For those who have read my blog for any amount of time, you already know that I am oddly fascinated with security. Am I a certified information security professional? No, I am not – at least, not yet. Nevertheless, I have been fascinated by both the techniques and the ethics of hackers.
And that fascination is nothing new. I installed my first WiFi access point last century. And I have had WiFi access within my home ever since. I did my first “war-walking” through my neighborhood in 2002. Then, I had a laptop an a PCMCIA card. And it was fun to know just how few of my neighbors had installed WiFi into their houses. Those that had taken the plunge were woefully under-secured.
But things sure have changed in the last decade. Now, over half of my neighbors also have WiFi. And more importantly, most have some form of security on their networks. At the same time, the tools I use have also changed. I now have a Droid 2 phone. And I am using tools like Wardrive and Wigle Wifi.
I have done two simple “wardriving” runs since I got my Droid 2. The first was on a car drive coming home from work. The second was on a bike ride to work. What fascinated me was just how many access points I found within such a small area. And more startling was the fact that I had found a thousand “new” access points and networks. [Note: “New” means that wigle.net did not have a record of this device at the specific GPS coordinates that I provided.]
After a very long day yesterday, I decided not to ride my bike home. I just didn’t have the heart to fight traffic after eleven hours at work. So I rode home with my wife. And I talked to her about my day. When I told her that I had done some wardriving, she was appalled.
As a geek, I was perplexed by her response. When I was riding my bike and collecting data, I was just inventorying the packets that were available from the street. And I was not even trying to probe the defenses of these networks. I was just cataloging the packets that my phone collected as I rode by. Nevertheless, my wife thought that I was doing something nefarious. I bristled at her “lack of understanding” of the simple and innocuous inventory I had collected.
But after several hours of thinking about her comments, I think I can understand her objection. Most of the people that have WiFi access points have no idea about computer security, licensed and unlicensed RF spectrum, existing law (in the form of local, state and federal statutes) or even the curiosity of hackers. What these users are doing is simple: they are using their home systems to perform simple tasks. And they are expecting a certain degree of privacy – even if they are doing the equivalent of electromagnetically shouting through their windows. Basically, people are assuming and expecting privacy. And to collect their carelessly scattered packets is a violation of an implicit trust arrangement.
But was I a party to that trust arranggement? No, I was not. Nor were these people’s neighbors party to any such agreement – either implicit or explicit. Nor was Google a party to this implicit agreement.
Nevertheless, I can hear my wife blaming Google as well as blaming myself. Is she right? As a geek, I scream my objections to her misunderstanding. But when I really consider her argument, she may very well have a point. Yes, these people are ignorantly casting their data out into the air and onto the streets. And I willingly picked up that data. Am I attempting penetration of their networks? Of course I’m not doing that. But I am sifting through the junk they are throwing out.
I’ve come to a simple conclusion: I wasn’t “wardriving” at all. Instead, I was doing the equivalent of electronic dumpster diving. They are leaving important trash un-shredded. And I am rummaging through their ignorance.
Should I stop collecting such small and insignificant packets? After all, I am not doing anything illegal. Nevertheless, I must now carefully consider my wife’s thoughts before I do my next “wardriving” run.
And even more importantly, I must rethink whether or not this activity become illegal/immoral when someone like Google does it. It may be tenable when it is done by a lone and curious geek. But does it become something more “sinister” when it is done by a large and “menacing” corporation? I don’t know. But I’ll have to think about it. What are your thoughts on the matter?
-Roo
