FCC Prohibits Blocking of Personal Wi-Fi Hotspots 129
alphadogg writes: The FCC on Tuesday warned that it will no longer tolerate hotels, convention centers or others intentionally interfering with personal Wi-Fi hotspots. This issue grabbed headlines last fall when Marriott International was fined $600,000 for blocking customer Wi-Fi hotspots, presumably to encourage the guests to pay for pricey Internet access from the hotel.
So (Score:1)
So I guess this means the government will pursue the tech companies who enable this illegal practice as vigorously as torrent sites that enable copyright infringement?
Re: (Score:1)
Re: (Score:1)
What did you just say? The most frequent use of encryption is masking illegal activity? Seriously?
Re: (Score:2)
Don't think so... (Score:2)
Good (Score:4, Insightful)
Re: (Score:3)
There is no obvious coverage for forbidding the sale of devices having a Part 15 radio component; but lacking a software configuration for providing network access to other devices with that device. They might be able to shove it into the conditions of a spectrum auction, and make it binding on the buyer; bu
Re: (Score:2)
This does not preclude occupying the same band in such a manner that the targeted WiFi devices become useless. WISPs have been playing this game with larger operators deploying Canopy or other devices which can be used to effectively jam an entire band. They earned schadenfreude when Ubiquiti WiMax devices did the same ba
Damn! (Score:1)
They outlawed Faraday cages?
Re:Damn! (Score:5, Informative)
Faraday cages don't jam signals. They insulate the inside from the outside.
Re: Damn! (Score:3, Insightful)
It would be legal to build a faridaycage around your hotel.
Illegal is transmitters that jam a band. They would need to be FCC approved. And the FCC isn't approving them.
Re: (Score:1)
The rule does include blocking... "In addition, we reiterate that Federal law prohibits the operation, marketing, or sale of any type of jamming equipment..."
Re: (Score:2)
Jamming equipment actively interferes.
RF shielding just blocks the signal passively.
Re: (Score:2, Informative)
The method is not specified in the rule. It just says blocking and disruption are prohibited.
Re: (Score:2)
It also means no cellular phone reception, if you think people are pissed about not being able to share their data plan instead of paying for hotel WiFi, wait to see what happens when their cell phone will not work and they have to pay root rates for using the phone!
Re: (Score:1)
The person that modded that down does not know the bureaucrat. They could make it that absurd if enough money is at stake.
Re: (Score:3)
Then you would need to charge every plaster who used iron cored mesh when they rendered a house.
And seriously think about what you are saying. If they turned their building into a faraday cage then everything inside the building would still be able to talk to each other. It's not like they are saying "please sir, will you please place your phone inside this copper ball please" and cutting your phone off.
If a hotel turned itself into a faraday cage everyone's mobile phone wouldn't be working either and the
Re: (Score:1)
That's pretty trivial and already occurs.
The convention center effectively gets no signal due to the way it was constructed anyway and so the major brands have repeaters inside the hotel while the minor brand phone's don't work.
DFW Hyatt is a good example of this. If you are not on Verizon- good luck using your phone inside the convention center downstairs.
Re: (Score:2)
They outlawed Faraday cages?
No, the jamming in this case is active, not passive. Passive blocking would have blocked cell phone calls as well (which would put Marriott out of business if they did that, it's not like Marriott is operating zen retreats for its customers). I suppose the wording in the US law could be interpreted to mean that intentional passive blocking isn't allowed either, but this hasn't been tested in court yet. And again, this kind of blocking is not what we're talking about with Marriott International.
Faraday cages
Re: (Score:1)
Well, I'm just saying the rule does distinguish blocking and disrupting. An over zealous bureaucrat can easily run with it until specific methods are stipulated.
Copper foil would be more effective than a mesh full of holes, and it can be made very thin. Aluminum might also work, anything that can run the signal to ground.
Re: (Score:2)
Good decision (Score:1)
The FCC has actually been showing some balls lately, I like it. Keep it up, Wheeler!
