Question in lieu of the 'Wifi' thread (aka Wardriving)

[Joe Mama]

(I didnt want to step on any forum no-no's so I started my own thread to expand on my question)

At any rate, it was presented by another poster that 'People were being arrested for using public or unsecured wifi' Most of the answers varied from sarcastic to 'no crime committed'

However, how would you handle a situation of someone who was deliberately seeking out unsecured (or poorly secured) wireless access points (i.e. Wardriving) http://en.wikipedia.org/wiki/Wardriving

There are no laws that specifically prohibit or allow wardriving, though many localities have laws forbidding unauthorized access of computer networks and protecting personal privacy.

While the act of wardriving itself isnt illegal - piggybacking (Connecting to the network and using its services without explicit authorization) is. Which would lead me to believe that someone engaged in the act of wardriving isnt breaking the law (yet) but they are gathering intel for something down the road.

So, back to my original question - How would you (or would you) handle an incident of someone gathering intel via wardriving but not necessarily piggybacking?

[mookster]

As I read your post, I gather that "wardriving" or "piggybacking" is equated to theft of services. The issue I see with that is proving what had happened and the theft of services. Water, taxi rides, even theft of electricity is rather easy to prove that amount of services pilfered. I'm not a big techy guy and would not have the first clue to gauge or place a value to the theft of wifi or charging a case in that situation.

I would write the incident up as an informational report documenting the incident the best I could and suggest to whomevers network had been used to increase their security.

[Michigan]

As I read your post, I gather that "wardriving" or "piggybacking" is equated to theft of services. The issue I see with that is proving what had happened and the theft of services. Water, taxi rides, even theft of electricity is rather easy to prove that amount of services pilfered. I'm not a big techy guy and would not have the first clue to gauge or place a value to the theft of wifi or charging a case in that situation.

I would write the incident up as an informational report documenting the incident the best I could and suggest to whomevers network had been used to increase their security.

+1

Besides proving it.... how is someone going to even know they are a victim of this?

[Dingo990]

I do believe Federal laws prohibit unauthorized connections to a network

[District B 13]

How do these questions even get asked?

[Joe Mama]

+1

Besides proving it.... how is someone going to even know they are a victim of this?

A letter from your ISP would be the most obvious. I actually had this happen as I let a buddy of mine hop onto my (secured) network. A few days later, I got a letter from my ISP telling me that I downloaded some copyrighted material and I knew exactly where it came from. (Needless to say, he is banned from using my wireless) More times than not, people are looking to commit their unsavory acts on someone elses network to help avoid detection. I have heard stories of people being investigated for internet crimes because someone else was piggybacking on their WLAN (and of course all internet activity points back to them) Corporate businesses have had sensitive information hacked due to poor wireless security. (Etc.)

The act of wardriving itself while not defined as criminal, it more than shows intent (IMO). Intent to do what is the million dollar question. As a network engineer whose job is to find vulnerabilities like these (on my own or even customers) systems is one thing - driving around a neighborhood with a giant antenna and a laptop mapping out your APs and just passively gathering information is something else entirely. Just because someone is ignorant enough to leave their car unlocked doesnt necessarily mean they deserve to be violated. I believe the same applies to their home networks. You would be surprised to see what sort of things people take for granted when it comes to securing their own network and computers.

[mookster]

I do believe Federal laws prohibit unauthorized connections to a network

If it's a federal law, than I won't be enforcing it on the state level. Only when the state enacts a law, which may in fact mirror the federal law word for word, will I be enforcing it. Reason being, I don't have a federal certification to enforce the federal laws.