How do open (no password) wireless networks deal with abuse?

Question

Many places today such as restaurants, malls, and other public places have free and open WiFi that does not need a password or login information to access. That means that anyone, even people outside the building that contains the router, can easily access the network. Since there are no accounts or similar, even with logs it is almost impossible to identify a specific user (especially if they spoof their MAC address).

So, how do those places deal with abuse or illegal activity? That includes uploading/downloading illegal files, criminal activity (threatening emails, leaking information, etc.), or hacking (denial of service, capturing network data from other users).

Basically, is it even possible to deal with abuse and identify a user who has committed a crime or similar on a public network when thousands of people use it every day?

Answer 1

Most sites with open wireless systems deal with abuse by not caring. And that's it.

When police forces need to identify some villain and know that he connected to some wireless hotspot, e.g. in a bar, they resort to what police forces have always done since police exists: witnesses. Just ask everybody if they saw someone shifty or hacker-looking. In recent times, this includes surveillance video cameras. The fundamental property at work, here, is that perpetrators of computer crimes are also human beings, with corporeal bodies, biological needs, and leaving traces everywhere.

While some attackers feel that "the game" is to be played in the computer world only, law enforcement agencies do not consider themselves to be constrained that way. If I remember correctly, Kevin Mitnick first reaction, upon being arrested, was to say that Tsutomu Shimomura had "cheated" by calling the cops instead of defeating him with "computer skills" only. (This anecdote is likely to be apocryphal, but I find it representative of the mindset of many wannabe hackers.)

Answer 2

The sorts of places that leave their wireless access points unprotected are often administrated by those who can most legitimately plead ignorance about the potential misuse of their network... to what extent the law takes that into account is a point about which I'm ignorant. But I do know that people 'leeching' of other's APs was a line of defense when certain governments were trying to crack down on P2P piracy. As in: I didn't download that film; someone else did via my AP. Again, I have little idea how that argument legally worked in practice.

I notice that unprotected access points is much more common amongst Ma and Pa places than branch places: you'll see them in local cafes but probably not Starbuck's. This perhaps implies that companies large enough to employ people to advise on such matters are informed that such open networks have problems like the ones you mention.

Also, technical information like MAC and IP addresses is only a part of the picture. Thomas mentioned the 'meatspace' stuff like the police asking around. I suppose that things like MAC addresses are just one of many pieces of information that law enforcement can triangulate to assess illegal matters that happened via an AP.

Answer 3

They ignore everything until the ISP threatens to terminate service or something bad happens.

The most common complaints are BitTorrent and similar copyright issues, and that can be mostly mitigated by capping bandwidth utilization per MAC, time limiting, etc.