Court Ruling Paves The Way For Better, More Reliable Wi-Fi

from the bigger-faster-stronger dept

A ruling (pdf) last week by the U.S. Court of Appeals for the District of Columbia Circuit has paved the way for deployment of faster, better Wi-Fi, while simultaneously cementing the FCC's authority to make important decisions related to spectrum and interference concerns.

Last year, the FCC voted to open up a chunk of spectrum in the 6GHz band for unlicensed use, providing more airwaves to be used by Wi-Fi and other technologies. Wi-Fi is the most immediate beneficiary; this posed the biggest expansion of available spectrum since Wi-Fi was first unveiled back in 1989. The expansion, and the new standards making more efficient use of more spectrum, should result first in better, more reliable Wi-Fi, and ultimately faster speeds of 1–2 Gbps connections over Wi-Fi. That means better broadband, and more innovation in the band:

Granted, large wireless carriers like AT&T didn't much like this plan. They wanted the FCC to auction off this swath of publicly owned airwaves to them for deployment of their 5G networks. Carriers masked this ambition under interference concerns in a subsequent lawsuit, claiming that Wi-Fi in these bands would interfere with the "tens of thousands of microwave links critical to maintaining network infrastructure." The FCC and its staff of engineers (and a bipartisan array of commissioners) disagreed, and found that opening this spectrum to unlicensed use served both innovation and the public interest.

Now, the court has reiterated that the FCC has the expertise and authority to make these kinds of decisions. That had long been understood, but there's been a concerted effort to reduce the FCC's authority on countless fronts over the last decade. First, you watched as the broadband industry effectively gutted much of the agency's consumer protection authority with the net neutrality repeal. We also watched a heavily-lobbied Congress gut the FCC's broadband privacy authority with a partisan vote. More recently, everybody from the wireless industry to the FAA has been trying to malign the FCC's engineering authority (see: the FAA's weird attempt to limit 5G deployments based on shaky interference and safety claims).

The court basically made it clear the FCC has the expertise and authority to make major decisions in this space -- provided it clearly explains why with real-world data (something it often didn't do during the Trump era).

It's one of those weird and rare instances where a bipartisan coalition of FCC officials all align to do the right thing, despite heavy meddling from giant wireless carriers like AT&T, ever eager for policies more favorable to their bottom lines. The coalition of companies excited to develop innovative products making use of the additional spectrum are understandably happy about the ruling, as are consumers and tinkerers looking forward to better, faster Wi-Fi -- and the policy wonks happy to see the FCC's authority to do its job cemented by the courts.

Filed Under: 6ghz, fcc, spectrum, unlicensed spectrum, wifi

Five Bar Owners Arrested In France For Not Logging Internet Use By Patrons Using Bars' WiFi Connections

from the what-even-the-fuck-but-in-French dept

A seldom used mandate from France's 2006 anti-terrorism law is being wielded rather conspicuously in a single French city to lock up small business owners.

At least five bar owners in Grenoble, France have been arrested for providing WiFi at their businesses without keeping logs. The bar owners were arrested under a 2006 law that technically classifies WiFi hotspot providing establishments as ISPs, and require them to store one year’s worth of logs or connection records for anti terrorism purposes.

France has a long and inglorious history of forcing ISPs to log user activity, but this is the first time data retention laws have been used against business owners who allow customers to connect to their WiFi. In 2011, the law was expanded to demand the logging of user login info and passwords, thus ensuring service providers would always be tempting targets for malicious hackers.

The new and sudden enforcement of a nearly 15-year-old law seems pretty weird, considering it only targeted five bar owners in one city. This suggests Grenoble law enforcement might have a bit too much time on its hands. It doesn't appear to be part of a larger sweep across the country to (harshly) remind small business owners of their data retention obligations.

The bar owners -- who were all released after questioning -- said the hospitality section union (UMIH) never made them aware they needed to retain 365 days of customer internet activity, despite holding several conferences and seminars on running hospitality business. UMIH responded by saying it's not the union's fault members don't read UMIH junk mail.

Umih admitted that the training doesn’t mention WiFi logging but noted that Umih members should have known about this important requirement because it was mentioned in a newsletter.

Dystopia -- well, more of it -- has come to Grenoble, France. Five bar owners are now more than fully aware of their data retention obligations. Since these arrests have made international news, it's safe to assume customers are also now fully aware their internet activity is being logged and stored every time they connect with a bar's hotspot.

Not that staying home helps. Bar patrons face the same harvesting of data whether they stay in or go out. ISPs -- which includes anyone offering a "public" connection -- are under the same obligations. Failing to do so could net bar owners (or cable company employees) a 75,000 Euro fine and up to a year in prison.

And, in a damned if you do/damned if you don't twist, there's a good chance this kind of logging -- especially without explicit consent from patrons -- violates the far-more-recent GDPR. But few bar owners will have the money needed to challenge France's law or have the ability to run this by the EU Commission for a second look. That leaves it up to the local cops, who appear to have found a new way to make things periodically miserable for the community they serve.

