Legal responsibility of illegal actions over open wifi?

Being hopelessly pedantic here, but no-one owns the Internet. However, your provider probably owns their internet, and has a range of legal responsibilities for that. They also often have a set of legal indemnities too.

Again IANAL, and I don’t even live in the US.

Suing someone really means you have a goal in mind. The RIAA is trying to scare people, so they go after little people, and bancrupt them. This is an unusual tactic, mostly you sue people to specifically stop them doing something, or you sue them to make money, in which case you sue whoever has the deepest pockets (or their insurance company does) taking the risk they they can outspend you and win.

Leaving any WiFi open is probably a bad idea. If you know that it can be used for bad purposes, and you left it open anyway, it is possible that this will be viewed as akin to any other reckless action. Not all that different to leaving your keys in your car’s ignition. Providing what is generally viewed as best, or at least, commonly understood to be good, practice access control to the WiFi, is probably akin to locking your car and keeping the keys in your pocket. Car might still be stolen, and bad things may be commited with it, but it isn’t as if you gave the criminals a free ride.

Sadly, as above, if you really have a specific legal need, you need to talk to a real lawyer in your locale. (Asking for specific legal advice breaches the terms of these forums, but the wider principle is IMHO still interesting.)

While this was probably intended as a joke, as part of “the management” of part of the Internet for nearly 20 years, I can say that this is more accurate than it seems.

As has been discussed in other posts here, smaller ISPs purchase service from larger ISPs who then purchase / trade service from even larger ones.

The normal course of events is that the rights holder finds out about a potential copyright violation (a number of companies exist just to watch the file-sharing sites for particular software, and sell that information to the software authors). They then send an email message to the recorded holder of the IP address that was sharing the file.

This may be a large ISP who may not have handled the traffic (it is possible to be “multi-homed”, where your IP address, even though delegated from one ISP, is sending some/all traffic via another ISP).

That ISP looks to see what company they sub-delegated that IP address to and sticks a “We got this complaint from a rights holder and the address is delgated to you - we trust you’ll handle it” at the front of the complaint. This may go on for several levels, until the complaint actually gets to the end customer who has that IP address. I’ve seen these go 4 levels deep.

That is for file sharing type stuff. If you post something to your own web site, or your provider’s, it is more likely that you will receive a “DMCA takedown” notice directly from the rights holder. In the “old days”, you’d get a registered letter from their lawyers with a list of demands.

While you might be able to get away with telling the rights holder “so sue me” and ignoring them, there are certain things that users can say / do on the Internet which get the Secret Service very interested. If you don’t want to partake of their hospitality offer, you had better have an accurate record of what customer the IP address in question was allocated to at the time the event happened. Back when the Internet was just becoming commercialized, we had them show up at the office a couple times before we explained how they could look up delegations themselves and save time. The few times they showed up, it was within an hour or so of the event happening, so they were definitely interested in getting to the bottom of things faster.

Al Gire has immunity because he saved the world from Tipper and global warming.

The process montioned above - “Rights holder finds violation, asks ISP to take it down…” That works for a hosted web site or a permanent customer.

File-sharing is more erratic. A customer (if that!) comes into the shop, shares some files for a while and then departs. By the time the rights-holder determines that a violation has occurred, determines the location, and sends someone out there, there’s a good chance that not only is the perp gone, but within a few days even th security camera footage may be gone; not that you can identify anyone’s MAC address of their computer by security footage.

It might be worth-while for a police department to spend a week or two staking out a coffee-shop if they find a habitual sharing of grossly illegal content (protection of the innocent is worth any price), but the RIAA has pretty much blown its budget for a specific violation before they even get to court. They rely on people caving and paying without a fight.

The ISPs will no doubt cooperate in identifying and passing on threats to established customers; and maybe even throttling excessive traffic. But, some hav alreay balked at doing too much of the RIAA’s work for them. A quick way to reduce your business is to basically tell any business wanting to offer free wifi to customers “that will last about a week before we cut you off unless you pay some security expert huge bucks to constantly update your filters…”

IIRC the DCMA basically says that ISPs only have to take down specified copyright content when asked to in a formal way. Anything more requires the goodwill of the ISP. If the RIAA threatens too much of the ISP business, they will minimize the cooperation obtained.

Oddly enough, in all those cases about file sharing and kiddie porn that make the news, I don’t remember one that involved sharing from a public access wifi point.

I wouldn’t like to be quoted on it (an I’m not in the US so this is of limited value) but from my understanding around here we are expected to secure our wifi, our govt particularly senstive to racial issues and “incitement” and I wouldn’t like toi try and explain to them that no, I didn’t post the racist crap, even if it did come through my IP…

You can secure (by which I mean encrypt) a private wifi site, but I don’t know what or how much you can do with a public one in your average Starbuck’s. The whole intent is open access.

