'Wardriving' spam conviction exposes Wi-Fi security

A Southern California man has pleaded guilty to spamming people through unprotected wireless hotspots in the first-ever conviction under the US Can-Spam Act, and a case that again raises concerns about the risks of open-access Wi-Fi services.

Nicholas Tombros admitted driving around Venice, California last year, searching for unprotected hot spots - an activity called "wardriving" - and exploiting them to distribute unsolicited email that advertised pornographic websites.

Tombros pleaded guilty earlier in the week to unauthorised access to a computer to distribute multiple commercial spam messages. He is scheduled to be sentenced 6 December and faces a maximum penalty of three years in prison, according to the US Attorney, Central District of California.

The case is the first conviction in the nation under the much-publicised Can-Spam Act of 2003, signed in December. Since it became law, Can-Spam has failed to generate significant litigation, despite the continued proliferation of spam marketing campaigns.

In April, the US Department of Justice filed a criminal complaint against four Detroit men under the law, the first case sparked by the legislation. In July, the Massachusetts Attorney General's office filed suit against a Florida man suspected of sending spam email to thousands of consumers.

The Tombros spamming case also underscores the significance of security, or the lack thereof, in wireless networks.

Experts have said current security measures are cumbersome for the average consumer to use and that many consumers don't even know they should activate them. As wireless networking reaches a non-techie, mass market audience, incidents such as the Tombros affair could increase.

Craig Mathias, an analyst with researcher Farpoint Group, said: "Security measures are getting better, but they're still an issue. The novelty of wardriving is wearing off, but the fear is those who are malicious, and the threat of installing viruses or spyware onto a network and computer. Many of these attacks can be avoided if people take basic precautions, but many just don't know they should."

For manufacturers and consumers both, dealing with such security features involves walking a fine line - a powerful measure is needed, but it must be easy to install, and it must also leave the network available to authorised users. One of the reasons Wi-Fi technology has become so popular is because it has been so open and easy to use.

The FBI has documented several incidents of alleged cybercrime involving unauthorised use of open Wi-Fi access points. The Tombros case is one of four such investigations involving 802.11b technology reported by the agency as part of its joint law enforcement project known as Operation Web Snare.

Richard Shim writes for CNET News.com