Filed Under: anti-terrorism, bar wifi, cafe wifi, france, isps, logs, privacy, small businesses, wifi

Google Finally Settles Lawsuit Over Decade-Old WiFi Snooping Accusations

from the that-took-some-time dept

So if you've been around these parts for a while, you might remember a big stink back in 2006 or so when Google's Street View vehicles were found to have been hoovering up data collected via WiFi. The collection came while the company was collecting Street View data via its army of specially-configured vehicles, and included pretty much any and all unencrypted data traveling over those networks, including telephone numbers, URLs, passwords, e-mail, or video streams. The goal was purportedly to ensure better geographical positioning data, but the data collected went well beyond what was needed for that goal.

Initially, Google claimed that the data collection was accidental, something supported by engineering analysis at the time. Here's what Google said in 2010 about the issue:

"So how did this happen? Quite simply, it was a mistake. In 2006 an engineer working on an experimental Wi-Fi project wrote a piece of code that sampled all categories of publicly broadcast WiFi data. A year later, when our mobile team started a project to collect basic WiFi network data like SSID information and MAC addresses using Google's Street View cars, they included that code in their software—although the project leaders did not want, and had no intention of using, payload data."

In 2012 however, an FCC document detailed how a Google engineer had created a system that collected this data intentionally, but had downplayed the privacy risk because Google Street View vehicles would not be "in proximity to any given user for an extended period of time," and "[n]one of the data gathered ... [would] be presented to end users of [Google's] services in raw form." And while the engineer was probably right that not much useful data was collected, doing so at all was admittedly not a bright idea, and the "mistake" wound up being an intentional, poor engineering choice signed off on by project managers.

Admittedly the real-world risk of the entire scandal was violently over-hyped. The moving vehicles only had access to hotspots as vehicles passed for a few seconds, frequent channel hopping reduced data collection further, and again, the entire effort only collected data from hotspots that didn't use encryption Still, it was a dumb decision any way you slice it.

Fast forward thirteen years after the data collection occurred, and Google has finally put the entire scandal to bed, at least here in the States. The company will wind up paying $13 million to settle a 2010 lawsuit over this data collection. Because the data is so fragmented, it's hard to actually identify whose data was collected during that period; so the payout will largely go to lawyers and a handful of privacy activism organizations:

"Lawyers for the plaintiffs said it would be difficult to identify masses of affected people, a decade later, from the random snippets of data that the company collected when its vehicles drove by their homes.

Instead, what’s left of the $13 million -- after administrative costs and the lawyers who brought the lawsuit get a commission of as much as 25% -- will be distributed to a handful of consumer privacy advocacy groups, according to a court filing detailing the terms of the deal."

While this scandal may have been over-hyped, it still managed to highlight how non-transparent privacy practices are, how companies have few reservations when it comes to misrepresenting what actually happened, and how long it takes to actually achieve anything even vaguely resembling accountability. Of course in the decade-plus since this scandal began, it has become abundantly clear that this sort of casual disregard for user privacy was always more of a feature than a bug, and we're still not doing a very good job coming up with a meaningful model for doing much of anything about it outside of hand-wringing and hysteria.

Filed Under: privacy, street view, wifi
Companies: google

Comcast Exposes Customer WiFi SSIDs and Passwords For Customers Paying To Rent A Comcast Router

from the pay-to-be-hacked dept

Look, when it comes to Comcast, it's obviously quite easy to slap the company around for any number of its anti-consumer practices. Just sampling from the most recent news, Comcast was sued over its opt-out mobile hotspot from your home router plan, the company has decided to combat cord-cutting by hiking prices and fees on equipment for customers who cord-cut cable television, and it also has put in place a similar plan to charge all kinds of bullshit fees on equipment installations for customers who aren't bundling in other services with its ISP offering. You should be noticing a trend in there that has to do with how Comcast handles so-called "equipment rental" fees for its broadband customers and how it handles customers that choose to bring their own device to their home networks instead. Comcast has always hated customers that use their own WiFi routers, as the fees for renting a wireless access point represent a huge part of Comcast's revenue.

Which is why you would think that the company would at least not expose the home networks of customers who use that equipment. Sadly, it seems that Comcast's website made the network SSIDs and passwords available in plain text of customers who were renting router equipment, while those that used their own routers were completely safe.

A security hole in a Comcast service-activation website allowed anyone to obtain a customer's Wi-Fi network name and password by entering the customer's account number and a partial street address, ZDNet reported yesterday.

The problem would have let attackers "rename Wi-Fi network names and passwords, temporarily locking users out" of their home networks, ZDNet wrote. Obviously, an attacker could also use a Wi-Fi network name and password to log into an unsuspecting Comcast customer's home network.

It should be noted that Comcast almost immediately addressed the security flaw in its website after ZDNet's report. Still, we're not in the business of giving high marks to a company that fixes a laughable security hole on its website. Comcast reps also claimed that "There's nothing more important than our customers' security." But, if that were true, Comcast's position would be to advocate its customers use their own routers rather than renting Comcast routers, as those who did so were completely protected from this security risk.

