$718K penalty against M.C. Dean for blocking Wi-Fi devices (2015)

I have not had much success implementing 802.11w. Either the wireless manufacturer or the client device implementation tends to be buggy. My most recent case is between Extreme Network 802.11ac APs and any MacBook Pro.

It's left me scratching my head as to why a protection mechanism such as this isn't mandatory by now. Because mandating aspects of the protocol seems to be the only sure way of easing compatibility woes.

Totally agree.

This kind of attack is really easy to make just by setting up a wireless network with the ssid you want to block and starting wireless containment countermeasures for rogue ap detection.

While I'm not a lawyer so I can't speak for how the law looks like, there is a clear difference in intent. The many users wifi interfering with eachother is not by intent, the de-auth packets is nothing but intent to interfere.

I don't think the issue is with multiple parties using same unlicensed spectrum; it is more that they deliberately jam this common spectrum so that nobody can use it.

This could be similar to some type of wifi blackmail. I could rent an apartment in expensive complex and setup a wifi jammer. then approach tenants that i can turn it off for X amount per month.

using != jamming

As a couple other people have pointed out, intent matters as well.

Over in the ham space if you know you're causing interference you're required to back off, regardless of who was there first(excluding some emergency situations).

It sounds like that line is discussing what happens when two (or too many) WiFi users congest a network, not one entity going around intentionally disrupting the communications of other devices.

It's the difference between not being able to talk to someone because you're in a crowd and not being able to talk to them because someone is standing behind you screaming into your ear.

That said, I guess you'd have to see what those specific repeated rulings were and for example whether they were two neighbors bickering over a network or convention centers blocking all WiFi except their own.

Intent.

Why isn't this just mens rea?

If I use WIFI as it's intended there's no mens rea. If I misuse WIFI to block your access there is mens rea.

I think intent matters a bit more than the outcome in this case.

I know it's not that simple, but having adding a "private" channel to the spectrum that can be leased over an area and isn't accessible on non-specialist hardware that could be used by, say, an even organiser to provide low-interference wifi would be a solution to this. Much like the radio waves.

The FCC isn't saying you can't use active measures to prevent a rogue AP from attacking users who intend to communicate with you. That's why they asked MC Dean to explain exactly how their interference helped secure its own network.

What they're saying is that you can't actively interfere with parties who want to use unlicensed spectrum to communicate with each other, even if they are physically on your property, and the fact that you must share bandwidth with them is not a valid excuse to do so.

Imagine if this were allowed. Would you accept it if someone else did the same to you, for instance a hotel guest would deauthenticate your use of your SSID?

Since no one owns the frequencies no one owns the SSIDs and there is no way to specify who is the legitimate user and who is the adversary. The only solution is if any one party just does not interfere in the business of the other.

Yes, it is generally understood that the FCC rulings on WiFi jamming continue to permit WIPS/WIDS systems that actively mitigate rogue APs that appear to pose a security threat, and broadcasting your SSID without authorization would be a good example of this.

There was quite a bit of talk about this in the WIPS industry after these fines, and while I don't think the FCC has really made a clear clarification on the issue, the vendors have all put out statements that are similar variations on "it's okay for matching SSIDs" and I don't think there has been any contest to this. Vendors do recommend that you be careful that active mitigation will not impact APs operating off your property, implicitly even if they are broadcasting your SSID.

In general I think the FCC is taking an intent approach to this, from the security side - their rulings on WiFi jamming cases have generally specifically mentioned the lack of a reasonable security justification.

As others have said, the hotel doesn't have any authority over the spectrum itself so it can't impose any rules on it.

Take the ham operator scenario: One operator can't broadcast a continuous whistle so that nobody else can talk. It's impossible for an operator to obtain consent to do this. A hotel acting as an operator can't do it even if they got permission from every guest because the guests don't have any authority to grant it. It's simply prohibited for any operator to behave that way, full stop.

There are a couple of things a hotel could do though:

1) Kick anyone using wifi in a way they don't like off the property.

2) Encase the exhibition area in a giant Faraday cage so that nobody's cell phone works. Their APs are the only ones with internet access so no point for anyone else to turn one on.

I don't think either option would end well for any business that tried it. The reason they like the deauth method is because they can lock out competitors without the non-technical public realizing what's going on.

It's because the WiFi frequency bands are publicly owned. They don't have the legal authority to ask for consent to deauth because they don't own the channels in the first place. Intentional interference can get in the way of municipal internet access, it can cause safety problems (some channels in some bands are reserved for safety equipment), and of course it can be anti-competitive. Private entities are only being allowed to use WiFi bands in the first place under condition that they will not intentionally interfere with other devices.

Because it's a criminal offense. The illegal act is sending signals which willfully interfere with communications.

Also, the FCC determined that those clowns were jamming the Wi-Fi of buses passing the convention center.

The FCC legally regulates use of the electromagnetic spectrum. For example, FCC conformance for EMI in electronic devices is not some optional stamp of approval for the benefit of discerning consumers. It's a legal requirement.