Free Pool but no Wifi? (Score:5, Insightful)
You have to have a free pool to get a 5 star rating. Too bad the ratings companies around the world haven't required decent and free Wi-Fi. Major hotel chains would change their offers in a hurry when they are down rated to a 4 star hotel.
Re: (Score:3)
You have to have a free pool to get a 5 star rating. Too bad the ratings companies around the world haven't required decent and free Wi-Fi. Major hotel chains would change their offers in a hurry when they are down rated to a 4 star hotel.
And wait until they start snooping everyones traffic and data mining it... for profit - I mean, reliability monitoring...
On another note, I see you're looking at hotel bookings with another hotel chain at your next destination.........
Re: (Score:2)
This is the part I found interesting about Marriott position. They rationalized jamming foreign WiFi networks based on the security of their customers but why would I trust Marriott's network anymore than any other foreign network?
Re: (Score:2)
free Wi-Fi with a forced 25-30 a day resort fee
Re: (Score:3)
Then they give you free wifi with a paid upgrade.
I stayed at a hotel with free wifi. The "free" part was true, it was free, for 4 devices at 1Mbps each. Yes, 1Mbps.
Oh, they were more than happy to sell you different rate plans - perhaps you want 5Mbps for $20/day? Or perh
Re: (Score:3)
802.11w (Score:2, Redundant)
FCC will not stop a moron staying in one of hotel rooms (or say appartments) sending disconnect packets to everyone around them. The only solution is to secure your network from trivial sabotage and applicable standards are readily available. Why waste time policing the hotel itself when every one of it's guests can do the same thing and worse?
Re: (Score:2)
There is a standard for protecting against these problems now:
http://en.wikipedia.org/wiki/I... [wikipedia.org]
It was never not prohibited (Score:3)
The rules for access to the frequency spectrum used by WiFi require that the device has a mechanism to prevent it interfering with other users of the channel. That is why frequency hopping, spread spectrum and exponential backoff algorithms are all parts of devices permitted to be used in these bands. The devices are not licensed to access the band, they are certified to comply with the rules to access the band.
A device specifically intended to prevent someone else accessing the band is a clear violation of this law. There was no time since WiFi existed that this was remotely legal.
People should be in jail.
Re: It was never not prohibited (Score:1)
Yes, people SHOULD be in jail. It's nice that the FCC is finally standing up to corporations, but the fact is that if I did this behavior myself for whatever purpose I could and very likely would be arrested.
We need to give these corporate creeps equal treatment under the law, right?
Re: (Score:2)
There is no such rule. The things you mentioned are all in place to get around interference caused by other devices, not to prevent interfering. Anyone can legally make a device that uses those frequencies, and there is no requirement at all that they do what you said.
Re: (Score:3)
You're incorrect. [gpo.gov] Part 15 devices are absolutely required to not cause interference. From the link, emphasis mine:
(a) Persons operating intentional or unintentional radiators shall not be deemed to have any vested or recognizable right to continued use of any given frequency by virtue of prior registration or certification of equipment, or, for power line carrier systems, on the basis of prior notification of use pursuant to 90.35(g) of this chapter.
(b) Operation of an intentional, unintentional, or incidental radiator is subject to the conditions that no harmful interference is caused and that interference must be accepted that may be caused by the operation of an authorized radio station, by another intentional or unintentional radiator, by industrial, scientific and medical (ISM) equipment, or by an incidental radiator.
(c) The operator of a radio frequency device shall be required to cease operating the device upon notification by a Commission representative that the device is causing harmful interference. Operation shall not resume until the condition causing the harmful interference has been corrected.
Re: (Score:2)
That does not mean what you think it does. Those are not technical rules, those are rules of operation. And what they mean is this:
If someone complains about your unlicensed device interfering, you have to stop using the device, and you, as the operator of an unlicensed device can not complain.
In other words, you can not interfere with a licensed operator, but you are in no way protected from anyone, licensed or not, interfering with your device.
