Legality of piggybacking

Under Australian Law, "unauthorized access, modification or impairment" of data held in a computer system is a federal offence under the Criminal Code Act 1995.[3] The act refers specifically to data as opposed to network resources (connection).

In Canadian law, unauthorized access is addressed the Criminal Code, s 342.1, which provides that: "Every one who, fraudulently and without colour of right" obtains "computer services" from an access point is subject to criminal charges.[4]

Section 326(1) of the Criminal Code may also be used to address unauthorized access of a computer network: '(1) Every one commits theft who fraudulently, maliciously, or without colour of right', '(b) uses any telecommunication facility or obtains any telecommunication service.'

In Morrisburg, Ontario in 2006, a man was arrested under section 326 of the Criminal Code. Ultimately the arrest was poorly reported, there does not seem to be any information available with regards to conviction.[5]

In September 2016, the European Court of Justice decided in "McFadden"[6] C-484/14 that "a businessman providing a public wifi network is not responsible for copyright infringement incurred by users. But he can be ordered to protect the network with a password, to prevent copyright infringement".[7] The Electronic Frontier Foundation had lobbied for not requiring passwords.[8]

Under HK Laws. Chapter 200 Crimes Ordinance Section 161 Access to computer with criminal or dishonest intent:

(1) Any person who obtains access to a computer-

(c) with a view to dishonest gain for himself or another; or

(d) with a dishonest intent to cause loss to another,

whether on the same occasion as he obtains such access or on any future occasion, commits an offence and is liable on conviction upon indictment to imprisonment for 5 years.

Unauthorized access to a protected system is illegal.[9]

On April 28, 2017 the Tokyo District Court ruled that accessing a wireless LAN network without authorization is not a crime, even if the network is protected with a password. In a case brought before the court involved a man named Hiroshi Fujita, who was accused of accessing a neighbors wi-fi network without authorization and sending virus-infected emails, and then using that to steal internet banking information and send funds to his own bank account without authorization. Hiroshi was found guilty of most of what he was accused of and sentenced to 8 years in prison. Regarding the unauthorized access of wireless networks, prosecutors argued that wi-fi passwords fall under the category of "secrets of wireless transmission" (無線通信の秘密) and that therefore obtaining and using passwords without permission of the network operator would fall under the category of unauthorized use of wireless transmission secrets, which is prohibited by law. However, the court ruled that the defendant is not guilty, stating in their ruling that wi-fi passwords do not fall under that category and therefore the unauthorized obtainment of passwords and subsequent accessing of protected wireless networks is not a crime.[10]

Although Russian criminal law does not explicitly forbid access to another person's network, there is a common judicial practice to qualify these cases as an "unauthorized access to an information" (a broadly interpreted concept in Russian law regarding computer crimes) according to Article 272 of the Criminal Code. To construct the accusation, one considers ISP's billing data the information which has been accessed.

In addition, if the defendant have used any program (network scanner, for example) to access the network, he may also be charged by Article 273 (creation, usage and distribution of malware).

Piggybacking another person's unsecured wireless network is illegal in Singapore under section 6(1)(a) of the Computer Misuse and Cybersecurity Act.[11][12] The offender is liable to a fine of $10,000, imprisonment for up to 3 years, or both.[11][12]

In November 2006, the 17-year-old Garyl Tan Jia Luo, was arrested for tapping into his neighbour's wireless Internet connection.[13] On 19 December, Tan pleaded guilty to the charge,[14] and on 16 January 2007 he became the first person in Singapore to be convicted of the offense. He was sentenced by the Community Court to 18 months' probation, half of which was to be served at a boys' home. For the remaining nine months, he had to stay indoors from 10:00 pm to 6:00 am. He was also sentenced to 80 hours of community service and banned from using the Internet for 18 months; his parents risked forfeiting a S$5,000 bond if he failed to abide by the ban. Tan was also given the option of enlisting early for National Service. If he did so, he would not have to serve whatever remained of his sentence.[15][16]

On 4 January 2007, Lin Zhenghuang was charged for using his neighbour's unsecured wireless network to post a bomb hoax online. In July 2005, Lin had posted a message entitled "Breaking News – Toa Payoh Hit by Bomb Attacks" on a forum managed by HardwareZone. Alarmed by the message, a user reported it to the authorities through the Government of Singapore's eCitizen[17] website. Lin faced an additional 60 charges for having used his notebook computer to repeatedly access the wireless networks of nine people in his neighborhood.[18][19] Lin pleaded guilty to one charge under the Telecommunications Act[20] and another nine under the Computer Misuse Act on 31 January. He apologised for his actions, claiming he had acted out of "stupidness" and not due to any "malicious or evil intent".[19] On 7 February he was sentenced by District Judge Francis Tseng to three months' jail and a S$4,000 fine. The judge also set sentencing guidelines for future 'mooching' cases, stating that offenders would be liable to fines and not to imprisonment unless offences were "committed in order to facilitate the commission of or to avoid detection for some more serious offence", as it was in Lin's case.[21][22]

The Computer Misuse Act 1990, section 1 reads:[23]

(1) A person is guilty of an offence if—

(a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer;

(b) the access he intends to secure is unauthorised; and

(c) he knows at the time when he causes the computer to perform the function that is the case.

In London, 2005, Gregory Straszkiewicz was the first person to be convicted of a related crime, "dishonestly obtaining an electronics communication service" (under s.125 Communications Act 2003). Local residents complained that he was repeatedly trying to gain access to residential networks with a laptop from a car. There was no evidence that he had any other criminal intent.[24] He was fined £500 and given a 12-month conditional discharge.[25]

In early 2006, two other individuals were arrested and received an official caution for "dishonestly obtaining electronic communications services with intent to avoid payment."[26][27]

There are federal and state laws (in all 50 states) addressing the issue of unauthorized access to wireless networks.[1] The laws vary widely between states. Some criminalize the mere unauthorized access of a network, while others require monetary damages for intentional breaching of security features. The majority of state laws do not specify what is meant by "unauthorized access". Regardless, enforcement is minimal in most states even where it is illegal, and detection is difficult in many cases.[1][28]

Some portable devices, such as the Apple iPad and iPod Touch, allow casual use of open Wi-Fi networks as a basic feature, and often identify the presence of specific access points within the vicinity for user geolocation.

• Piggybacking (Internet access)
• Wardriving