Am I assumung correctly that internet shooping with a credit card though a public wifi site is a a really bad idea – that you’re basically transmitting your cc info to anyone within a couple blocks’ radius who has the gear to receive it?

Ok, you have now convinced me of not offering wifi to my customers. I was going to be something completely irrelevant to the business and I only considered it because I planned to have internet access to entertain myself while babysitting it on the slow hours and figured I might as well open it for others to use while I was busy with customers.

That said, places that offer wifi to their customers are five to a corner in most cities. Are they all really either jumping through a million hoops to cover their asses or risking their business through ignorance? I find that surprising.

No, and my cite is the relative dearth of googlable stories of coffee shops getting sued. :slight_smile:

Also, would this be a personal ISP account you’d be sharing with your business? I doubt your ISP will let you do that. If you’re setting up a business account, I"d be surprised if your ISP didn’t include network security tools and information.

A better analogy would be for a taxi driver to be hired as a getaway car, though the driver didn’t know that the customer was a bank robber.

You are almost certainly assuming incorrectly. Any site that has the least understanding of how to conduct such a transaction encrypts data, such as your credit card number (if the URL being displayed when you click the PAY button is https, or you see your browser’s little padlock icon, you know the data is being encrypted). It is extremely difficult (maybe even impossible in any practical sense) to break those. WiFi connections themselves should be encrypted, but I understand that some older WiFi encryption methods are breakable.

I wouldn’t be so quickly discouraged. In a discussion like this, people will always offer worst-case scenarios, and if you had a lawyer, the lawyer would probably be bound to do the same. There is probably some extremely small risk (I can’t say zero), but the upside is that you’ll attract more customers. Remember, the music/movie industry wants to hit the most visible targets it can. Cities, universities, those get a lot of publicity. Even if you get a customer that downloads a movie or two illegally, the suers are not going to bother with an independent coffee shop. Starbucks or Panera would be much better targets, and they seem to be doing fine.

I know that it’s possible to monitor this stuff, because it has happened at two companies I worked for. My boss recently was downloading movies illegally at work. We used to sublet office space and the Internet connection from the primary tenant and they told us they discovered the activity and demanded that we stop. Years ago, the company I worked for sent a policy statement that accessing Napster (remember Napster?:)) from work was no longer allowed, although frankly I think the bandwidth suck was a bigger issue than the ethical/legal one.

So there are tools you could use to detect/limit the volume, content, source of downloads per customer which would probably preclude abuse of more than one kind. Not sure what is available in a more mom & pop setup, though.

Here is the text of an actual notice that …Someone I know very well got from his ISP:

They can say whatever they want. Unless the law explicitly says that, or court precedents do, it’s a variation of the lawyer’s “write them a nasty letter and see if they care…” tactic. besides, this appears (from your details) to be a single private person’s line, so it’s easy to guess who is most likely the offending party. I have never heard of any service provider being sued for that.

Good points though - if you have a simple home or business internet, better be sure your terms of service allow for redistribution of access. For that they will cut you off, because they probably charge more for a public access service.

They most likely have elementary spam blocking - i.e. port 25 can only contact the ISP’s mail server unless you specifically buy the SMTP service. Anything more - too much like work, too likely to cuse problems when you start blocking things.

I agree with md2000. I also want to know how the transmission was detected as containing copyrighted material, and how the copyright owner identified the IP address.

This is basically a CYA letter from Verizon. Frankly, they could probably be sued just as easily as the accountholder. Deeper pockets, too. :wink:

No they can’t be sued. They might be if they make a habit of protecting their customers, or it looks like they encourage this sort of stuff, so to CYA they say “we’ll pass on your concerns, but if you want to sue our customer by name get a court order to find out the name and address”.

If you get one of these, you’ve appeared on someone’s radar, good sense in the USA suggests you cool it for a while or go to a coffeeshop. In Canada, most people ignore the letters because it’s not clear if they can sue here anyway. (Yet…)

There is a difference between “they can’t be sued” and “it is unlikely that a plaintiff could win the case.” They could be sued.

I forgot to add that this was received because someone used this person’s open WiFi connection. I don’t find it to be any more than a CYA either, but I’m throwing it out there so Sapo can see what kind of communications he might expect.

Also, most accounts that are going to get a CYA letter were probably sharing one particular file for a period of days. Since customers come and go, it’s unlikely one customer is going to be uploading an entire copyrighted file for more than an hour or so, and that’s not usually long enough to stand out on someone’s radar.

This is a good point. Even aside from any illegal actions over the open wifi, your DSL or cable modem account may not permit you to share the network with others. You might need a business-class account as opposed to a residential account.

Yes to all. It would definitely be a commercial account open with the explicit option of sharing it. I am very serious about separating personal and business matters.