now let's take the next case. 07:54.360 --> 08:02.340 Let's say that we have a situation where I'm still... there's a situation where we can set up something called promiscuous mode. 08:02.340 --> 08:05.260 Promiscuous mode is not as dirty as it sounds. 08:05.260 --> 08:12.840 Promiscuous mode is that some Wi-Fi devices, cards, can be set to listen to any packet coming across. 08:12.840 --> 08:14.020 And they do it passively. 08:14.020 --> 08:16.200 They don't send back an acknowledgement packet. 08:16.200 --> 08:19.300 So you're simply receiving everything that's out there in the ether. 08:19.700 --> 08:32.220 So I'm receiving these packets and I'm receiving them for the purpose of pulling them down onto my PC and what I want to do is to break... is to crack the encryption. 08:32.420 --> 08:34.600 I'm simply doing it for the sport. 08:34.660 --> 08:39.200 I'm not interested in going onto that person's network and stealing any information from them. 08:39.200 --> 08:49.220 It's for the purpose of receiving information that's being broadcast out to me in the free air waves, as Doonesbury said, but for the sport of being able to crack the web. 08:49.520 --> 08:51.360 Is that a legal activity? 08:51.420 --> 08:53.120 Renderman? 08:53.120 --> 09:08.140 In Canada, basically it's free reign and the ISM ban and capturing anything that you want within reason in that spectrum is perfectly legal. 09:08.140 --> 09:18.320 You cannot divulge to other persons what you capture and you cannot decrypt the information you do receive. 09:18.320 --> 09:19.820 Those are the only two provisions. 09:19.840 --> 09:30.200 If you're just looking at screen dumps of the packets going by, seeing what web pages people are looking at, things like that, that's all perfectly legal. 09:30.200 --> 09:35.840 It's entirely passive, you're not disrupting, you're not doing anything that I can tell is legally bad. 09:36.240 --> 09:50.840 When you start getting into cracking WEP, if it's something that is not your access point, not your property and no permission, definitely you're starting to get out of the Radio Communication Act more into the preparatory stages for computer intrusion, 09:50.840 --> 09:53.260 so computer trespass laws. 09:53.260 --> 10:03.380 You could probably argue the case that having the two tools, like Aircrack and a dump file, themselves are not illegal. 10:03.380 --> 10:09.940 However, having processed the dump file through Aircrack and having the key, then they'd probably want to speak to you. 10:09.940 --> 10:13.900 But you'd really have to get somebody's attention to have them go after that. 10:13.900 --> 10:16.400 It wouldn't be worth their time, just if you're doing it for sport. 10:16.580 --> 10:28.200 Not something I'd recommend, because if you've got the wireless gear to go out and collect this stuff anyways, you've probably got an access point at home and can tinker around in your own lab, rather than driving halfway across the city and doing it there. 10:28.200 --> 10:30.160 I'd rather sit at home in air conditioning. 10:31.100 --> 10:31.980 Thank you. 10:31.980 --> 10:32.580 Robert? 10:32.580 --> 10:42.260 I would talk to three things, mainly the CFAA elements, then, again, the sort of conspiracy enterprise theory, and then also, really, public policy. 10:42.260 --> 10:45.660 I think from the CFAA standpoint, again, we just go through our elements. 10:45.660 --> 10:47.440 We've got unauthorized access. 10:47.440 --> 10:49.380 Yes, we do have unauthorized access. 10:49.840 --> 10:58.440 Obtaining information, there's a case that controls CFAA that says even looking at information is obtaining it. 10:58.440 --> 10:59.920 Is that the right decision? 11:00.140 --> 11:02.480 Again, we could debate that, but that is the president. 11:02.480 --> 11:07.300 So if you're just looking at it, as Render said, you've satisfied that element of the CFAA. 11:07.300 --> 11:08.380 Then you have your damages. 11:08.380 --> 11:18.920 Now, through that act of cracking the encryption, the user is then led to have to spend a lot of money to reconfigure their system or something. 