Who's liable?
Beefing up Wi-Fi security is a top priority for the industry. Wi-Fi case law is not developed enough to clearly support negligence claims, according to Burton, but businesses are already bracing for a day when they might be found liable for Wi-Fi security breaches.
The issue sparked up earlier this year, when three men were arrested and charged with stealing credit card information from a Lowe's store in Michigan, after allegedly accessing the home improvement store's wireless network from a parking lot.
Lowe's said the men were apprehended before they were able to use the credit card data. Since no customers suffered damages as a result of the alleged break-in, Lowe's couldn't be held liable in the incident. But that wouldn't preclude customers and insurers from seeking redress in other cases, particularly if they were found to have suffered financial or other losses as a result of negligence, attorneys said.
Security and the prevention of access by unauthorised individuals have been among the thorniest issues surrounding the use of wireless networks. The attraction for consumers and businesses has been that the wireless networks are easy to set up because they don't require laying cables in an office.
The easiest networks for consumers to install are wireless networks using Wi-Fi standards that have been created and developed by technology industry groups. Wi-Fi networks create an area of up to 300 feet in radius from a distribution device called an access point allowing a consumer to wirelessly access resources on the network. The most common resource used with Wi-Fi networks now is a broadband connection.
Many businesses have shied away from allowing wireless networking within their offices due to security concerns, although Wi-Fi has made in-roads in some areas such as warehouses, health care, education and government.
Consumers have been less concerned with security and have readily purchased Wi-Fi gear to set up networks. Security specifications are included in most consumer gear, but for whatever reason they aren't being used.
One solution would be to make security easier to turn on, according to Bruce Sunstein, an attorney with Boston-based Bromberg and Sunstein, which would also make it more clear when negligence has occurred. If security were already enabled when networking gear was sold or were self-configuring, consumers would have to actively disable the security, making them responsible for their act, Sunstein said.
But out-of-the-box security is not likely to happen soon, according to Dennis Eaton, chairman of the Wi-Fi Alliance, an industry group that certifies Wi-Fi products for interoperability.
"Networking can still be a complicated process, and what we're trying to do first is make it as easy as possible for consumers to set up the networking," Eaton said. "Then they can work on enabling security.
Eaton added that while the group discusses making security easier to enable, there is no formal plan for making that happen.
Mike Wagner, a director of marketing at Linksys, a division of Cisco, added that there could be a larger problem if security were enabled before gear got to consumers.
"Most people don't change default settings, so if we enabled security out-of-the-box with preset passwords, and consumers didn't change their passwords, there could be a potential for a larger problem if a hacker found out that default password -- something that would be easy to do," he said.
