Legality of piggybacking

Laws regarding "unauthorized access of a computer network" exist in many locales, including the U.S. federal government, all 50 U.S. states, and other countries, though the wording and meaning differ from one to the next. However, the interpretation of terms like "access" and "authorization" is not clear, and there is no general agreement on whether piggybacking (intentional access of an open Wi-Fi network without harmful intent) falls under this classification. Some jurisdictions prohibit it, some permit it, and others are not well-defined.

For example, a common but untested argument is that the 802.11 and DHCP protocols operate on behalf of the owner, implicitly authorizing use of the network. (This would not apply if the user has other reason to know that their use is unauthorized, such as a verbal or written notice.)

In addition to laws against unauthorized access on the user side, there are the issues of breach of contract with the Internet service provider on the network owner's side. Many terms of service prohibit bandwidth sharing with others, though others allow it. The Electronic Frontier Foundation maintains a list of ISPs that allow sharing of the Wi-Fi signal.

Australia

Under Australian Law, "unauthorised access, modification or impairment" of data held in a computer system is a federal offence under the Cybercrime Act 2001.[1] The act refers specifically to data as opposed to network resources (connection).

In the state of Western Australia it could be construed as "Unlawful operation of a computer system". The use of bandwidth or other resources could also be construed as theft if it involves deception then fraud.

Canada

In Canadian law, unauthorized access is addressed by Section 342.1 of the Criminal Code of Canada. According to Section 342.1, "Every one who, fraudulently and without colour of right" obtains "computer services" from an access point is subject to criminal charges. (See Criminal Code of Canada, RSC 1985, c. C-46, s. 342.1 (1) (a))

In Toronto, a man was arrested with a WiFi-enabled laptop in his car, partially undressed. He was tapping into unprotected wireless networks to download child pornography. Ultimately, however, he was charged not for piggybacking, but for the pornography instead.

Hong Kong

Under HK Laws. Chapter 200 Crimes Ordinance Section 161 Access to computer with criminal or dishonest intent:

(1) Any person who obtains access to a computer-

(c) with a view to dishonest gain for himself or another; or

(d) with a dishonest intent to cause loss to another,

whether on the same occasion as he obtains such access or on any future occasion, commits an offence and is liable on conviction upon indictment to imprisonment for 5 years.

Singapore

In November 2006, a 17-year-old man, Garyl Tan Jia Luo, was arrested for tapping into his neighbour's wireless Internet connection. He faced up to three years' imprisonment and a fine under the Computer Misuse Act. On 19 December, Tan pleaded guilty to the charge, and on 16 January 2007 he became the first person in Singapore to be convicted of the offense. He was sentenced by the Community Court to 18 months' probation, half of which was to be served at a boys' home. For the remaining nine months, he had to stay indoors from 10:00 pm to 6:00 am. He was also sentenced to 80 hours of community service and banned from using the Internet for 18 months; his parents risked forfeiting a S$5,000 bond if he failed to abide by the ban. Tan was also given the option of enlisting early for National Service. If he did so, he would not have to serve whatever remained of his sentence.

On 4 January 2007, Lin Zhenghuang was charged for using his neighbour's unsecured wireless network to post a bomb hoax on-line. In July 2005, Lin had posted a message entitled "Breaking News – Toa Payoh Hit by Bomb Attacks" on an on-line forum managed by HardwareZone. Alarmed by the message, a forum user reported it to the authorities through the Government of Singapore's eCitizen website. Lin faced an additional 60 charges for using his notebook computer to illegally access the wireless networks of nine people in his neighborhood repeatedly. Lin pleaded guilty to one charge under the Telecommunications Act and another nine under the Computer Misuse Act on 31 January. He apologised for his actions, claiming he had acted out of "stupidness" and not due to any "malicious or evil intent". On 7 February he was sentenced by District Judge Francis Tseng to three months' jail and a S$4,000 fine. The judge also set sentencing guidelines for future 'mooching' cases, stating that offenders would be liable to fines and not to imprisonment unless offences were "committed in order to facilitate the commission of or to avoid detection for some more serious offence", as it was in Lin's case.

United Kingdom

The Computer Misuse Act 1990, section 1 reads:

(1) A person is guilty of an offence if—

(a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer;

(b) the access he intends to secure is unauthorised; and

(c) he knows at the time when he causes the computer to perform the function that that is the case.

In London, 2005, Gregory Straszkiewicz was the first person to be convicted of a related crime, "dishonestly obtaining an electronics communication service". Local residents complained that he was repeatedly trying to gain access to residential networks with a laptop from a car. There was no evidence that he had any other criminal intent. He was fined £500 and given a 12-month conditional discharge.