Just to be clear, we're talking about really sensitive information exposed by this website flaw. WiFi network names and passwords are one thing, but malicious actors were also presented with the routers' physical home addresses, despite the attacker not needing a customer's full home address in order to access that information. And all of this was presented in plain text.

Any company making these kinds of dangerous mistakes would be bad, but it's worth putting all of this in the context of Comcast both operating in a competition-deprived unregulated ISP market and that it is trying to get even bigger through major acquisitions to gobble up even more market-share. That kind of attempt at ISP monoculture makes any security flaw exponentially worse and Comcast has not demonstrated its ability to live up to the security task.

Meanwhile, why anyone would rent a Comcast WiFi router is completely beyond me.

Filed Under: passwords, privacy, routers, wifi
Companies: comcast

UK WiFi Company Uses Overlong TOS To Trick Hotspot Users Into Cleaning Toilets, Hugging Stray Cats

from the sign-your-life-away dept

So we've talked for years about how overlong terms of service contracts that nobody reads are used to eliminate your rights in numerous ways. That includes stripping away your legal rights and forcing you to engage in binding arbitration, which results in the company-employed arbitrator ruling in their employer's favor a vast majority of the time. In fact Tim Berners-Lee, the creator of the World Wide Web, recently cited these overlong and misleading contracts as one of the biggest threats to the health and utility of his invention.

Every so often we'll see a company conduct an experiment to demonstrate the stupidity of long-normalized behavior, like the company in 2010 that got users to sign off on selling their soul. Taking a cue out of that playbook, UK WiFi hotspot operator Purple recently did something similar, burying a provision in their terms of service requiring that customers engage in 1,000 hours of menial labor if they wanted to access the internet.

Purple currently provides hotspot connectivity to Legoland, Outback Steakhouse and Pizza Express, and stated in a blog post that they provided patrons with a wonderful array of possibilities in terms of how to pay down their community service time, including:

The company says it ultimately found that over 22,000 users blindly signed off on the requirement during the two week period during which the experiment was conducted. It should go without saying that they won't be enforcing the rules, but wanted to simply get a little free press while highlighting the stupidity of overlong TOS. Impressively, they note that during the two-week trial, just one user actually noticed what he was signing off on:

"Don’t worry, we aren’t going to round up these individuals and ask them to don their rubber gloves and repay the community debt. The real reason behind our experiment is to highlight the lack of consumer awareness when signing up to use free WiFi. All users were given the chance to flag up the questionable clause in return for a prize, but remarkably only one individual, which is 0.000045% of all WiFi users throughout the whole two-weeks, managed to spot it."

While these pranks go a long way in highlighting the problem, there's few if any real efforts to actually do much of anything about it. We desperately need simpler, cleaner terms of service updated for the digital age, but since companies adore using these lengthy, confusing contracts to protect themselves, hamstring your product ownership rights and make additional revenue, nothing much ever changes.

Filed Under: hotspots, terms of service, tos, uk, wifi
Companies: purple

Top UK Cop Says Hackers Should Be Punished Not With Prison, But With Jammed WiFi Connections

from the yeah,-that'll-work dept

Here's a story that starts out well. One of the UK's top police officers, Chief Superintendent Gavin Thomas, has said that putting people in prison for offenses like hacking into computers makes no sense. He points out that it costs around $50,000 a year to keep someone in a traditional prison, and that education programs are likely to be a far more cost-effective solution, especially in terms of reducing recidivism. This is absolutely right, and it's great to hear a senior officer admit it. Unfortunately, things go downhill from here. He told the Telegraph:

If you have got a 16-year-old who has hacked into your account and stolen your identity, this is a 21st century crime, so we ought to have a 21st century methodology to address it.

His solution is as follows:

He said convicted criminals could be fitted with electronic jammers around their wrists or ankles which blocked wifi signals and prevented them from going online.

Leaving aside the human rights implications, which to his credit Thomas acknowledges, there is another big problem with the proposal, as Techdirt readers have doubtless already spotted. The people wearing these WiFi jammers would be those who have been found guilty of some computer-related crime. By definition, then, they are likely to be tech-savvy. So they probably have other computers that can use Ethernet connections to access the Internet. In addition, they are unlikely to have any problems using Bluetooth or a USB cable to reverse-tether their mobiles to a system with wired access. The more adventurous might even try to rig up some kind of Faraday shielding to jam the jammer. In other words, this isn't going to work, but would probably cause havoc with everyone else's WiFi connections.

Back in 2015, Thomas was quoted by Computer Business Review on the topic of encryption, and the problems it posed for the police, when he said:

It is utterly essential for detectives and criminal investigators to use data held on smartphones and other devices when they are investigating serious crimes.

Given his belief that jamming bracelets would stop convicted computer criminals from using the Internet, the worry has to be that he shares the mistaken view that tech companies can create a safe system of crypto backdoors or "golden keys" that only the authorities can use. Let's hope he takes some expert advice before offering an opinion on that one.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: access, gavin thomas, hackers, jail, law enforcement, punishment, uk, wifi