Subject: [NEXTEL-1] Open Season on Wireless LANs

From: [email-masked]
Date: Sat, 17 May 2003 22:13:09 -0400

Open Season on Wireless LANs
By Jay Wrolstad
NewsFactor Network
May 16, 2003

Wi-Fi-based wireless local area networks are spreading like
wildfire among homeowners, businesses small and large, and such
public entities as libraries and government offices. But most
users pay little attention to security, inviting penetration of
their networks by anyone within range (about 300 feet) of an
unprotected access point.

And such intrusions occur all too often. In fact, "war driving" is
becoming an increasingly popular practice among mobile computer
geeks. War drivers cruise the streets with laptops rigged for WLAN
broadband connectivity searching for open access points.

Typically, they mark a new find with graffiti that flags the spot
for other Wi-Fi users. All most of these war drivers are
interested in is getting free Internet use. However, leaky WLANs
also give network intruders with more nefarious motives easy
entry.

Accidental Break-Ins
A law wending its way through the New Hampshire legislature could
have broad implications for anyone operating a wireless LAN by
offering a measure of protection for war drivers and would-be
hackers. In effect, the legislation puts the onus on businesses
and consumers to protect themselves.

New Hampshire state representative Richard Kennedy said he was
prompted to introduce HB 495 after a friend accessed a local
government WLAN -- and its files -- while trying to link up with a
network located across the street.

"It's illegal in our state to cut into a computer network, just
like it's illegal to tap a phone line, but people are connecting
to wireless networks by accident all of the time because they are
everywhere," Kennedy told NewsFactor. "We needed to clean up the
law."

Tell It to the Judge

Consequently, the New Hampshire measure stipulates that the owner
of a wireless computer network is responsible for securing such
network, and that "negligent or inadvertent" access is "an
affirmative defense" to prosecution.

The bill provides that those charged with unauthorized access to a
WLAN can escape legal responsibility simply by claiming they
believed the owner of the network granted access, or that they
could not have known that access was prohibited.

That pretty much gives the green light to war drivers, who need
only tell the judge, "The access point was open, so I assumed it
was okay to use." It boils down to a question of good faith. "If
you send a request to an access point and get approval, you have
every reason to believe that access point is available," said Cory
Doctorow, outreach coordinator for the Electronic Frontier
Foundation.

Network Sharing

"As long as there is no notice stipulating that access is
restricted, and as long as the individual is not trying to crack
an encryption code or taking other extraordinary measures to
connect, it should be legal," Doctorow told NewsFactor.

The EFF, a defender of digital rights, is an ardent supporter of
community WLANs, which have sprung up in San Francisco, Boston and
New York City, as well as many other locales. Participants
willingly leave their access points open for others to use, in the
belief that they are contributing to the common good. And some
ISPs allow their customers to invite the public to use their
access points, Doctorow pointed out.

Good Intentions

War driving has gotten a bad rap, Doctorow contends. A better
moniker might be "wireless network mapping," since most
practitioners are not malicious by nature.

When sites are located, they often are marked with symbols written
on the sidewalk or a nearby building in a practice known as "war
chalking." The marks can indicate the signal strength as well as
security features at a specific access point.

The term "war driving" is derived from the 1983 film "War Games,"
a cult favorite among hackers. It is a global phenomenon that
certainly has attracted thousands of participants, although
obtaining an accurate head count is virtually impossible since
they prefer to operate with anonymity.

Tough To Control

While obtaining free access to bandwidth is not in itself a
problem, reaching into the internal traffic on a business server,
for example, could be a serious invasion of privacy.

The pending New Hampshire legislation raises some intriguing
questions. "Suppose I deploy a wireless LAN without security,"
says IDC analyst Abner Germanow, "but it is used for malicious
purposes. Do I have any legal recourse against the person who used
it? Can I even track down that person?"

When individuals access a public WLAN at a coffee shop across the
street from a library, for example, the laptop is configured to
connect to the nearest, or strongest signal. The user cannot tell
if that network is located in the coffee shop or the library, he
noted.

Wi-Fi Industry on Notice

Because most WLANs involve sharing airspace and airwaves, multiple
parties often are sharing a physical network, each with different
policies for its use, Germanow said.

The New Hampshire proposal is intuitive, according to Aberdeen
Group analyst Dana Tardelli. He compares unprotected WLANs to a
car that is parked with the key in the ignition and the doors
unlocked -- an invitation to thieves.

"This could serve as a wake-up call for both WLAN users and the
industry. If you have an access point, and you don't want other
people on it, you have to take measures to secure it," Tardelli
told NewsFactor. And if a Wi-Fi system is difficult to secure,
people will not buy it, he added.

Leading the Way

Equipment vendors can do a better job of educating the public
and/or shipping their products with default protection measures,
Doctorow agrees. "Manufacturers should be held to a higher
standard," he said.

New Hampshire is the first -- and so far, only -- state to address
this legal gray area. The bill got the nod from the New Hampshire
house and is under review by the state senate. If signed into law,
it is scheduled to take effect in January 2004. Doctorow expects
that the courts will affirm the law and hopes that others will
follow the "Live Free or Die" state's example.

http://www.newsfactor.com/perl/story/21529.html

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Get A Free Psychic Reading! Your Online Answer To Life's Important Questions.
http://us.click.yahoo.com/Lj3uPC/Me7FAA/uetFAA/61FxlB/TM
---------------------------------------------------------------------~->

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/