Other than radiated power, there are no technical restrictio
Re: (Score:3)
I understand Part 15 (as well as Part 97, since I'm licensed under those rules). The mechanisms mentioned in the GP _do_ exist in law for 5GHz U-NII (read WiFi) systems. Please refer to Title 47 Part 15, Subpart E [ecfr.gov], particularly 15.407(h)(1) and (2) and also 15.37(e).
Also, (if I read it correctly) 15.37(h) forbids the marketing or sale of devices that use any digital modulation technique other than Spread Spectrum operating in the 5725-5850 MHz bands starting on June 2, 2016.
The definition of "digital modula
Re: (Score:2)
Well, since you are licensed under those rules you should understand that the purpose of those rules is to not cause interference with weather and military radar systems, and not to prevent interference with other wifi devices. So the point still stands - you can not interfere with licensed services, and nobody cares if you are interfered with.
Re: (Score:2)
Ah, must be slashdot. Complete bullshit gets an 'informative' mod. They are only required to not interefere with LICENSED operations.
You are wrong. See the above comments to understand why.
Re: (Score:2)
Nope. The key to part 15 is that you have no regulatory protection [fcc.gov] from interference with your unlicensed device. That is what the 'must accept interference' statement means.
If you have no regulatory protection, then there is absolutely no requirement that I don't interfere with your device, since such a requirement would be by definition regulatory protection.
If there is no requirement that I don't interefere with your unlicensed device, but there is a requirement that I don't create harmful intereferenc
Re: (Score:2)
That's interference. Targeted, but it sure as hell is interfering.
Incidentally... (Score:5, Interesting)
This seems like the place where somebody who has been dealing with enterprise wireless gear long enough to have observed the change might be found. Did this 'feature' cross over from what was initially a proof of concept by a security researcher? Was it recognized as a possibility before the standards had even been hammered out and was available from day one? Do we know what vendor adopted it first? Were there any who specifically didn't offer it for legal, rather than technical, reasons?
At this point, it is certainly the case that at least some wireless management consoles adopt a very...possessive...tone, detecting 'rogue' APs, despite those APs being no more or less legitimate than any others, in terms of spectrum use, and offering 'containment' or various similarly clinical euphemisms for dealing with them. How, historically, did it come to be that this nasty DoS trick went all legitimate, even as generalized hacker hysteria can get you a stiff dose of CFAA charges for almost anything that involves a CLI and confuses the DA?
I'd love to have my hands on all the versions of various vendors' wireless management and administration packages, to see how this feature evolved over time. I can certainly see its appeal; but I find it hard to believe that nobody had serious doubts about its legality from time to time.
Re: (Score:2)
Re: (Score:3, Informative)
Companies can not be charged for hacking:
- See this company that makes a DoS device.
- See SONY rootkit drm.
- See companies that are poisoning P2P networks.
Re: (Score:1)
Companies cannot, but the chairman and/or board of directors certainly can.
Re: (Score:2)
Re: (Score:2)
Actually, they write and publish something that resembles an apology in some ways (at least in the US). A real apology acknowledges wrong action (deliberate or accidental) and regret for the action. The usual corporate version of an apology says the corp had good reason to do what it did, and is sorry that anybody had a problem with it.
Re: (Score:1)
Most of the systems don't do TCP-reset style attacks to disrupt service, they do hundreds or thousands of MAC level connects to the device overwhelming them. Most of these devices cannot actively talk to more than a handful of people, so it's trivial to swamp them. Still evil, but the attack is different than you imagine...
Re:Incidentally... (Score:4, Insightful)
If I used a stupid protocol trick to jam your tv signal, but without radio jamming, it would be no less a violation of the law.
Re: (Score:2)
All sorts of crimes can be committed by means of a speech act(indeed, many crimes are hard to commit without some means of communicating, fraud, extortion, ransoming hostages, etc.); but that doesn't give them constitutional protection, any more than the argument that your god demands blood sacrifice would provide protection against murder charges.
