What is legality of monitoring traffic for mac addresses

[kootenpv]

Hey, nice job on this :) I just wanted to mention that in case you are not aware, it is against the law to sniff packets. The only exception is to sniff on your own network, and only to protect it.

It is unfortunate, otherwise it would be really nice to come up with ways to use it!

At least you should put a "big fat" warning that the use of sniffing is most likely be illegal.

[schollz]

Hi @kootenpv! Thanks for that. Do you know any legal precedent that this type of sniffing violates Section 18 U.S. Code § 2511?

I don't need legal advice. I'm just curious whether "to intercept...electronic communication" applies to this since it is only looking at mac addresses and signal strengths and not actually investigating any of the packet contents (meta-data vs data?).

I see that Google got in trouble for something like this in 2013 but Google went so far as to collect fragments of data (sometimes email/passwords) which is more the definition of "electronic communication" than mac addresses and signal strengths.

[kootenpv]

Hi @schollz. The fact that you are not concerned does not mean you shouldn't put out a warning for people using your software if there is risk involved :)

Some people might live under other laws and they might be put in "danger".

I understand what you're saying w.r.t. meta-data vs data, and I do believe it is a valid point.

Very interesting to read your sources!

[schollz]

Added: 28cac50

Some people might live under other laws and they might be put in "danger".

Absolutely, I totally agree. I never thought about this but I'm also going to add a notice to https://github.com/schollz/find-lf.

I also put this question to the wireshark community.

[diogocp]

IANAL, but if you walk down the street with your smartphone in your pocket with Wi-Fi turned on, you will be "intercepting" thousands of packets from networks that you have no right to connect to.

[ansell]

@kootenpv just interested to know what the distinction is between MAC addresses and SSID's, such as are required for https://github.com/kootenpv/whereami, where you do not currently warn your users that sniffing this traffic may be illegal?

[cornishExile]

UK readers can find a brilliant legal summary, and advice on making MACs anonymous, from the UK Information Commissioners Office (ICO) https://ico.org.uk/media/for-organisations/documents/1560691/wi-fi-location-analytics-guidance.pdf

The 'howmanypeoplearound' situation is specifically dealt with.

Thanks to https://sites-dacb.vuturevx.com/110/3347/landing-pages/ico-produce-wi-fi-analytics-guidance.asp for way into the subject.

[kootenpv]

Maybe I was too paranoid, though I think it is an interesting discussion.

@ansell I did not think about it yet, although the situation is a bit different. Receiving/counting probes of people (this repo) is different from probing access points. As long as your phone is not functioning as an access point (hotspot/tethering), it will not be involved by whereami/FIND.

@cornishExile That's a fantastic link!

I think that the line is drawn if the WiFi data would be used for singling out individuals, as opposed to be collected as statistics: that would most likely be okay?

Another nice advice in the paper is to convert MAC to something non identifiable.

[cornishExile]

@kootenpv yes, it's interesting, isn't it?

Personal data acquisition is OK so long as it has a purpose or benefit to the individual (or group). But I wouldn't worry too much - given that web page adverts can install trackers on devices and lookup Facebook demographics, the bar seems pretty high to me (subjectively speaking).

Some basic privacy questions should be asked of a specific use: "what is the purpose of the data collection?", "what is the benefit (both for individuals and groups?", Is the data secure (eg 'hashing' protects in case of theft or loss)?, and how is data destroyed after use?

I don't think mac addresses collected by this means has any inherent privacy issues. The famous case in the UK of going too far is here http://www.cbsnews.com/news/uk-bars-trash-cans-from-tracking-people-with-wi-fi/ but even then the project was cancelled because of political and social pressure, not compliance issues per se.

Everyone keep developing please!

[kootenpv]

Sounds like a case closed to me :)

[cynddl]

Personal data acquisition is OK so long as it has a purpose or benefit to the individual (or group). […] I don't think mac addresses collected by this means has any inherent privacy issues.

Actually, collecting MAC addresses in the EU now falls under the GDPR regulation, as personal data. Indeed, a MAC address is directly associated with a device and their owner can easily be identified (uniquely).

Therefore, collecting and storing MAC addresses requires explicit consent from users on the network. Pseudonymizing MAC addresses is also not enough.

[john-patterson]

@cynddl Like most people in this thread, I am not a lawyer. There's a clause for being engaged in personal versus commercial pursuits in GDPR.

According to https://www.itgovernance.eu/blog/en/does-the-gdpr-apply-to-me:

The one caveat to that that the GDPR does not apply to people processing personal data in the course 
of exclusively personal or household activity. This means you wouldn’t be subject to the Regulation if 
you keep personal contacts’ information on your computer or you have CCTV cameras on your house 
to deter intruders.

To fall within the remit of the GDPR, the processing has to be part of an “enterprise”. Article 4(18) of 
the Regulation defines this as any legal entity that’s engaged in economic activity. You must be careful 
not to mistake business conducted from home for household activity.

[chrisnicola]

Pseudonymizing MAC addresses is also not enough

@cynddl would hashing them be sufficient? I'm assuming the problem here is to just count the number of unique ones.