11:19.100 --> 11:23.040 Again, it's a stretch, but you could say that you have damages there. 11:23.040 --> 11:33.180 Now, moving on to the conspiracy part, again, if you have a group of people doing this, and again, they may, some of them, say it's for sport, but there's kind of a gray area there. 11:33.440 --> 11:37.760 I could see the feds coming in and saying, you know, you guys are aiding and abetting. 11:37.920 --> 11:44.800 You say you might not be doing anything bad, but if you know that something bad is going to occur down the line, you're aiding and abetting bad actors. 11:45.080 --> 11:58.920 The third thing I'd say is that really, since, and we're going to get to this in your third segment, the public policy aspect, you want these companies to develop tools to enable the user to protect their access point. 11:59.320 --> 12:06.600 So to the extent that you go around cracking them, I mean, it might be contrary to public policy, but you could also argue that it facilitates a good public policy. 12:06.600 --> 12:08.400 But we'll debate that next. 12:10.100 --> 12:19.560 My view on this portion of it is when you start getting into, if you're just receiving straight data without any encryption on it, you're probably completely okay. 12:20.740 --> 12:30.680 You may be treading into an area of a problem if you start reading email, which is completely, clearly illegal under a couple of different laws. 12:31.800 --> 12:37.820 However, if you're just getting a packet and you're looking at a packet, seeing what it is, you're probably all right. 12:38.040 --> 12:45.420 When you start doing the web breaking, you're crossing into a real gray area in my mind. 12:45.420 --> 12:56.580 And I think that having worked with prosecutors, that would show clear intent in their mind if they were going to try and grab someone for doing something. 12:56.580 --> 13:10.160 The fact that someone went out and was breaking web on someone that they did not know, they did not have permission, most prosecutors would say that that is a clear intent to commit a further criminal act. 13:12.000 --> 13:13.480 Thank you. 13:13.480 --> 13:21.200 Now we get to what I think is the most interesting question here, from my perspective. 13:21.200 --> 13:37.860 Which is, if you were to go out and purchase a typical Linksys or Belkin router, you'd find that the SSID, that is the name given to the router, is usually either default, or in the Linksys case, I believe it's Linksys. 13:39.600 --> 13:51.740 A consumer goes, buys that router, sets it up at home, follows all the instructions, goes into their Windows XP machine, and sets it to access their Linksys router. 13:51.920 --> 13:58.060 No protection is set, they check the box, and it links up to their router. 13:58.580 --> 14:13.880 Now, a week later, they go out and they take their laptop, and they're sitting in a park in another part of town, working on their own PC, and the laptop detects another consumer who's done the same thing in the area. 14:13.920 --> 14:20.000 And it, of course, thinks, oh, I have a router named Linksys, it's not protected, I've already been programmed. 14:20.540 --> 14:24.240 And what does Microsoft's operating system do? 14:24.240 --> 14:28.100 It grabs onto that signal, and connects you directly to the Internet. 14:29.040 --> 14:38.160 So, the question is, one, I've done nothing active, I've simply followed the instructions that Microsoft and Linksys gave me. 14:38.520 --> 14:40.700 Have I done anything wrong? 14:41.160 --> 14:44.540 And then the question becomes, who is responsible? 14:44.780 --> 14:49.800 Is it the person who manufactures, is it the person who is accessing the signal? 14:49.800 --> 14:56.840 Is it the consumer or the business which happened to follow Linksys' and Microsoft's instructions and set up their router that way? 14:57.180 --> 15:00.460 Is it the hardware manufacturer? 15:00.500 --> 15:07.160 Should they have set security as a default, rather than insecurity as a default? 