Interpreting packet sniffing with Kismet/Wireshark programs and their legality under U.S Title III "pen-trap statue" law

Introduction

Note: Because there are MANY different scenario's that involve packet sniffing and because they need to be evaluated on a case by case basis in various countries, I highly RECOMMEND you seek legal counsel specializing in Intellectual Property law or "I.T" law in THOSE respective countries if you need to better understand the legality of such issues OUTSIDE of the U.S. If you ARE legal counsel in the U.S and want me to make technical corrections or add more case scenario's for U.S readers, DO NOT hesitate to contact me. I understand U.S law is not static and open to interpretation. Thank You!

In this week entry, I will be analyzing the varying degree of circumstances, in which packet sniffing with Kismet/Wireshark computer programs maybe consider "legal" and "illegal", given two real life, real world scenario's. I noticed that this question comes up quite frequently between "hackers" and law/policy analysts. This was the case at "Defcon" this past year, where individuals with both titles were looking for more efficient legal ways of securing mobile and wired networks and how lengthy legal battles could "potentially" be avoided.

The Google Wi-Fi packet sniffing case from 2011

The question that was posed in a similar case, back in 2011 [1], was whether or not Google was within their right to sniff out unencrypted 802.11 traffic off of Wi-fi networks with Kismet using Street View, even if they were collecting data "unintentionally"? the answer in the first scenario is not so simple!. I am going to look at both sides of the argument and then attempt to have you the reader draw your own conclusions, about packet sniffing and whether or not it's legal to sniff out traffic that's not unencrypted either "intentionally" or "accidentally" over a network. In order to be brutally honest most users should know that "black hat hacking" meaning, unless you are a "pen-tester" is considered illegal in the U.S, you can be prosecuted under Computer Fraud and Abuse Act [2]. It's that simple.

First real life example

A real life example rather then a fictional scenario that usually comes up would be "wardriving", which is accessing your neighbors wi-fi networks with the intent of intentionally trying to break into them. Looking at in one perspective, technically it's fair game if they have an open network that was not encrypted using a pre-shared key over WPA or WPA2 with Rijndael using (AES-128) and you should be able to use their network freely, it would be their own fault IF they failed to secure their own network. Most courts are split over whether or not you have the right and ability to access data on unencrypted wireless networks or whether or not it's considered a form of "wiretapping" under U.S federal Title III "pen-trap statue" law, known as the Federal Wiretap Act. A majority of them most of the time will say that Wi-fi "hacking" on the other hand is federal offense though and you can do time under Computer Fraud and Abuse Act [2], if you were accessing the network with malicious intent. It was my personal believe that with the Google case Google should have not be liable for data collected on unencrypted Wi-Fi networks, IF most users failed to properly secure their own networks and the case could have been dismissed, regardless of the intent under U.S law. European law on the other hand is ENTIRELY different and European data privacy laws, are much STRICTER then they are in U.S. There is the possibility that Google could continue to be fined from the fallout from this case for years to come! Google (even as of 2019) was fined from fallout from Street View in both U.S and Europe for "unintentionally" collecting traffic off wireless networks several years ago.

Second real life example

Another real life example, would be if a company was monitoring traffic over their own LAN sniffing out unencrypted data with Wireshark? would this be considered "legal"? It would be considered "legal" if within their privacy policy, under which everyone in the workplace was forced to sign stating that the network was subject to random audits and that any objectionable material was subject to warnings or termination, if the network logs turned up "objectionable" or "questionable" material. On the flipside, it would be considered a violation of the workers fourth amendment rights (an "illegal search and seizure") and would more then likely be considered "wiretapping", if the company failed to properly say that within their privacy policy, that the network was subject to random audits all of sudden and that they would be logged indefinitely using vague written language in the existing policy. A computer use policy legally always has a higher value and can "quash" or limit any users fourth amendment right in context and is the case in most legal scenario's that frequently come up in the U.S with respect to work place privacy in the private sector (a 'fourth amendment' legal article search on Google Scholar or the LexisNexis, will turn up several cases where this has happened in the past). Akin to that, O'Connor vs. Ortega (1987) dictates workplace privacy in the public sector.

Conclusion

The answer is simple, in my opinion. Most network traffic should be encrypted in order to protect the end users privacy and to ensure the administrator is not abusing their power to monitor the network properly. Period! this would solve many cases and leave everyone in good legal standing. What are your thoughts? In what scenario does or does this not work? Leave me comments or questions if you would like to see more scenarios, where this does and does not work. Have a nice weekend and take care! ;-D.

References:

1.Ars Technica. "Judge to Google: Even open wi-fi networks maybe wiretapping" http://www.arstechnica.com/tech-policy/2011/06/judge-tells-google-sniffing-even-open-wifi-networks-may-be-wiretapping.ars accessed 09 Nov 2012. 2011
2. Panix. "The Computer Fraud and Abuse Act (18 USC 1030)" http://www.panix.com/~eck./computer-fraud-act.html accessed 09 Nov 2012. 1998