This i
Re: (Score:2)
In private buildings that don't offer guest services or otherwise accommodate outsiders, you can certainly disconnect anything you don't approve of from the wired LAN, and ask anyone operating a hotspot to leave or be removed for trespassing; but the notio
Of course. (Score:1)
If I jammed the hotels WiFi (Score:3, Interesting)
If I jammed the hotels WiFi it'd be a criminal (more likely 'terrorist') attack. Should I be surprised there isn't a criminal investigation into hotels doing this to it's own customers?
They got off lite (Score:2)
So what is an answer? (Score:2)
Every now and then I encounter a hotel with only wired access provided in rooms. (Often they have wifi in public areas.) Is there an answer to using the wifi-only device in such a circumstance. For sake of argument, let's assume I am an international traveller whose cellphone never works in the countries I visit. (True) That means the hotspot method mentioned will not work.
Re: (Score:1)
For weight and space reasons I travel with only my wifi-only tablet. Generally that works well for me.
Every now and then I encounter a hotel with only wired access provided in rooms. (Often they have wifi in public areas.) Is there an answer to using the wifi-only device in such a circumstance. For sake of argument, let's assume I am an international traveller whose cellphone never works in the countries I visit. (True) That means the hotspot method mentioned will not work.
There are numerous mobile wifi router/bridges which can plug into a wired network and make ot available over wifi, either as a bridged or routed connection. At home they can also be used as a wifi range extender.
For example
http://www.tp-link.com/en/prod... [tp-link.com]
Re: (Score:2)
Re: (Score:2)
A WiFi to wired ethernet bridge will solve this handily. Ubiquiti devices can be configured this way.
Re: (Score:2)
Note that you would not be able to charge the tablet at the same time.
Sure you can, just use an OTG Y-Cable.
Right Culprit, wrong motive (Score:2)
Re: (Score:2)
Think of how well that would work out.
Someone... (Score:2)
Obviously didn't write Tom Wheeler a big enough check.
What about if the customer is giving theirs away? (Score:2)
My only question is what if the hotel is giving free wi-fi to guests, and then those guests are re-offering that bandwidth freely for people who didn't pay? That doesn't seem fair either, sort of like a fast food restaurant offering free refills, and then some asshole continuously refilling his large beverage to pour into other people's cups so they don't buy drinks at all.
I don't know if there's a tech that could tell when packets are coming from X machine, or coming form sources 'beyond' that machine, bu
Re: (Score:2)
Also imagine what would happen if someone were also giving away their free electricity! Or water from the expensive to construct indoor plumbing!
And about that jerk who refills other people's cups with a beverage! Horrors! I'm sure that next to nothing cost colored sugar water is going to break the hotel -- because the hotel charges an artificially high price for it!
Does it really matter? Some people will always be pricks. But not most people.
Re: (Score:2)
Well, we know which asshole would be standing there pouring drinks now, don't we?
Seriously, if a business gives you unlimited (something), you wouldn't feel the teensiest bit guilty then giving it away, costing them possible business?
Pretty clearly an incentive for business to never give people like you things like free refills. Congrats - you live in Europe.
Re: (Score:2)
Re: (Score:2)
(shurg) it's a matter of definition.
Here in the US, free wifi is pretty much as common as free refills. If you're GIVING away wifi - even to non guests - it seems stupid to argue over it.
OTOH, in Europe, it seems that every bloody hotel and airport feels that you should pay $10 / day or somesuch for the ability to get on the internet. To me, that's gouging. Rather than cheat the hotel, I simply don't use them, and share as broadly as possible that X hotel charges for internet.
Re: (Score:2)
I don't know if there's a tech that could tell when packets are coming from X machine, or coming form sources 'beyond' that machine, but to me it would be legit if a hotel *could* prevent such usage. Otherwise you have a freeloader issue.
What one ISP I used once did, to prevent people with routers and networks from getting out, was to filter by TTL. Windows has a default TTL of 64. Any TTL below that was "beyond" a router. Of course, then everybody with an ounce of Google either had an iptables rule in their router to increase the TTL by one in mangle/POSTROUTING or, if the router was an off the shelf one, just tell each machine on the LAN to have a TTL of 65. The people not versed in Google-fu didn't have routers either, so everybody was b
Why this is a money grab by hotels (Score:3)
It's a money grab.