15:07.440 --> 15:16.040 Or is it the responsibility of the operating system not to automatically jump on to somebody's router without asking permission each time? 15:16.040 --> 15:21.940 So, it's an interesting question, not only from a legal standpoint, but also from a public policy standpoint. 15:22.420 --> 15:23.380 Thank you. 15:23.380 --> 15:31.300 I don't think any sane person would want to hold a consumer responsible for an accidental connection like that. 15:31.300 --> 15:44.040 If they open up their laptop and get the little bubble that says, you're now connected, and they realize, oops, this isn't my network, and they log off or disconnect, I don't think anyone would ever try to convict somebody for that. 15:44.060 --> 15:52.640 However, if they decide, hey, I'm on a network, I want to check my email, and then they go forward, yeah, that's theft of service, plain and simple. 15:52.880 --> 16:00.780 The consumer should have enough brainpower to realize that, yeah, you've towed up to that line, let's not cross it. 16:01.060 --> 16:03.560 I personally blame a lot of the manufacturers. 16:04.680 --> 16:06.000 Linksys is probably the worst. 16:06.000 --> 16:08.360 Everybody's probably heard of the Linksys Global Network. 16:08.360 --> 16:11.640 60% of the access points out there are Linksys. 16:12.040 --> 16:13.940 Most of them are on default. 16:16.260 --> 16:19.060 They bury the security warnings in the manuals. 16:19.060 --> 16:20.760 They're not easy to set up. 16:21.500 --> 16:26.680 Different manufacturers have different high-level encryptions and everything. 16:26.680 --> 16:28.160 They don't play nice together. 16:28.160 --> 16:30.620 It just gets really confusing for the customers. 16:30.760 --> 16:33.560 I actually, sadly, have to give props to Microsoft. 16:33.560 --> 16:45.780 When they were in the wireless gear development and stuff, and they were selling their routers and cards, their software wizard that came up, you specifically had to tell it, no, I don't want web on. 16:45.780 --> 16:50.020 By default, it would ask you for a key for your security. 16:50.020 --> 16:52.400 You had to specifically tell it, no. 16:52.440 --> 16:58.320 So just by not going for insecure by default, I think they did a really good job. 16:58.320 --> 17:14.300 However, everybody that had built-in wireless cards and had some sort of 128-bit, tried to set 128-bit encryption, because different manufacturers were using different methods to get 128-bit at the time, nobody could get on it. 17:14.300 --> 17:19.560 So if they set the security as high as they could or couldn't connect, okay, I'll just turn it off and leave it. 17:19.980 --> 17:26.220 So there's a lot of these companies that I think just need to sit down, readdress what they're doing. 17:27.200 --> 17:30.100 They're not taking care of their customers. 17:30.100 --> 17:32.940 They're intentionally putting them in harm's way. 17:32.940 --> 17:40.160 I'm just waiting for the first day that somebody is convicted for having an open access point and facilitating a crime. 17:40.240 --> 17:56.860 I don't know if that's within the realm of law, but I could see somebody even civilly, if company A gets attacked by a bad person through my access point, can company A sue me civilly for facilitating the access? 17:57.560 --> 17:58.780 It's a scary thing. 17:59.080 --> 17:59.840 Thank you. 17:59.840 --> 18:00.580 Robert? 18:00.620 --> 18:05.260 Yeah, I think with respect to the users, that that's really the risk there. 18:05.960 --> 18:22.840 But to the extent we're going to hold Linksys liable, they relate, because Linksys ships these things with the default, and they do it for a reason, because they're advertising a product that will provide ubiquitous Wi-Fi access. 18:23.180 --> 18:25.060 People just want it to work. 18:25.060 --> 18:26.360 Yeah, they really do. 18:26.360 --> 18:35.560 So you've got that smashing up against the real implications of shipping this stuff the way they do. 18:35.560 --> 18:55.420 So I think that to the extent that they start to make it easier for the users to implement quickly with some sort of restrictions, then you might get into a case, as you described, where there would be some liability on the WAP operator, even if it's someone in their house. 