Industry


Ads by TechWords

See your link here


Preston Gralla's picture
Preston Gralla

Seeing Through Windows

AOL: The biggest Wi-Fi privacy invader ever?

Worried about Wi-Fi invaders? Then forget Hot Spot hackers. By far, the biggest culprit is an AOL business partner that has put together a massive, private database of 16 million Wi-Fi routers throughout the U.S. and Canada, including network name and precise location. The odds are that if you have a home wireless network, you're in it.

The perpetrator here is Skyhook Wireless. For the last few years, it has sent a fleet of 200 trucks through the streets of 2,500 cities and towns in the U.S. and Canda. According to the Associated Press, "These trucks scan for the pulse given off at least once a second by every home wireless router or commercial hotspot, recording the unique identifying code for that piece of Wi-Fi equipment. That code is correlated with the exact physical location where it was captured using GPS in the trucks, which cruise the streets at 15 to 50 miles per hour as they collect this information."

What is Skyhook using this massive database for? At the moment, it's being used in concert with the AOL Skyhook "Near Me" AIM plug-in. The plug-in adds a new “Near Me” buddy group to AIM, and will show you contacts who are within a certain number of miles of you.

Where does Wi-Fi fit in? Skyhook uses the massive Wi-Fi database as a kind of poor man's GPS system to triangulate buddy locations.

By itself, this is fairly innocuous. But I wouldn't expect this to be the end of uses that Skyhook Wireless puts to this information. Expect it to be used for other purposes as well. And who's to say that they're only gathering basic information about your router? Will they also gather whether it uses encryption or not? Will they grab other information as well?

One thing is very clear: Skyhook Wireless isn't spending all this money just so it can support an AOL plug-in. Its ultimate goal, it says on its Web site, "is to expand the market for Location-Based Services (LBS) by making precise location information accessible to users and application providers."

In other words, the data will be made available to the highest bidder.

Skyhook Wireless very proudly admits what it's doing. In fact, it's hiring more truck drivers to do more scanning. If you're looking for extra work, it's posted a help wanted ad on its Web site for drivers. Be ready to drive down city streets for 40 hours a week with Wi-Fi scanning equipment. Just don't be too queasy about invading people's privacy.

Related Opinion by Preston Gralla:

What People Are Saying

I think the point has been

I think the point has been missed as to why this data is being collected and why it is so valuable, if a web site has access to this data they can reference where your physical location is when you hit the site, this is then used to target local and relevant advertising directly at your screen, this is worth millions to advertising companies. Knowing where the access point is, is only part of it, knowing where the client is in relation to those access points is the real end game

If you read skyhooks website you can see exactly where they are coming from and where they are going to make their fortune, this is a billion $ game and its being played in your street, there is no interest in capturing data or stealing bandwidth there is no money in that, its all about knowing where you are physically at any moment in time and big brother has it covered, its an awesome project when you look at it from a business point of view.

Back in the old days I got

Back in the old days I got my ham radio license then a commercial FCC licence. At that time, it was illegal to listen in on any radio signal that wasn't explicitly intended to be a public broadcast. That applied to any conversations that you weren't a party to, and any data that was broadcast that you weren't explicitly meant to receive. That regulation was in place specifically to address private information that is broadcast on public airwaves. Just because you "can" listen, doesn't mean it is legal for you to do so.

Seems to me that this would fall under that category of transmission, since most home WiFi networks are not explicitly meant to be accessed by the whole world. There's a big difference between noting the presence of the WAP, and recording and selling the information gained from the contents of the broadcast.

But maybe those regulations doesn't exist any longer. Probably were getting in the way of corporate profits.

THE REAL PROBLEM. 1-you are

THE REAL PROBLEM. 1-you are paying for "x" amount of bandwidth from your ISP. With free-loaders piggy-backing on your bandwidth you are subsidizing them and cheating yourself.
2-Most ISP providers are shipping wi-fi routers to their customers with no encryption, no firewall protection, and no security at all. If you are unaware of this fact, you may make your private data available to anyone within range of your wireless network (even if you think that you are only sharing with your other computer in another room).
3-You as a user are responsible for ALL internet traffic on your network. So, if "Joe Pervert" downloads kiddie-porn using your network, and saves it on a folder that you have shared on your computer--- SURPRISE!! You too can become a convicted sex offender....

