Judge Says Sniffing Unencrypted WiFi Networks Is Not Wiretapping

Privacy

from the if-it's-freely-available... dept

There’s been a lot of discussion over the past few years concerning whether or not intercepting data on an open WiFi network is a form of “wiretapping.” This has been a central issue in one of the legal challenges to Google’s Street View cars collecting data from open WiFi networks. I’ve long argued that on such an open network, it shouldn’t be wiretapping because it’s wide open and available for anyone to see. Yes, that may be a security concern, but it’s one that an individual user can deal with. It certainly shouldn’t be illegal for someone to sniff that data. If you’re broadcasting something free and clear and I then read it… how is that wiretapping? Unfortunately, last year a judge in a case related to Google’s Street View capturing came to the opposite conclusion, but in a convoluted way where the court declared that WiFi is not a radio communication (even though it is).

However, in a totally unrelated case, a judge has now come to the exact opposite conclusion again, and noted that sniffing open WiFi is legal. The case is one that we’ve already talked about, though in a very different context. A patent troll called Innovatio IP has sued a bunch of businesses (hotels, coffee shops, restaurants) that offer WiFi to users, claiming that anyone using WiFi infringes, though it says “at this stage” it won’t go after individual users, only businesses. In trying to win its patent lawsuit, it wanted to use evidence from packet sniffing on some open networks, and asked the court to say that this is legal. And the judge has now said it is. First, unlike in the Google case, the judge has no problem recognizing that WiFi is electronic communication using radio waves. Then it points out that open WiFi quite clearly fits under the stated exception to the wiretapping laws, which is that they do not apply to “a system that is configured so that such electronic communication is readily accessible to the general public.” The judge then pushes back on the ruling in the Google case, noting that the judge there claimed that the data on an open WiFi network was only available via “sophisticated technology.” This judge isn’t buying it:

… upon examination, the proposition that Wi-Fi communications are accessible only with sophisticated technology breaks down. As mentioned above, Innovatio is intercepting Wi-Fi communications with a Riverbed AirPcap Nx packet capture adapter, which is available to the public for purchase for $698.00. See Riverbed Technology Product Catalog, http://www.cacetech.com/products/catalog/ (last visited Aug. 21, 2012). A more basic packet capture adapter is available for only $198.00. Id. The software necessary to analyze the data that the packet capture adapters collect is available for down load for free. See Wireshark Frequently Asked Questions, http://www.wireshark.org/faq.html#sec1 (last visited Aug. 21, 2012) (“Wireshark is a network protocol analyzer. . . . It is freely available as open source. . . .”). With a packet capture adapter and the software, along with a basic laptop computer, any member of the general public within range of an unencrypted Wi-Fi network can begin intercepting communications sent on that network. Many Wi-Fi networks provided by commercial establishments (such as coffee shops and restaurants) are unencrypted, and open to such interference from anyone with the right equipment. In light of the ease of “sniffing” Wi-Fi networks, the court concludes that the communications sent on an unencrypted Wi-Fi network are readily available to the general public.

While the court admits that many users probably don’t know their unencrypted data is subject to sniffing, that does not play into the analysis. The law doesn’t say whether or not the user’s perception matters. It only matters if the communications are “readily available to the general public,” which they are. Legal expert (especially on privacy issues) Orin Kerr disagrees with this ruling, claiming that the intent of whoever configures the network is what matters, but I’m not sure I buy that claim either. He compares it to early cordless phones that easily “leaked” data, noting that no one designed those systems to do that, and the same is likely true in most cases with open WiFi. But that’s pretty different. The case of unencrypted data on an open wireless network isn’t some sort of accidental leakage, it’s the basic nature of any open network.

Either way, I get the feeling this is not the last we’ll be hearing of these kinds of cases. Though, if you’re really worried about your data on open WiFi networks, there’s an easy way to deal with it: encrypt your data.

Filed Under: privacy, sniffing, wifi, wiretapping