Legal implications of unsecure bluetooth device

Question

I have recently learned about a high-tech premium bed base that incorporates Bluetooth speakers, plus massage actuators and other features controllable via a smartphone app.

Like many insecure Bluetooth speakers, the ones in the bed base will pair with any Bluetooth device without any form of authentication, not even a pairing button.

This basically allows anyone with a smartphone to:

• Walk within Bluetooth range of the device (for example from the street)

• Open their phone and notice the device advertising itself on Bluetooth

• Click on it to select it as audio output device

• Play any kind of audio file on it

There is no microphone, so it is not possible to remotely record audio. This is not like insecure Bluetooth headsets which allow anyone within range to connect and use the microphone to record.

Neither hacking nor password is necessary to perform this feat, as the device advertises itself as available for connection, and simply accepts all incoming pairing requests. It may even be possible to control the bed position and massage features remotely.

Now I'm wondering what the legal implications are:

• For someone who does not own the device, yet connects to it (perhaps by mistake) and plays audio on it without the owner's consent, or manages to remotely control the motors...

• For the manufacturer: is it legal to even sell this? Can the buyers sue the manufacturer after the neighbor's kids decide to make the bed speakers play heavy metal at 4AM every night, rendering the bed base features unusable?

• For the owner: I know if someone hosts an insecure WiFi and someone else connects to it and uses it for nefarious purposes, the owner of the insecure WiFi can face consequences. In this case the device uses Bluetooth not WiFi, and it is not connected to the internet, so this should not apply... unless maybe?

I'm definitely not planning to buy one of these (nor prank it) anyway, so I'm not focusing on any particular jurisdiction.

Answer 1

It is legal for a manufacturer to sell a device which is capable of being misused. For example, a wifi-capable router can be sold even if it is "open" by default. A Bluetooth device has a shorter range than wifi, but in principle can connect to any other device. An owner's legal liability is not different given wifi vs. Bluetooth.

Whether or not there is criminal liability for a third person who connects to the device also does not specifically depend on whether the device uses Bluetooth technology, as opposed to some other technology. 18 USC 1030 is the general federal law prohibiting "unauthorized access". In the case of a bed, two legal question arise: is it a "computer", and is it "protected"? It is an electronic high speed data processing device which performs logical, arithmetic, storage and communications facilities, i.e. it is a computer (in the legal sense). It probably is not protected, because it is not "used in or affecting interstate or foreign commerce or communication", that is, it is not connected to the internet (unless it is). State laws tend to be broader, not having the "interstate commerce" limitation, so accessing the bed would violate Washington's analog of the federal law. However, under Washington law, the access is probably not "without authorization". That term is defined as

knowingly circumvent technological access barriers to a data system in order to obtain information without the express or implied permission of the owner, where such technological access measures are specifically designed to exclude or prevent unauthorized individuals from obtaining such information, but does not include white hat security research or circumventing a technological measure that does not effectively control access to a computer. The term "without the express or implied permission" does not include access in violation of a duty, agreement, or contractual obligation, such as an acceptable use policy or terms of service agreement, with an internet service provider, internet website, or employer. The term "circumvent technological access barriers" may include unauthorized elevation of privileges, such as allowing a normal user to execute code as administrator, or allowing a remote person without any privileges to run code.

One question is whether there is any technological access barrier that the user circumvents (I don't know if it is possible to circumvent "hidden mode"). Since the term "may include ... allowing a remote person without any privileges to run code", and since playing music on speakers involves running code, then the remote user may be criminally liable. On the third hand, the language of that paragraph ("technological access measures are specifically designed to exclude or prevent unauthorized individuals from obtaining such information, but does not include ... circumventing a technological measure that does not effectively control access to a computer") clearly indicates a legislative intent to address deliberately overcoming active access barriers and not accidentally connecting to an unprotected, open system. Plus, the law also says that you are accessing the computer "in order to obtain information", but that is not the purpose of transmitting sound to speakers.