18:56.320 --> 19:01.820 As far as holding Linksys liable, I certainly think pressure is coming onto them. 19:02.660 --> 19:13.780 I mentioned in my paper that there's a consortium to develop some kind of product that's going to add onto the router to make it easier for people to implement security. 19:13.780 --> 19:18.040 Whether that's going to be any good, I don't know anyway. 19:18.040 --> 19:33.040 And again, the efforts to hold ISPs and manufacturers liable in the past haven't gone really anywhere, except for when they're going after monopoly-type situations. 19:33.040 --> 19:37.080 So that would be my view at this time. 19:39.000 --> 19:48.500 You know, a lot of this has come about because 802.11 has been a victim of its own success. 19:48.880 --> 19:59.140 I think a lot of the manufacturers originally envisioned setting these things basically as a very short-range item that would work only in a house. 20:00.580 --> 20:05.460 And people are going out using them in places they never dreamed of. 20:05.520 --> 20:07.360 The manufacturers never dreamed of. 20:07.360 --> 20:17.420 So it's going out, it's being used a lot more than it was ever anticipated, and the technology implemented was never intended to be used this way. 20:17.420 --> 20:20.740 So we've got kind of conflicting things going on here. 20:21.400 --> 20:25.440 On the other hand, I think there's a certain amount of responsibility of the operator. 20:25.440 --> 20:30.800 There's this very old thing that I think you've probably all heard called RTFM. 20:31.200 --> 20:35.480 You have to be able to operate your own equipment properly. 20:35.480 --> 20:38.460 You're supposed to be able to figure out what's going on with it. 20:38.460 --> 20:49.760 While I would agree that the manufacturers owe responsibility to the general public to get this stuff right, the operators do have some responsibility in getting it right themselves. 20:51.280 --> 20:52.460 Thank you. 20:52.460 --> 21:11.780 I think the questions that we begin to ask ourselves as fellow hackers are, although it's not totally independent of what the law requires of us, is what is the definition of ethical war driving? 21:12.080 --> 21:17.300 And that's something which our friend RenderMan here has given a first stab at. 21:18.080 --> 21:24.520 But it becomes a question of, in a sense, the law hasn't quite caught up with Wi-Fi, as you can see. 21:24.520 --> 21:29.680 So the question is, how do we, as hackers, act in an ethical manner? 21:29.980 --> 21:40.880 Now in the first step, we do, kind of like John Muir said, we have to walk softly and not leave too many footprints in the sand. 21:40.880 --> 21:45.720 On the other hand, the act of cracking a web, we're pretty soft. 21:45.720 --> 21:49.580 No one really knows we're there until we've actually cracked the web. 21:49.640 --> 21:51.980 So it's a very interesting question. 21:52.540 --> 21:54.840 Are there any questions? 22:17.980 --> 22:31.680 If it's the one I'm thinking of, what I've heard is it's basically the telecoms are trying to fight municipalities from getting in to what they consider their business. 22:33.820 --> 22:41.060 It's one of these private enterprise versus giving away something on a municipal level. 22:42.520 --> 22:45.120 I've got mixed feelings about some of that stuff. 22:45.120 --> 22:52.300 As much as I'd like to have free access everywhere, I don't particularly want my tax dollars going for it. 22:52.300 --> 22:56.120 I'm one of those people that I hate paying taxes. 22:56.800 --> 23:00.660 And where I am, I get minimal services anyways for what I get. 23:01.140 --> 23:04.900 I'm not sure I want to pay more for something I may not use. 23:06.480 --> 23:12.140 I just think that we can all agree that this sort of stuff would be really nice if it was like a utility. 