Hacker News new | ask | show | jobs
by wahsd 3961 days ago
I don't see how anti-rogue AP tech can be legal either unless it is within the confounds of your own property. Where WiFi jamming is technically also legal if it does not affect any external party.

What gives you, company xyz, the right to essentially DoS an AP just because they share the SSID? Just because you call something CorpWiFi, doesn't really make it legal to DoS someone else's SSID that is also called CorpWiFi. There does not seem to be any kind of legal framework that would allow you do so, but inversely, you are essentially then not only committing multiple types of crimes, but you are also violating free speech.

I get the reason, but the solution really needs to be something else, even if that something else is some sort of change to the WIFI spec and inclusion of some kind of authentication or security layer.

4 comments

> you are also violating free speech

Of course, since the example you described is an interaction between two private parties, there is no legal notion of free speech to violate.

The airwaves are considered a public space so it's not two private parties and the rules are different. (You can't just use air raid sirens to disrupt a public protest.) However, at a minimum you are likely to run into issues with the computer fraud and abuse act because your interfering with two other parties, and that has rather stiff penalties.

PS: Random noise is one thing; hacking someone’s Wi-Fi even using such a simplistic approach is very different.

It's two private parties acting in a public space. It may still be illegal to interfere, but the first amendment protects you from the government, not from other individuals.

You can't just use air raid sirens to disrupt a public protest

I'm not 100% up on my civil rights/protest law, but if you are a private party, I suspect you could. It is, for example, 100% legal to surround a protest with other people holding sheets to block them & their signs from view.

https://en.wikipedia.org/wiki/Disturbing_the_peace

This can include creating loud noise

Of note: A violation of a noise ordinance is in most jurisdictions not considered a disturbance of the peace unless the perpetrator has disregarded an affirmative request that he or she reduce the noise to a reasonable level. However, that would be implied in the air raid siren case.

Anyway, I agree it's not the 4th that's the issue. But, it's still unlawful conduct.

Ok, maybe no air raid sirens. But you could talk over them, which is a bit more analogous to what was done here :)
Talking over each other would be the same as running two or ten routers on the same channel, which is not an issue. This approach actively prevents communication.
Where WiFi jamming is technically also legal if it does not affect any external party.

I'll concede the possibility that my understanding is incorrect but jamming is flat out illegal(for non-government entities). It's illegal to even sell jamming devices. I remember a few years ago, the FCC started threatening movie theaters that had been jamming cell phones.

What is the legal definition of a jamming device? The wifi jamming being discussed does not interfere with any existing radio communications, it adds extra packets of data that the client device interprets. The original signal is fine, it's just not usable in a practical sense.

Broadcasting white noise on wifi frequencies to drown out communications is the sort of jamming that is clearly illegal, this likely isn't jamming under current laws.

There was also a guy in Florida who went to jail because he ran a jammer in his car during his work commute so people wouldn't text and drive around him.
I am not 100% sure, but I think if you are jamming signals on your own, personal, private property and the jamming does not extend past your boundaries, it might be legal. But that is an edge case that really doesn't apply in the vast majority of situations. The rule of thumb would essentially be that if you are jamming someone's signal outside of the strict boundaries of your personal, private property you are doing so illegally.
Especially in public gathering business, when you are subleasing some part of the attraction (alcohol, wifi) there are provisions in the contracts to ensure the provider is the only one providing the service. That's why it is usually illegal to bring own alcohol to festival. In this case they could argue to have acted in good faith according to the contract. Should the wifi provider/venue operator first block all APs and then accept rebutals that it is for personal use, or attempt investigations if given AP is for sale?
Illegal contract provisions are not enforceable. I can sign a contract saying you can jam my wifi, I can sign a contract saying you can kill me and serve me as the main course at the banquet, but you're still not actually allowed to do those things.
According to their response, it was within the bounds of their (leased) property. Not saying that makes it right, but FYI.
Yeah, still doesn't give them legal claim to 'This Wifi SSID'. Also, there are trespass statutes for people behaving as you don't wish within private property.

"Within the bounds" - so their walls are RF shielded, then?

> Yeah, still doesn't give them legal claim to 'This Wifi SSID'

Nobody has a legal claim to any wifi SSID. They don't have an exclusive claim to the conference SSID, and you don't have a legal claim to your hotspot's SSID (the one that's actually at issue here). Conflicts can occur, and the law has nothing to say about them.

> Also, there are trespass statutes for people behaving as you don't wish within private property.

Yes, there are, but it's not the FCC's role to enforce those particular statutes (nor should it be). The real question is whether the FCC should be unilaterally setting policy regarding interference at the MAC level where things like de-auth packets come into play. That's being discussed in another sub-thread, so I won't repeat the points here.

> Within the bounds" - so their walls are RF shielded, then?

No more that the average corporate HQ, but there seems to be a consensus here that doing the same thing in that context would be A-OK. Why the different treatment for two situations that are equal under the law?

Right. They don't. But they seem to think they can send de-auth packets that effectively say to third parties, "I am going to disconnect you from this network". That is at the least -implicitly- saying "I am claiming this SSID, and I am willing to use power/technology/tools to enforce this, whether you like it or not, whether I have the right to or not".

I never said the FCC was involved in enforcing trespass statutes. If there are people on your private property behaving in a way you deem unacceptable (even if legal), then the solution is to remove them from your property, not for you to illegally interfere with the use of the spectrum. That's vigilantism.

The Corp HQ example seems to work because there are clauses that surround intentional deception and the risk to security that could come there-from. When CorpHQSSID access points de-auth packets to an unauthorized access point using the same SSID.

That -wasn't- what was happening here. The convention center was saying "I don't care what your use of the wireless spectrum is, your hotspot, whatever, I'm going to interfere with it so that my SSID is the only one usable (oh, enter your credit card number here)".

Your contortion of logic, willful and disingenous ignorance of contradictions and interpretations don't change these facts. The issue was discussed many times, many lawyers were involved, and the outcome was decided - whether you think it should be or not (your perfect right), it -is- illegal.

You know if a private individual was disrupting a corporation's WiFi he'd be put in prison, right? People got sued for just using WiFis without permission, not even by the owners, but by the government.