Oh, but the hotels argue: it costs money to build and operate a WiFi network!
I would point out that those hotels do not charge an extra fee for other things that have a substantial cost to build and substantial operating cost:
Why aren't the hotels charging fees for those other things that have a substantial cost to build and operate?
Wake up dinosaurs, it's the 21st century.
Re:frist post (Score:5, Funny)
Re: (Score:2)
well, stop using my channels. I'm using channels 1-16 to stream 4k video from my computer to the TV next to it.
Re: I am mad if I cant unplug my employee hotspots (Score:5, Insightful)
Private hotspots aren't on your network.
Re: I am mad if I cant unplug my employee hotspots (Score:5, Interesting)
Just like modems on laptops or in the server room are not a security risk?
The problem is that people can, and do, connect the same device simultaneously to the hotspot or the modem and to the internal network. And then they port forward. I've certainly caught people doing this, especially among non-technical staff who try out "this cool thing they read about". I'm afraid it's often even worse among software architects who use passphrase free SSL or SSH keys "to save time", who lock their passwords to never expire, and who are very careful never to explain what they're doing to anyone else.
I've encountered far too many cases of such setups used for business critical services, unknown to anyone else, that collapse during network cleanup efforts or when the employee finally moves on.
Re: I am mad if I cant unplug my employee hotspots (Score:5, Informative)
If the employees are turning on their personal hotspots and using that, you don't have a security problem. If they are both connecting to the hotspot and to your network, you can stop this by booting them off your network. What you can't do, though, is put a hotspot jamming device in place to knock out all personal hotspots.
Re: I am mad if I cant unplug my employee hotspots (Score:5, Interesting)
> If the employees are turning on their personal hotspots and using that, you don't have a security problem.
If they connect anything that lives inside your network, at any time, or that even has a VPN connection your internal networks at any time, you have a security problem. It may be one you choose to accept as a matter of policy, but the risk is very real. Worse. Most admins simply do not have the tools are buy-in to review and monitor systems for gateways, remote console access, or network tunnels that may expose your internal network through precisely such a hotspot or modem access.
I agree that by current regulation you may not run a hotspot jammer. The FCC regulations are quite clear about this, partly because they block other cellular communications and services such as telephones and GPS. But I'm afraid I disagreee vehemently with you that their use does not constitute "a security problem".
Re: (Score:2)
If the hotspot is connected to your internal network then you absolutely have an issue. If it is just a hotspot, ala your mobile phone then there is no security risk as there is no connection to your network
If that vector exists though for the hotspot to be connected to your network you by default have to treat the network as compromised and hostile. So if you are in an office, or a hotel or any other large physical scale environment you have to treat the wider network as if it is compromised already beca
Re: (Score:2)
If they connect anything that lives inside your network, at any time, or that even has a VPN connection your internal networks at any time, you have a security problem.
If they can physically do that, then you have a problem. I hear even Windows comes with IPSEC, maybe you could do something about that.
Re: (Score:2)
True. As much as people like knocking PHB's and management in general, there are some problems where a technological solution isn't appropriate and a management solution is.
Don't allow untrusted devices on a trusted network (Score:1)
The problem is that people can, and do, connect the same device simultaneously to the hotspot or the modem and to the internal network.
You should be screaming at your network security team for allowing an untrusted device to connect to your internal network. My god, I bet you even allow devices with no antivirus running.
My Fortune 500 company only allows devices to connect to the internal network if they are running a (commercial) software which detects when a network interface is enabled and immediately disables whichever other network interface had been in-use. On *our* network, people CANNOT connect the same device simultaneously to ou
Re: (Score:3)
Re: (Score:2)
Re:I am mad if I cant unplug my employee hotspots (Score:5, Informative)
If they won't let me unplug my employees private hotspots on my network, I will be mad.
