Hacker News Reader

Comment by kens | Hacker News Reader

What I find interesting is this isn't jamming of the radio signal, but protocol-level interference by sending deauthentication packets. I find it a little concerning that the law is interpreted this way since it could give the FCC a very broad jurisdiction.

More on the law: http://www.fcc.gov/jammers

More on deauthentication packet jamming: http://hackaday.com/2011/10/04/wifi-jamming-via-deauthentica...

View on HN

If you look on the back of your wifi gear, you'll likely see a stamp that says something to the effect of:

"This device complies with FCC part 15 and will not cause harmful interference".

The argument could be made that by using the device to send lots of deauth packets, that Marriott had modified the device beyond it's original scope, and was now using it to cause harmful interference (to other wifi devices).

The FCC is responsible for allocating what can be broadcast on any given frequency. It is well within their jurisdiction to say that such broadcasts must comply with standard protocol X plus additional restrictions.

There really isn't a slippery slope argument to be made.. they already have that power.

If they determine you are deliberately interfering with lawful use of the airwaves, it doesn't matter how you are doing it.

It's still a broadcast designed to create interference.

This is really interesting - the college I went to used this kind of technology to prevent students from spinning up rogue hotspots. In fact, it is a pretty common practice. Anyone know if this law extends to that use case or if Marriot was doing something different?

No - that is blatantly illegal.

This is a Cisco technology: http://www.cisco.com/c/en/us/support/docs/wireless-mobility/...

Something tells me there is more to this story.

That seems to cut off APs connected to a wired Cisco network - that's perfectly legal, you can terminate any device you want from your network.

> Once a rogue client is detected on the wired network, the network administrator is able to contain both the rogue AP and the rogue clients. This can be achieved because 802.11 de-authentication packets are sent to clients that are associated to rogue APs so that the threat that such a hole creates is mitigated.

Looks like the Cisco AP sends these deauthentication packets over wireless, it doesn't cut off the rogue AP from the network by filtering it or disabling a switch port. The rogue AP is certainly bridged to your network, but is the association between the clients and the rogue AP part of your network?

That doesn't look good. It is mentioned near the start about potential issues:

> rogue containment usually introduces legal issues that can put the infrastructure provider in an uncomfortable position if left to operate automatically.

The FCC also says selling these things is illegal:

> Federal law prohibits the operation, marketing, or sale of any type of jamming equipment

There might be a legal workaround in the case of unauthorized devices, as I doubt Cisco's legal team would allow such a feature if there was not something to base it off of. It is concerning though...

Your college is mitigating what it considers an abuse of its network.

Mariott is, in effect, preventing people from using the cellular service they pay (a carrier) for. Except, instead of attacking the cellular part, they're attacking the WiFi part. But, in effect, it's very close to jamming cell phone calls.

That is pretty damning. Blocking wifi signal is one thing, fraudulantly deauthing is like... fuck these people.

If you or I got caught doing it to their systems, we'd probably go to jail. But when they do it to us, they get fined a few days' profits. Lovely double standard.

You're accusing them of a double standard based on the supposition that they would have a double standard?

Based on a long history of putting people in jail for similar offenses.

You can't put a corporation in jail.

First of all, why not? If a corporation does something that would be worthy of prison in an individual, shut them down for a period of time as punishment.

Second, even if you accept that, you could at least fine them an amount that will cause harm, rather than an amount they'll barely notice.

Let's say a Mariott bus driver was caught racing down the freeway at 100mph in a company vehicle. Do you also wish to shut down Marriott, Inc for this offense? This is actually putting _lives_ at risk. Much more jailworthy than some mid-level manager's decision to violate some FCC rules, right?

If the corporation itself is not responsible, then the individual should be punished. If the corporation is somehow responsible (for example, they have a long history of systematic and deliberate violations with supporting policy), the corporation should be punished.

Here, neither is happening. The individuals responsible are, as far as I can tell, being completely let off the hook, while the company gets a completely trivial fine.

Why do you think that $600k is not commensurate with the offense? It may be a significant part of that business unit's income. It may be 10X the amount of revenue they obtained by breaking this particular law. It may have resulted in some people getting fired - possibly people who didn't even realize they were doing something illegal. Hell, there are at least a half-dozen switches I could flip in DD-WRT that will violate FCC rules and I have no idea which ones are which.

I don't know this, nor do you. The people that do know this are the prosecutors in this case, and they considered that $600k (and the rest of the consent decree) was punishment that fit the crime. Unless you have some special knowledge of this particular case, I don't see why you are in a position to second guess them.

There's a long history of wrist-slaps for huge corporate crimes. Two recent examples are BP and Bank of America, both hailed as massive, unprecedented fines for massive crimes, both of which barely hurt either company.

Proportionally, my cost for merely retaining a lawyer would affect me more than a $600,000 fine affects Marriott. Never mind the fact that I would probably go to jail and lose out on months or years of salary, not to mention freedom.

There's an odd disconnect between people who on one hand say "corporations are not people!" and then on the other hand anthropomorphize them as if they were a child who needs to be spanked. You can't compare the punishment of a corporation with the punishment of a human, because corporations are not people. They don't have minds, they don't "feel bad" for what they have done, they can't sit in jail and regret their decisions. The best we can do discourage unwanted behavior in the future.

Will this particular remedy be effective at preventing the behavior in the future, both from Marriott and other corporations? The prosecutors seem to think so, you think to seem not. You've given me no reason to trust your judgement more than theirs.

Well, you've given me no reason to trust their judgment more than my own, so unless you're making a "trust the authorities, they are Your Friend" argument, I don't really see the point of repeating that.

That sounds like a bug, not a feature.

Except the corporation didn't do anything. And actual, living breathing human made a deliberate and criminal choice. And that dude belongs in jail.

Or rather,"those dudes". A good prosecutor would start at the bottom and work his way up the chain of command, not stopping until he reached the highest level person who was aware of this without immediately moving to shut it down. Then he'd throw the book at they guy.

Conference organization is a small world. Word would get out fast, and that really would be the end of it.

How would you block wifi then? Sending deauth frames is the only way to contain a rogue AP without physical access. Generally these systems are used to enforce corporate network security policies by making sure Joe in accounting can't breach your top-secret network by plugging in a $25 wifi router so he can use his iPad on the office network.

I'm not sure what the legal standing is once you get to publicly accessible spaces like colleges, stadiums, conference centers, etc.

This is a specious argument. The company is free to enact policies prohibiting the use of their own network in an unauthorized manner and enforce it in a legal way ( instituting the penalty of immediate firing usually works well). They don't have the right to jam public airwaves to enforce these rules.

Fascinating... wouldn't this be illegal? It falls into laws regarding hacking and network disruption. They're joining another network, and interfering with its activity.

If the reverse was happening, say a hacker was going through and deauthentication jamming THEIR network you can bet they would call the FBI.

In my mind impersonation/forgery is worse than jamming.

The FCC governs communications, not just radio waves. We just happen to be most familiar with them in the context of radio.

Reply on news.ycombinator.com