It's just been reported that the BBC plan to deploy wi-fi detection vans to identify users who are streaming content from their internet service (BBC iPlayer) without a TV license. For example, see The Telegraph.
How might they achieve this? What signatures could possibly be detected if the wi-fi is encrypted?
There's a number of possible aspects at play here. First up as @gegenbeispiel says it could just be a bluff, however lets consider the possibilities if it's not.
Unencrypted wireless. Obvioulsy if people have unenecrypted wireless it would be technically possible to sniff traffic going over the network and determine whether iPlayer URLs were accessed and then correlate that with the License fee database. You still have the problem of narrowing down the signal to a specific property (which could be quite difficult in things like flats, but it's technically possible)
Encrypted wireless. Here you can't get any details on the content being transmitted but in theory you could get some details about the volume of traffic being sent/received. Now in a lab style setup where there were no other wireless signals, if someone was watching a live broadcast, you might be able to say "that wireless network transmitted roughly the same amount of data as that stream is sending" and indeed that seems to be what they're describing. Where you own the server end of a connection you could modify the volume of data sent in a pattern that might be observable in a controlled environment.
Wired network. Outside a property there's basically no chance of detection using vans or the like.
So technically there are some possiblities with the wireless scenarios. So what are the problems here?
Legal. This is generalized traffic sniffing and would inevitably (in the unencrypted scenario) gather data not related to iPlayer. This leads to potential privacy/legal issues as faced by Google with their street view data gathering.
Technical. The number of unencrypted wireless networks is much much lower than it was in the earlier days of home broadband. All the major ISPs that ship Wireless routers make used of WPA2 encrpytion by default, so in most cases you're looking at the encrypted wireless scenario.
The problem with what they're describing in the article is that to me it seems likely that even if it works in a lab environment, in a real-world scenario with the huge mess of connecting devices, connections from each device and the vagaries of Internet traffic, isolating the patterns being sent in a reliable way that would stand up in court seems unlikely.
Overall it seems most likely that this is a bluff (or someone has managed to sell some snake oil inside the BBC and is going to make some good cash desiging the solution), however we'll only really know if more details emerge, most likely when someone refuses to pay the BBC after being told they're infringing and taking the matter to court.
I think this tweet from BBC settles the question:
and I quote: "While we don't discuss the details of how detection works for obvious reasons, it is wrong to suggest that our technology involves capturing data from private wi-fi networks."
It's a bluff, like so much of BBC/Capita licencing stuff.
Easily defeated by using RJ45 and either turning WiFi off or putting the router into a metal Faraday cage. Aluminium foil would suffice.
It would be very difficult to provide criminal-conviction-standard proof with data like this.
Unless BBC puts iplayer behind a paywall, any prosecution is going to be vulnerable to the "adverse possession" defence, i.e. the BBC did not make a reasonable, obvious effort to prevent contravention.
It would be much easier, and much more reliable legally for Capita/BBC to require ISPs to supply traffic data for suspect addresses under RIPA2000.
Laptop --RJ45--> Router Gateway --> Internet --> iPlayer not over WiFi.
Aug 11, 2016 at 8:43
How this could work: BBC iPlayer is obviously under control of the BBC. When it streams video, it can freely determine the packet sizes used, and create a pattern in those packet sizes. Even if you use VPN, the VPN server would encrypt the packets, and the packet sizes would be a bit bigger, but still in a recognisable pattern. So it may be possible to look at the encrypted packages that the VPN server sends to your home, and be very sure that this is a specific iPlayer program.
The license fee in U.K. is paid per household. The BBC iPlayer does not require login from within the U.K.
BBC has detailed information about each streaming endpoint, but the challenge for them is to match the streaming destination (maybe obscured by a carrier grade NAT) with a physical street address (and thus verify the license).
In the simplest case they can deploy the vans and sniff the encrypted WiFi traffic in the proximity of a household that does not hold a valid television license. Then they can match the on/off usage pattern of a certain endpoint with the observed WiFi traffic pattern.
In a more advanced case they can try to introduce deliberate alterations (breaks that would not get notice because of cache, changing the packet size) for a certain endpoint.
Having the information about each single receiver, I don't see a need to deploy any more advanced analysis techniques.