23:12.140 --> 23:13.760 Like phone, power, water. 23:13.760 --> 23:15.940 You turn it on, it's there. 23:16.360 --> 23:21.840 I think it's a good step for municipalities to realize that internet access is not just going to go away. 23:21.840 --> 23:23.940 You might as well start providing it for everybody. 23:24.220 --> 23:26.600 There's already enough internet access. 23:26.600 --> 23:30.740 If one wanted to do really bad things with wireless, you could get internet access anywhere. 23:30.740 --> 23:34.140 Let's just organize it and do this sanely. 23:34.140 --> 23:38.640 It is just a money grab by the telcos trying to hold on to their old school monopoly. 23:39.140 --> 23:41.760 Because now they don't have the wires to control. 23:42.140 --> 23:44.100 There's a limit that they can do. 23:44.100 --> 23:47.640 They're just trying to stem the tide as long as they possibly can. 23:48.080 --> 23:50.260 I don't know of anything like this in Canada. 23:50.360 --> 23:52.600 I honestly hope it doesn't go through down here. 23:52.600 --> 24:00.300 I would just add that I think an interesting legal concept comes into view if you do move toward a municipality model. 24:00.300 --> 24:07.100 It's called sovereign immunity, which the government essentially can't be held liable even for negligence. 24:07.320 --> 24:12.940 Something to think about for those of you who await government control of the internet. 24:13.040 --> 24:15.440 So government control of the internet would actually be a positive. 24:15.440 --> 24:19.360 It might be if you're looking to have a good time. 24:19.360 --> 24:22.340 I think a lot of it depends on how it's set up, who's running it. 24:22.340 --> 24:25.020 Thank you. 24:25.020 --> 24:27.470 Before we get to the next question, I wanted Robert... 24:28.080 --> 24:30.320 Robert Hale has written an article on this. 24:30.320 --> 24:40.240 If you look in the CD that you got with Defcon, there are some pieces written by RenderMan on a first stab, which I think is great, at a hacker code of ethics for war driving. 24:40.320 --> 24:46.680 As well as Robert Hale has an article on this, which delves into some of the issues. 24:47.040 --> 24:51.120 But I wanted Robert to comment on the Computer Fraud and Abuse Act. 24:51.120 --> 25:03.800 Because if I recall reading, there's a part in the CFAA which basically says that it shall not be a crime to access a Wi-Fi signal that is unencrypted. 25:03.820 --> 25:05.900 Can you comment on that? 25:06.320 --> 25:13.780 You know, what I will focus in on, that makes sense. 25:13.780 --> 25:18.840 That seems consistent with a lot of the things that I've read and what we've been talking about. 25:18.840 --> 25:26.440 I think probably the biggest unknown there is what the definition of unauthorized access is. 25:27.300 --> 25:30.100 There's a huge disparity of opinion. 25:30.660 --> 25:34.760 The Act doesn't define it, as anybody who's delved into it knows. 25:35.120 --> 25:39.440 And they really left it up to the courts to come up with a definition. 25:39.440 --> 25:45.640 And as a result, there is a very, very wide spectrum of views on what that unauthorized access is. 25:45.640 --> 25:55.000 And the crux of it is that, is the user, when they approach the Internet, are they in the default position of being unauthorized? 25:55.640 --> 25:58.040 Or is it the exact opposite? 25:58.040 --> 26:12.380 That unless something on the Internet end gives some kind of a signal to the user that you can't come in here, is the default of the user coming in, actually, I have open access? 26:12.380 --> 26:17.120 So it really comes down to a policy debate about whether the Internet's open or not. 26:18.220 --> 26:20.820 And there's a paper that I refer to in my paper. 26:20.820 --> 26:29.200 If you want to get into excruciating detail on the status of what unauthorized access means, I would point you to that for further detail. 26:29.300 --> 26:39.940 But irrespective of what some commentary on the CFA may say, I really think that the future of where this is going to go, at least at that level, is going to come down to unauthorized access. 