Liability from unsecured wireless hotspot for security testing
<p>Lets say I have created an "Offensive" security system. It runs on my own private network on my laptop any where I go. My private network has a wireless access point called "Malicious Wifi" and it is unsecured (Anyone can connect to it without a password).</p>

<p>My security system will attack any unauthorized devices that connect to it. The goal of the attack is to gain access to the system by any means necessary but without any interest of the internal  data of the device. Just to gain control of the device.</p>

<p>If I goto any location (Starbucks for example), and someone connects to my private (albeit unsecured) network out of curiosity.</p>

<p>Can I be held civil and/or criminally liable for any damages that arise from my security system attacking their device on my private network?</p>

<p>What if no permanent damage was done and no data was taken or used for malicious intent. Just temporary control of the device. Does this avoid or reduce potential liability?</p>

<p>18 USC 1030 starts</p>

<blockquote>
  <p>Whoever— (1) having knowingly accessed a computer without
  authorization or exceeding authorized access</p>
</blockquote>

<p>In this scenario, I will refer to the person running the access point as Malicious, and the person accessing it as Curious. When Curious accesses the network, they have done so without authorization. Accessing a computer is not itself a crime, and other elements are required to make it a crime – under (2)(C) that includes obtaining "information from any protected computer" (cellphones and modern computers are protected computers, since they are capable of affecting interstate commerce). Also under (5)(C), it becomes a crime if one</p>

<blockquote>
  <p>intentionally accesses a protected computer without authorization, and
  as a result of such conduct, causes damage and loss.</p>
</blockquote>

<p>Other conditions involve accessing financial data, committing fraud, threatening, etc. and do not seem obviously applicable. It is not obvious that access to an unsecured network falls under the ambit of (2)(C) or (5)(C). In so connecting to Malicious's computer, Curious obtains an IP address, which constitutes information, and also consumes a tiny amount of bandwidth (miniscule loss). At the same time, any attempt to access any network or web page is always done without explicit authorization (yet), and always involves obtaining information (HTML, some means of asking the user to agree, and getting the user's agreement). As far as I know, it has not been found that accessing a computer without <em>prior</em> permission violates 18 USC 1030. In the case of <a href="https://stanford.edu/~jmayer/law696/week1/United%20States%20v.%20Drew.pdf" rel="nofollow noreferrer">US v. Drew</a>, defendant accessed a web page but violated the TOS – the government argued that that made the access "without (and/or in excess of) authorization" (defendant <em>did</em> obtain actual information, not just an IP address, and used it maliciously). However, the conviction was vacated on the grounds that violating TOS does not clearly constitute having unauthorized access. Since Curious caused no harm and did not snoop on Malicious's computer, since all computers with wireless automatically probe all sorts of devices out there without pre-authorization to ask for authorization, I see no reasonable change that Curious has committed a crime; and clearly, Curious has caused no harm.</p>

<p>Malicious has more clearly violated the law, by likewise accessing Curious's computer but also (5)(A)</p>

<blockquote>
  <p>knowingly causes the transmission of a program, information, code, or
  command, and as a result of such conduct, intentionally causes damage
  without authorization, to a protected computer</p>
</blockquote>

<p>Malicious does not have to specifically know that his machine is transmitting the virus to Curious: he knows (or should know) that he has cause the situation where the virus will transmit, and that damage will result. Under 18 USC 1030(g), Curious may seek compensation in a civil action.</p>

<p>Since every state has its own wireless-access laws, we'd need a specific state to see if a state law has been violated.</p>

<p>This message brought to you by the legal concepts "reasonable man",  "attractive nuisance" and "booby trap".  </p>

<p>The first problem is that you are <em>advertising</em> the SSID.  That is, when Innocent queries "any WiFi networks in the area?", your system is jumping up and answering "Yes! Right here! My name is Malicious_Wifi and I am open." </p>

<p>First, if you do not desire intrusion into your WiFi network, you are granted ample ability to lock it down: </p>

<ul>
<li>you can fail to advertise the SSID (force them to know the SSID) </li>
<li>you can use WAP, WPA etc. to set a <em>password</em> on the WiFi</li>
<li>you can have an "open" WiFi but one which answers every HTTP request with an interstitial logon challenge.</li>
</ul>

