Hacker News Reader

Comment by varispeed | Hacker News Reader

This must be illegal, right?

Why would it be illegal to listen to or record broadcasts in the unlicensed ISM band? In fact monitoring the band is part of the wifi standard itself, as wifi devices are supposed to avoid interfering with each other even if they are not associated to the same AP. Most devices monitor the entire 2.4ghz and 5ghz bands for beacons from APs to give the user a listen of available networks and to support roaming.

The Computer Misuse Act [0] makes it an offence to commit "unauthorised access to computer material". Obviously Google thinks they can get away with it, but it's an entirely reasonable question. I'm not saying what they are doing is illegal, but their approach to tax hardly demonstrates good-faith approach to the law.

[0] https://en.wikipedia.org/wiki/Computer_Misuse_Act_1990

IANAL but the fact that you are using wifi means that you are authorizing others to monitor everything you transmit -- that is literally in the wifi standard. It is also worth pointing out that no computers are being "accessed" here, we are talking about recording the wifi beacons that APs broadcast (also part of the standard), so the only relevant laws should be those governing radio equipment. Even if we wanted a world of tightly controlled access to radio receivers (again, we are talking about recording and not about transmitting), the ISM bands that wifi uses were specifically set aside for unlicensed use by the general public.

The fact is that your ability to simply plug in a wifi router and use it with any devices you want, without having to coordinate with anyone or buy a SIM card or whatever else, comes with the understanding that anyone else can monitor your wifi network for any purpose (and in fact this is a requirement of the wifi standard). If monitoring someone's wifi transmissions required their explicitly approval, nobody would be able to use wifi -- every time you moved your phone from one place to another, you would first need permission from every wifi station operator to monitor their transmissions before your phone could use wifi (you would not even be able to join a network you had previously used, because doing so requires your phone to listen to beacons being transmitted by nearby APs).

I'm not going to guess the foibles of law, especially the British courts.

But the intention of accessing your network for the purposes of choosing a network you're authorized to use is different from connecting to networks you know you do not have authorization to use, and then for a purpose that a reasonable person wouldn't expect would be assumed.

I.e. I think it's reasonable to expect that I grant permission to my neighbours and passers-by to access my network for the purpose of choosing their own network. I don't expect that they will be adding my address to a data-set.

And maybe individuals do speculatively connect to random networks, but that's different to doing it at an industrial scale.

Except that nobody is connecting to a network without permission. Again, we are talking about monitoring radio transmissions (wifi beacons) in an unlicensed band. You do not need to connect to a wifi network to receive beacons from the AP, those are transmitted periodically as part of the normal operation of the AP.

You seem to be hung up on what is being done with the recorded beacons, but we are talking about the unlicensed band, so you have no reasonable expectations about what is being done by anyone. That is the point of the unlicensed band. It is meant to be a free-for-all, which is the only thing that is suitable for consumer applications (imagine if every phone, laptop, router, drone, microwave oven, baby monitor, etc. you purchased required you to get permission from everyone around you before it could be used).

Not hung up, just interested in exploring it. Thanks for the info, I'd assumed that the SSID broadcast was done on the same band as the actual network communications.

It is broadcast on the same band as the communications, which is almost always in an unlicensed band (if your wifi network used a licensed band you would know -- you would have had to fill out a bunch of paperwork and pay a fee for your license). The point here is that anyone can monitor your wifi transmissions, not just the AP beacons, for any purpose.

Why would collecting publicly advertised information be illegal?

I get your sentiment, but there is a big difference between that information being publicly available somewhere and someone building a centralized private database of it.

At least, IF you assume that e.g. "database copyright" serves a valid purpose, then you could make a similar case here that the collection of all these data points is qualitatively different from collecting any single data point.

Note: I used a capital "IF" up there because I do have issues with database copyright. But that's the world we live in...

If they did the same tracking but to other phones instead of access points would that cross a line?

Are you uncomfortable with the idea of someone monitoring the ISM band and collecting information about what is being transmitted and by which stations? If so, maybe you should stop using wifi, since that is actually part of the wifi standard (your phone is literally monitoring transmissions on your neighbors' wifi networks to avoid interference).

Lots of publicly available information is illegal to collect, for copyright reasons, privacy reasons, security reasons, etc.

Do you really want to make passive wardriving illegal? Literally anybody who sets up a wifi system has probably seen the list of other people's networks within a some-meter radius. How could you possibly think there's a reasonable expectation of privacy with your SSIDs?

I did not say I want to make it illegal, just pointing out that it’s not some completely bizarre idea.

I think it would be reasonable to have various restrictions on all kinds of large scale datasets, especially when they include data that is easy to connect to individuals, and especially when it was not compiled with their explicit (informed, opt-in) consent. This includes public information such as what I’m wearing, where I am at what times, when and where my wifi is on.

I'd think there's a difference between use and abuse

The same way you cannot photograph people on the street and collect their facial image for processing.

They publicly advertise their face though, right?

Just the fact that information is available, it does not imply there is a consent for 3rd party to do anything with it.

Except you can? The courts (in the US) have consistently ruled that you have no expectation of privacy in the public square. ALPRs on police cars are perfectly legal if there’s no laws prohibiting them.

Sure, take a picture of someone, so his or her face is the main content of the picture and start posting it everywhere (it's your picture so you can do whatever you want, right?).

> ALPRs on police cars

Government is usually exempt from those things or have license.

Reply on news.ycombinator.com