26:41.580 --> 26:42.460 Yes? 26:43.220 --> 26:44.100 I've heard... 26:44.660 --> 26:45.820 Can you stand up? 26:45.820 --> 26:46.400 I can't hear. 26:46.400 --> 26:46.840 Sorry. 26:46.900 --> 26:47.360 I've heard 27:14.930 --> 27:15.370 . 27:15.570 --> 27:24.410 So your question is that if you're broadcasting it and it's unencrypted, you don't have the right of privacy to what you're broadcasting? 27:24.830 --> 27:25.430 I don't know. 27:25.430 --> 27:26.870 Anyone want to comment on that? 27:29.110 --> 27:34.510 Basically, I think you're correct in that you don't have a right as far as the reception goes. 27:34.930 --> 27:36.350 You've sent it out there. 27:36.350 --> 27:42.370 However, there are some laws that will conflict with that directly, specifically the one regarding e-mail. 27:43.590 --> 27:52.610 It's illegal to intercept e-mail if you're not the recipient, if you're not one of the carriers, or you're not the one that's transmitting it. 27:56.920 --> 27:59.140 And that's the real gray area. 27:59.140 --> 28:06.200 If you capture it and you realize it's an e-mail, where are you crossing the line? 28:06.200 --> 28:13.900 Because if you just get a header and it's an e-mail header, and you say, oh jeez, I'm not going to read anymore, have you crossed the line? 28:14.340 --> 28:16.400 I'd say maybe, maybe not. 28:16.600 --> 28:21.160 If you go through the whole thing, you've probably definitely gone way past where you should have gone. 28:23.100 --> 28:31.360 But if someone's just broadcasting everything that's going out there that they've been getting, all their web surfing and all that, a lot of that's completely open. 28:31.360 --> 28:32.680 That's their own problem. 28:33.320 --> 28:37.740 I would add that I discuss this a little bit in my paper. 28:38.060 --> 28:52.300 If you want to push the Computer Fraud and Abuse Act aside for a minute and get down to common law issues like trespass, there have been cases in which they've likened unauthorized access to trespass. 28:54.480 --> 29:05.220 The views that come down there are if you're not protecting your access point and taking steps to protect it, then there's an implied authorization you're giving to the user. 29:05.600 --> 29:13.700 And again, that relates to the point I made earlier about the debates about this unauthorized access business. 29:13.700 --> 29:20.320 I would also add that I think that if you really boil it down to the bone right now, the Feds can tap into the Internet without a warrant. 29:20.320 --> 29:22.760 I mean, that's basically the way it stands right now. 29:22.760 --> 29:24.940 So we can debate that endlessly. 29:24.940 --> 29:28.640 But I think that if you really boil it down, that's really what's the bottom line. 29:28.640 --> 29:32.640 So the Feds could tap into the Wi-Fi network without... 29:33.540 --> 29:35.300 That's my current understanding. 29:35.300 --> 29:38.820 But again, there's a lot of conflicting views about that. 29:38.940 --> 29:39.600 Okay. 29:39.600 --> 29:40.380 Thank you. 29:40.380 --> 29:41.760 Any other questions? 29:44.340 --> 29:45.140 Okay. 29:45.140 --> 29:49.920 One other issue I'm going to bring up again is this issue of who's responsible. 29:50.220 --> 29:58.280 So I think what we've talked about here is the problem, which is they try to make it easy for you to use Wi-Fi. 29:58.280 --> 30:01.380 At the same point, they make it insecure. 30:01.960 --> 30:19.380 So one of the things that I've talked about with several of the members of the panel here is, in a sense, that we believe there needs to be a much stronger effort on the part of the software and the hardware manufacturers to change, in a sense, not only their marketing literature, 30:19.380 --> 30:26.200 but change the way they ship this equipment and this software so that, in a sense, security becomes the default. 30:26.200 --> 30:29.660 I know we addressed that a little bit, but I'm asking that specific question. 