My concern is that with this

My concern is that with this information some nut will be able to add physical proximity to the search criteria as he browses through social networking sites looking for his or her next victim. If I read the article correctly, that is what the Skyhook project is doing, referencing the logical node, i.e. the router, to a set of physical coordinates. While it's not illegal to collect the data, making it widely available does seem negligent, perhaps criminally so.

In a nation where there have been successful lawsuits by criminals who were injured while in the midst of criminal activity, compiling and releasing this type of information seems not only to be socially irresponsible, but to directly contradict the sole corporate ethic - mandated by law in most, if not all states - generate return on investment for shareholders. Remember, behavior that does not either directly or indirectly support that this is either incompetence or malfeasance.

While I agree with the

While I agree with the author that the AIM plug in is not the only thing they are going to do with this information, I just don't see it as invasion of privacy unless they are also using the WAP or sniffing the information or overlaying it with other information. I also agree with Cutaway that cell phone towers would make a more reliable signal to use. I have written more about this on my blog here.

This has existed as a hobby

This has existed as a hobby for quite some time: wigle.net

Anonymous (03/21/2007 -

Anonymous (03/21/2007 - 8:05pm), with all due respect, you have no idea what you're talking about.

What skyhook (and others, like navizon.com) are doing is completely passive. As your signal beacon that says "00:00:00:00:00:00, Joes_AP" goes flying by, they notice it, and mark down the location they were at when they heard it. That's it. If they were there to hear it or not, it has the exact same effect to you. You're not losing bandwidth, they're not connecting to your AP, they could care less whether it's encrypted or not.

It's not just about privacy;

It's not just about privacy; it's about bandwidth. The whole idea of such a database is not to 'invade' anyone's privacy; it's to track bandwidth, a measurable commodity that is 'used.' The only reason to track it is to make it available to others. For example, if someone parks outside my house and does their windows updates at 50MB a pop, that's bandwidth no longer available to me. I won't be able to do the same thing or any high-bandwidth operation at all at the same time. If I didn't give you permission to do so, that's theft.

Now, of course, if that happens I haven't been too smart about encrypting my link, adding a password other than the default, or even restricting access to the IP addresses I specify, so maybe it's "all my fault because I'm so stupid." On the other hand, that's not a particularly good defense for a crime. It's like saying that woman deserved to get raped because she was dressed in sexy clothes and looked hot, so it was "all her fault." I'm pretty sure the owners of these many thousands of hubs haven't given permission for Skyhook to identify them. And one wonders why Skyhook is tracking even encrypyed signals. Are they planning to break the encryption?

I don't have a problem at all mapping commercial nodes. Indeed, libraries, for example, advertise them and encourage their use, but for unwitting home users? No.

This sucks. They should be stopped.

The privacy implications of

The privacy implications of the previous posters' assumption that what's OK for anyone within 100 feet of me to know is ok for everyone willing to pay a third party to know are breathtaking.

Ever whisper anything to anyone in a public place? The expectation that you can only be heard by the person next to you or a very determined snooper who at that time and place must go out of his way to hear you is being challenged.

In fact, with the right equipment, it's probably possible to hear conversations inside most folks' homes from public places. I guess we can whisper in our homes if we expect privacy.

Can't folks tell the difference between expecting to be observed by someone nearby and expecting nearby observations to be recorded and published for worldwide distribution by a third party?

Wi-Fi is a public band. If

Wi-Fi is a public band. If you don't want to have yourself identified by anyone in any fashion--excluding the fact that there's no way to identify a user by their base station's BSSID or Wi-Fi station address--then don't use Wi-Fi. It's public. That's the risk you take. If you want private data, use cell data networks, in which only your cell operator can violate your privacy.