You can unplug them. You just can't actively jam them.
Re: (Score:2)
I'm sorry what? I could be falling for the biggest WHOOSH of all time here but I've re-read your post a few times.
Are you talking about your employees setting up a hotspot and bridging into your wired network? If that is the case you would be fully within your rights to unplug them from your wired network.
That said if that is even a possible vector into your network (I can only assume you don't control their hardware) then you need to treat that network as hostile anyway and the servers should not be dire
This is a much bigger problem than you might think (Score:4, Informative)
I worked NetSec for a global casino/resort company. At nearly every site a few times a month I would send local IT to go find wifi routers plugged into our network. Employees would bring in cheap routers because we didn't allow wifi other than the guest network which was strictly for corporate visitors (ie. sales reps, etc) and they wanted to use their personal devices for whatever. This happened even at corporate, where I sat.
Re: (Score:3)
I'm still not understanding how your setup allowed them to function. Assuming you are talking about them plugging a router into an active port in a room, how are their devices resolving anything other than your hotels generic hotel login screen. That there should have immediately stopped them as they would have had to authenticate through your portal and you would have had a log of it. Simple case of warning then dismissal.
If it's not a port for guests to access the internet from in their rooms why the h
Re: This is a much bigger problem than you might t (Score:4, Insightful)
1. Your stupid policy of no wifi created the behaviour.
2. Authenticate physical connections to your corporate LAN. This function has been built into most non welfare switches for at least 15 years
Re: (Score:2)
The problem is not a wifi policy (Score:2)
The problem was the employees wanting to put their personal devices on the corporate network to surf the web. The corporate wireless network is there strictly for corporate issued machines (laptops and the occasional blackberry), not for Joe Blow's laptop, iPhone, or Galaxy. Employees were unwilling to accept that there's no good reason for their personal crap being attached to the network.
I didn't design the network, I was part of a team brought in specifically to secure it where prior to us there wasn't m
Re: (Score:2)
The problem was the employees wanting to put their personal devices on the corporate network to surf the web.
You never explained why exactly this was a problem. Their devices couldn't possibly be a security risk if your internal servers and networks were set up properly.
Employees were unwilling to accept that there's no good reason for their personal crap being attached to the network.
Maybe they weren't willing to accept that because it's not really true and you are just stating it like a fact. There's lots of good reasons employees would benefit from guest network/internet access: Wi-Fi calling, not getting any cell signal at all in buildings like Casinos and some resorts, better battery life on their devices, not needing to us
Re: (Score:3)
Re: (Score:2)
Or, for even less complexity, limit the number of MAC addresses per port to 1. No need for central MAC database that way.
Re: (Score:2)
Re: (Score:2)
You're correct, but my point is that many people don't deploy 802.1x because it seems so complex and expensive.
port-security to 1 mac gives most of the benefits of 802.1x for no cost and very easy deployment.
Re: (Score:2)
Re: (Score:2)
As I said, very easy to circumvent
If your point is to stop employees from plugging in an access point they bought at Best Buy, this is quite effective.
If your point is actual security against a criminal, 802.1x with certificates is the only way to go.
Point is, at least stopping 1/2 of the problems is better than stopping none of them. Right or wrong, 802.1x security is seen as too complicated for most IT departments.
Re: (Score:2)
Re: (Score:1)
Sounds like you need to set up a wifi network for your empoyees.
Re: (Score:1)
Haha! Nice. And nice raincoat, but might I suggest a more attractive model to show it off :P
Re: (Score:3)
So finally, the government does something for the consumer rather than the biggest corporate monopoly, and there's all this butthurt? You people are slaughtering that gift horse and serving up chevalineburgers to the hungry multitudes.
Re: (Score:2)
If your employees are using "your" network to get on the internet via WiFi, for personal crap like facebook, slashdot, personal Email, facebook ect, they should be connecting to the WiFi host located in the DMZ; connecting to a WiFi inside the private firewall is just crazy!
Re: (Score:2)