30:29.660 --> 30:40.720 Do they believe that if a case were to happen, that we did have unauthorized access, do you believe that the software and the hardware manufacturers share some responsibility? 30:42.140 --> 30:47.020 I don't think that the software and hardware manufacturers could be held directly liable. 30:47.560 --> 30:51.420 The end user, you know, stupidity is not a valid defense. 30:51.420 --> 31:10.160 If you didn't secure your access point, and somebody ends up accidentally being on there intentionally, my personal opinion is that if you leave it open and you specify in the SSID that it's free access, then go for it. 31:10.160 --> 31:17.520 If it is not specifically telling you free access, you know, surf me, anything like that, take some pity on these people. 31:17.520 --> 31:19.020 You've probably got high-speed internet at home. 31:19.020 --> 31:20.640 You don't need to mooch off of other people. 31:20.640 --> 31:23.040 Hotels have Wi-Fi, usually. 31:24.100 --> 31:31.080 There are much better ways of doing it than, you know, trouncing around in this legal gray area and get yourself in trouble. 31:31.780 --> 31:35.500 At some point or another, it's going to be ubiquitous. 31:35.500 --> 31:39.620 You know, we're just going to be able to open things up and it's there, all nice and legal. 31:39.620 --> 31:44.300 But for now, yeah, drive the two blocks down to the Kinko's or wherever and use theirs. 31:44.840 --> 31:46.360 Just cover your butt. 31:46.440 --> 31:54.080 I just really wish I could have smacked Linksys around a couple of years ago when they were putting this stuff out because they just... 31:54.080 --> 31:56.140 they seem to be the biggest part of the problem. 31:56.140 --> 32:03.200 Their manuals are getting better, but I still hold them responsible for so much of this because they're making it so easy. 32:03.700 --> 32:05.140 It's not even like you're having... 32:05.140 --> 32:11.060 the tools are out there to break a lot of the security that's in place, but they just make it so much easier for everybody. 32:11.380 --> 32:17.820 As he said, if you have a Linksys at home, Linksys out in the park, it just hops on there. 32:17.820 --> 32:21.180 And suddenly people can suddenly commit a felony on their own. 32:21.180 --> 32:23.400 The software and everything helps them. 32:23.520 --> 32:31.720 They could very easily go too far and start checking email, start realizing, hey, I can use this as a launching point for other things. 32:32.520 --> 32:33.260 Thank you. 32:33.260 --> 32:33.800 Robert? 32:33.800 --> 32:42.660 I would just say that it's the job of the plaintiff's bar to come up with a lot of these outlandish and bizarre theories of liability. 32:42.660 --> 32:53.060 As any of you know from buying appliances like toasters and hairdryers and pretty much anything nowadays, it's got warnings all over it, that you, you know, really stupid stuff like, you know... 32:53.060 --> 32:55.420 Do not iron pants while wearing... 32:55.420 --> 32:55.940 Yeah, yeah. 32:55.940 --> 33:02.520 I mean, really, that's all there because there's enough books to fill this room about product liability. 33:02.520 --> 33:05.980 And the reason I mention that is that the whole idea here is to make... 33:05.980 --> 33:11.160 well, maybe not everybody would agree with this, but they're trying to make computers a newer appliance, right? 33:11.160 --> 33:21.240 So to the extent that that keeps getting pushed, it's not inconceivable that you could come up with some kind of theory like that. 33:21.240 --> 33:32.200 So I think it's extremely unlikely that Linksys or other companies ever come under any kind of liability, but it's not impossible, given the history of litigation within the product liability space. 33:32.200 --> 33:37.180 But I completely agree with the points made that they really need to do more. 33:37.180 --> 33:39.320 Doesn't mean we can't yell at them still, though. 33:39.860 --> 33:41.960 Yeah, I would agree with that. 33:42.020 --> 33:45.760 Like I said earlier, there's a certain amount of RTFM. 33:45.760 --> 33:51.920 However, I also think the companies, as companies, owe us something to get their product right. 