In early 2006, two other individuals were arrested and received an official caution for "dishonestly obtaining electronic communications services with intent to avoid payment."

United States

Laws vary widely between states. Some criminalize the mere unauthorized access of a network, while others require monetary damages or intentional breaching of security features. The majority of state laws do not specify what is meant by "unauthorized access". Regardless, enforcement is minimal in most states even where it is illegal, and detection is difficult in many cases.

Currently, 8 states (Arizona, Florida, Illinois, Michigan, Missouri, Tennessee, Virginia, and Wisconsin) and the District of Columbia, as well as some municipalities, have explicit laws criminalizing and allowing for prosecution in all cases of unauthorized use of a network. All 50 states and the district of columbia prohibit renting or neighbor-sharing of a single subscription not authorized by the provider, or the regular use of a neighbor's connection with or without that neighbor's approval in order to dodge payment of one's own subscription fees. Many places also have laws prohibiting the use of a hot-spot connection from outside the property's boundaries.

Some portable devices, such as the Apple iPod touch, allow casual use of open Wifi networks as a basic feature, and even use it for user geolocation.

Arrests

In St. Petersburg, 2005, Benjamin Smith III was arrested and charged with "unauthorized access to a computer network", a third-degree felony in the state of Florida, after using a resident's wireless network from a car parked outside.

An Illinois man was arrested in January 2006 for piggybacking on a Wi-Fi network. David M. Kauchak was the first person to be charged with "remotely accessing another computer system" in Winnebago County. He had been accessing the Internet through a nonprofit agency's network from a car parked nearby and chatted with the police officer about it. He pleaded guilty and was sentenced to a fine of $250 and one year of court supervision.

In Sparta, Michigan, 2007, Sam Peterson was arrested for checking his email each day using a cafe's wireless Internet access from a car parked nearby. A police officer became suspicious, stating, "I had a feeling a law was being broken, but I didn't know exactly what". The man explained what he was doing to the officer when asked, as he did not know that the act was illegal. The officer found a law against "unauthorized use of computer access", leading to an arrest and charges that could result in a five year felony and $10,000 fine. The cafe owner was not aware of the law, either. "I didn't know it was really illegal, either. If he would have come in [to the coffee shop] it would have been fine." He was eventually sentenced to a $400 fine and 40 hours of community service. This case was featured on the Colbert Report.

In 2007, Palmer, Alaska, 21-year old Brian Tanner was charged with "theft of services" and had his laptop confiscated after accessing a gaming website at night from the parking lot outside the Palmer Public Library, as he was allowed to do during the day. He had been asked to leave the parking lot the night before by police, which he had started using because they had asked him not to use residential connections in the past. He was not ultimately charged with theft, but could still be charged with trespassing or not obeying a police order. The library director said that Tanner had not broken any rules, and local citizens criticized police for their actions.

Legislation

In 2003, the New Hampshire House Bill 495 was proposed, which would clarify that the duty to secure the wireless network lies with the network owner, instead of criminalizing the automatic access of open networks. It was passed by the New Hampshire House in March 2003, but was not signed into law. The current wording of the law provides some affirmative defenses for use of a network that is not explicitly authorized:

I. A person is guilty of the computer crime of unauthorized access to a computer or computer network when, knowing that the person is not authorized to do so, he or she knowingly accesses or causes to be accessed any computer or computer network without authorization. It shall be an affirmative defense to a prosecution for unauthorized access to a computer or computer network that:

(a) The person reasonably believed that the owner of the computer or computer network, or a person empowered to license access thereto, had authorized him or her to access; or

(b) The person reasonably believed that the owner of the computer or computer network, or a person empowered to license access thereto, would have authorized the person to access without payment of any consideration; or

(c) The person reasonably could not have known that his or her access was unauthorized.

New York law, until a few years ago, was the most permissive. The section of NYS Penal Code which covered unauthorized access, previously only making piggybacking illegal when encryption or passworded security was bypassed, was quietly revised to reclassify piggybacking without the network owner's authorization as a class A misdemeanor. Westchester County passed a law, taking effect in October 2006, that prohibits commercial networks from being operated without a firewall, SSID broadcasting disabled, and a non-default SSID, in an effort to fight identity theft. Businesses that do not secure their networks in this way face a $500 fine. The law has been criticized as being ineffectual against actual identity thieves and punishing businesses like coffee houses for normal business practices.