<p>By doing none of these, you are <em>inviting</em> connection.   Now your grandfather with no computer experience, in your small town, might have a case against weird people parking vans on his street to poach his Open WiFi becuase he didn't know how to secure it.  But as a techie you have no standing to criticize.   You have created an <em>attraction</em>. </p>

<p>If you use the UI's of many mobile devices, you know it can be awkward to control them precisely; for instance it may pop up an interstitial inviting you to jon Starbucks WiFi, then 50ms before you actually tap it, change the interstitial to inviting you to join Malicious_WiFi.  tablets do this <em>accidentally</em>.  This stuff is not safety-engineeered because the industry philosophy is "features before bugfixes" or "move fast and break things".  And of course, people don't really pay that much attention.  So this kills your presumption that everyone who joins your network has <em>mens rea</em>, a thoughtful intention to do so.  You are at too high risk to snare innocents, which is why I call them "Innocent" instead of "Curious".</p>

<p>If you have a spooky old house or installation which attracts the curious/urban explorers, and you make efforts to secure it but they keep breaking in anyway, and it draws crime or there's risk of getting hurt in there, that is called an <strong>attractive nuisance</strong>.  This increases your liability for what happens in there.  You don't become criminally liable for cooking meth, but you certainly will be civilly liable if somebody puts their foot through a faulty stair. </p>

<p>That's not normally the case.  Once a criminal broke into a house, and tried to exit through the garage.  The interior door locked behind him, and for some reason (gross mechanical incompetence?), he was unable to open the garage door.  He subsisted on large bags of dogfood and bottled water.  He sued the family for his misery, and lost, <em>because it was happenstance</em> <strong>and not an intentional booby-trap</strong>.  It met the very minimal duty of care every facility manager has to first responders and trespassers to not leave the most gross hazards unguarded (open pits, rotted stairs, exposed electrical wiring) etc.  You know sometimes, people get in trouble with that standard, with pools. </p>

<p>Obviously, this "duty of care" excludes booby-traps.  If you intentionally create a hazard to a trespasser, then you have crossed the line from negligent to malice aforethought: here it is <strong>you</strong> who has <em>mens rea</em>.  You are <em>criminally</em> accountable for the trespasser's injuries same as if you attacked him in the street.  Indeed, when Fort Knox type places use booby traps, they merely contain the intruder long enough for security to capture her, and they have a system to positively alert security immediately before the trespasser needs an insulin shot.</p>

<p>How does this apply to your situation?  From the reasonable citizen's view.  You will find it very hard to seat a jury who will consider it a despicable act to log onto an open WiFi.  They will consider your hacking to be a wildly disproportionate response, and not a response at all, but the origin crime.  </p>

<p>They will consider your hacking in this context to be a "booby trap", again a crime all its own.   Yes, I realize your idea makes sense from inside its own bubble.  But the view from 30,000 feet is <strong>this is just a slight variation on other Trojan horse wifi networks</strong> which seek to infect other systems for nefarious purposes: it only differs by using a cutesie name for the SSID.  And even that makes sense:  there's a reason phishers <a href="https://www.microsoft.com/en-us/research/publication/why-do-nigerian-scammers-say-they-are-from-nigeria/" rel="nofollow noreferrer"><em>still</em> claim to be from Nigeria</a> and swerve out of their way to do so.  You look, walk and quack like an actual Trojaner. </p>

<p><a href="https://www.youtube.com/watch?v=hLmuF-0P4tk" rel="nofollow noreferrer">"I'm the bad guy?"</a>  'Fraid so. </p>

<p>It doesn't matter where or how you conduct your attempts at unauthorized access to other peoples' computers - i.e., by fooling them into connecting to your wi-fi network in a public space - becuase it is still illegal: <a href="https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act" rel="nofollow noreferrer">Computer Fraud and Abuse Act - Wikipedia.</a></p>

<p>As to the SSID (wi-fi network name) being named "Malicious." Many people's devices simply connect to any open network; they may not even see the SSID. Or, they may, and they are curious; do they waive all their rights to access by you by connecting to the network?</p>

<p>Your unauthorized access could also be compounded by <em>where</em> you were when you set up your wi-fi point. Starbucks could go after you - in a civil sense - for using their premises for your illegal activity.</p>

internet civil-law damages