33:52.120 --> 34:01.780 And for all the abuse Microsoft takes on a lot of different things that they absolutely deserve, the one thing they did right, in my opinion, was with their Wi-Fi appliances. 34:01.800 --> 34:05.980 They went to a default encrypted mode. 34:06.240 --> 34:08.640 They were the first and the only product to do that. 34:09.120 --> 34:11.440 I'd like to see the other products do that. 34:11.620 --> 34:12.600 I'd love to see it. 34:13.640 --> 34:14.560 Thank you. 34:14.560 --> 34:22.000 Before we finish, I just want to know if any of you saw this article in the newspaper, which we have up at our booth, that 10 more commandments were found. 34:22.400 --> 34:31.160 And I'm not sure that anybody is aware of it, so we made up a T-shirt about it, which I think really talks on what we're going for ethical war driving. 34:31.160 --> 34:32.660 The 11th commandment. 34:32.700 --> 34:35.520 Thou shalt not covet thy neighbor's Wi-Fi. 34:36.000 --> 34:36.440 So... 34:39.980 --> 34:42.160 Thank you all very much for coming. 34:59.240 --> 35:07.120 If you're actually hoping to have some level of security by hiding your SSID, I don't think that anyone would actually say that works as security. 35:07.940 --> 35:12.340 You could make an argument, but it's just a matter of using a different tool to find it. 35:12.860 --> 35:24.620 I don't think there would be enough there for anybody to complain that I was trying to secure my stuff, why are you on here? 35:27.360 --> 35:29.760 Do we have any other opinions on that question? 35:31.380 --> 35:31.740 Okay. 35:32.320 --> 35:34.200 Thank you all very much for coming. 35:34.200 --> 35:37.020 Alright, we've got time for two more. 35:37.020 --> 35:37.400 Go ahead. 35:53.160 --> 35:55.420 I really wish that they would. 35:55.540 --> 36:04.880 I'm not a lawyer, but I've seen cases where companies will go in, install wireless access all over the place in a business, leave it wide open and walk away. 36:04.940 --> 36:07.680 I don't think it's due diligence and it's not very professional. 36:08.300 --> 36:12.460 The companies, I think, would probably be best sued civilly if something did happen. 36:13.760 --> 36:17.080 Ethically, who are these people that are setting these things up insecurely? 36:17.080 --> 36:19.220 They're supposed to be... you're hiring the expert. 36:19.220 --> 36:20.620 Why aren't they reading the manual? 36:20.620 --> 36:22.940 Why aren't they doing what their job is? 36:23.240 --> 36:24.320 I'd say two points. 36:24.320 --> 36:27.500 It's conceivable they would be held liable civilly, maybe. 36:27.560 --> 36:31.680 The second thing I'd say is most of these laws have loopholes for... 36:33.460 --> 36:42.220 you could say information security or technical loopholes to allow for these types of things. 36:42.220 --> 36:45.040 So it's conceivable they could get immunity under something like that. 36:47.060 --> 36:47.820 Yes. 36:56.300 --> 36:58.540 Does that count as wiretapping? 36:58.780 --> 37:00.060 It's conceivable? 37:00.060 --> 37:02.760 That's a topic I mentioned briefly in my paper. 37:02.760 --> 37:10.100 Certainly, again, if you're going to find liability under CFAA, under the facts you described, there's no reason why you wouldn't find it under the wiretap laws. 37:10.200 --> 37:19.720 One of the points that we make in the beginning here is that we know what we interpret some of these state and federal laws to be. 37:19.720 --> 37:24.160 The question remains over the next few years how the courts will interpret them. 37:24.400 --> 37:36.080 And we need to walk, as hackers and as people who advise people out in the field, we need to walk a fine line and make sure that we're not going into an area which is gray without knowing that we're going into a gray area. 37:36.080 --> 37:38.260 Any other questions? 37:39.340 --> 37:40.620 Okay. 37:40.620 --> 37:42.220 Thank you all very much. 37:42.220 --> 37:43.160 Enjoy DAPTCON.