If I sign a contract saying you can kill me and you do, it's still murder.

Contracts cannot override the law.

A member of the public has no capability to immunise another from a criminal activity.

While the hotel owns the property (land) it does not own the spectrum. Spectrum is a limited resource that government manages for the public good. The hotel cannot interfere with my lawful use of spectrum, even if I am lawfully on their property.

We did a trade show in Minneapolis' convention center a few years back and had the same issue. We were charged ~$1200 for a few days of Wifi access from SmartCity. Even though we paid for them to allow us to use our Wifi AP (Cisco enterprise AP, not some consumer gear bought at BestBuy) we still had to beg and plead with their on-site network engineers to get them to stop issuing de-auths on all our traffic. Then again, you have to pay hundreds of dollars to have a trash can in your booth as well. These venue are such a racket it's ridiculous.

Sounds typical for what I have seen at Tradeshows.

Every enterprise wireless vendor has this ability. Further there are definitely legal ways to use this, if not in the US then certainly elsewhere.

Contractors, especially licensed ones are usually liable for their work. So too is Marriot, for asking them in the first place, but they settled:

> Marriott agreed to settle the investigation by paying a civil penalty of $600,000 and establishing operating procedures to ensure that it does not engage in further Wi-Fi blocking

Presumably MC Dean did not.

> On October 23, 2014, the Commission received an informal complaint from a company that provides private Wi-Fi networks for exhibitors at trade shows by shipping equipment to customers around the country. The complainant stated in part that it had "just spent all morning arguing with M.C. Dean company who provides wireless [at the BCC] until they finally ceased sending de-auth signals to our router."

They were actively harming/disrupting others' equipment. It wasn't just "oh, your signal sucks, use ours!" but "we're going to knock you offline unless you pay."

Disclosure: I used to work for MC Dean 10+ years ago.

It is illegal. Ignorance of the law is no excuse. It's not much different than hiring someone to hack, rob or murder someone. We don't throw just the person doing the hiring in prison, we also pursue the person who performed the act.

Believing that a company is not liable for an illegal act they are hired for shows just how far the rabbit hole modern society has gone with respect to business ethics.

It is if you use it to maliciously interfere with someone else's network.

aircrack-ng itself doesn't send anything, so it wouldn't be affected by this. Its sister tool aireplay-ng however can be used for exactly this kind of attack, and that is illegal.

Nothing has changed though, those laws have been in place since soon after the invention of radio.

It always has been

As I understand it, ownership of a space does not confer ownership of the radio spectrum, even within the confines of the space. They don't have the authority to regulate radio signals at all.

I think this is the exception that swallows the rule.

Let's say I observe two ham radio operators having a morse code communication. I decide to stop them from communicating, so I transmit "<callsign 1> QRT DE <callsign 2>", where callsign 1 and callsign 2 are the callsigns of the two ham radio operators.

Is this harmful interference, or did one of the ham radio operators just misinterpret my signal?

> It is the router and/or the client that have picket up these signals and misinterpreted them

From what I understand of this attack, the signals are not being misinterpreted. The client receives a packet which basically says "I'm the AP and want you to disconnect", so the client correctly does what the packet asks it to. The packet, however, was spoofed; who send it was not the AP, but someone else.

The solution to this particular attack, as someone else mentioned, is 802.11w, which authenticates these control packets so they can't be spoofed. Unfortunately, it's still uncommon.

It's pretty straightforward: sending fake deauth packets “seriously degrades, obstructs or repeatedly interrupts a radio communications service”.

Why is electromagnetic spectrum special? A convention center couldn't put poison in their air, couldn't stab people, couldn't libel anyone, couldn't cook meth, and couldn't produce patented pharmaceuticals in their own private property either.

You may own the property, but you don't own the electromagnetic spectrum. The spectrum is a limited resource. It is managed by the government for the public good.

Some spectrum is licensed. Some is for public use, such as WiFi, Bluetooth, baby monitors, and many other uses.

How would you like it if someone else on their own private property interfered with your use of WiFi on your property by sending you deauth packets?

I pay AT&T for my phone, including the use of it as a hotspot. AT&T paid handsomely to license the spectrum it uses to provide service to my phone. I'm sure they would not be happy if I am unable to use that service because I am maliciously blocked by someone interfering with my lawful use of WiFi spectrum on my own lawful hotspot, regardless of what property I am lawfully on, such as a hotel.

Check the notice. They were also blocking APs in cars and busses driving outside the convention center.

But you can! You just have to license a portion of that spectrum for yourself. Leave the public spectrum alone.

> unless of course there is leakage of that radiation affecting someone else outside of your private property.

There always is. Radio waves don't respect walls (unless they're made of metal). If you look at the linked document, it shows strong indications that the attacks did affect wifi networks from vehicles passing by, that is, fully outside of the property.

It sounds more like they are saying "Yes, this is bad, but technically not illegal under our laws". Sounds more like they are doing their job rather than being emotional about it.

Why do you think it's mental gymnastics?

Does this make it less interesting to you? [edit: didn't it was convention to mark non-current years in titles]