4

Lets say I built a device using some software like NFCProxy or a hardware/software kit like Proxmark3 and just stood in middle of a sidewalk with a high amount of foot traffic and I passively captured all the data of the people walking by me. The data captured might include personal/private information like credit cards, passports, drivers license, building access cards, etc. Basically anything that uses radio frequencies to transmit data within a certain proximity.

Since the data was captured passively and in public. Would publishing that data on a public website/forum be illegal?

EDIT: For clarification, This is for a cyber security project I had in mind to show the vulnerabilities in everyday items we carry with us (Phones, Tablets, Credit/Access Cards, ID's, etc). This is to raise awareness and eventually secure these devices properly.

|improve this question
  • I don't understand what it mean to "passively capture" passport data. – user6726 Jul 20 '17 at 2:20
  • "Passive sniffing / capture" is monitoring signals in the air without needing to do anything to receive those signals. Think about it like receiving radio signals without needing to actively do anything to force that broadcast other than being within a certain proximity. Here is a youtube video showing an example of it; youtube.com/watch?v=cxxnuofREcM – Digital fire Jul 20 '17 at 4:12
  • So this is about passive tags that happen to be near someone else's RFID scanner, right? Also, for a passport, the person would have to have their passport open. – user6726 Jul 20 '17 at 20:15
  • Correct regarding the purpose of the question. As for the passport, it just needs to be within proximity to cause the tag to "activate" transmission of data, not necessarily be open. – Digital fire Jul 20 '17 at 20:22
  • I think it technically has to be open, because of the scanner-blocking envelope. Anyhow, now I understand the scope. – user6726 Jul 20 '17 at 21:36
3

This would probably constitute illegal wiretapping and would certainly constitute a 4th Amendment search if conducted by law enforcement.

Normally, the definition of whether something is "public" for purposes of an expectation of privacy is whether it could be detected by a human being unaided by technological enhancements from a place where someone could lawfully be to make that kind of observation.

Some of the relevant cases are Katz v. U.S., 389 U.S. (1967) (tape recorder outside a public telephone booth was a search violating the expectation of privacy) and U.S. v. Karo, 468 U.S. (1984) (tracking device placed in barrel by authorities violated expectation of privacy).

RFID signals are not "public" even if they are not encrypted with a private code because a device, such as the ones identified in the question, is necessary to receive them.

The Wiretap Act, codified by 18 U.S. Code § 2511, is a federal law aimed at protecting privacy in communications with other persons. Typically, when you think of a "wiretap," the first thing that comes to mind is someone listening to your telephone calls. But the Act protects more than that. Under the Act, it is illegal to:

  • intentionally or purposefully

  • intercept, disclose, or use the contents of any wire, oral, or electronic communication

  • through the use of a "device."

The Act provides criminal and civil penalties for violations, although it creates various exceptions to when interceptions and disclosures are illegal.

From here.

In this circumstance, despite being passive, one is intentionally intercepting the contents of electronic communications through the use of a device. The fact that there was not in all cases an intent to communicate through, for example, an RFID chip, on a specific occasion probably does not suffice to render it not a communication.

|improve this answer
  • I think your definition of "public" above is slightly skewed. As it has already been shown that anything you can see from the public, can be captured and made public. For example, a woman changing by an open window would not be protected from a photographer taking a picture with a telescopic lens from a public street. See this article for an example; petapixel.com/2013/05/16/… – Digital fire Jul 20 '17 at 20:01
  • Also, the "omniCISA" (justsecurity.org/wp-content/uploads/2015/12/…) seems to include language that allows for the publication of information for the purpose of cyber security. Not sure if this situation is covered under these changes. – Digital fire Jul 20 '17 at 20:08
  • @DigitalFire Putting aside general principles, the Wiretap Act seems to pretty squarely cover this scenario. and the Cybersecurity Act doesn't seem to apply as by definition (from the question) this isn't cybersecurity information. Also, the telescopic lens case isn't so simple. There are rights of publicity, etc. that could also be implicated and you can't use the equivalent of X-ray vision. – ohwilleke Jul 20 '17 at 20:45
  • I'll add clarification to the question as it is indeed for a cyber security project. – Digital fire Jul 20 '17 at 20:47
  • @DigitalFire The fact that it is for a cyber security project does not mean that it is cyber security information. Cyber security information would be stuff like computer malware code and sources, not personal information about random people walking down the street. Raising awareness IS NOT a legitimate reason to share personal information. It is probably a crime to do that. – ohwilleke Jul 20 '17 at 20:51
1

Extending ohwilleke's conclusion, RFID sniffing is interception of electronic communication (defined in 18 USC 2510(12)):

“electronic communication” means any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic or photooptical system that affects interstate or foreign commerce, but does not include—

(A) any wire or oral communication;

(B) any communication made through a tone-only paging device;

(C) any communication from a tracking device (as defined in section 3117 of this title); or

(D) electronic funds transfer information stored by a financial institution in a communications system used for the electronic storage and transfer of funds

Oral communication, (2) that section

means any oral communication uttered by a person exhibiting an expectation that such communication is not subject to interception under circumstances justifying such expectation, but such term does not include any electronic communication

Briggs v. American Air Filter, 630 F.2d 414 points to this distinction, saying

As we have noted, see n. 4 supra, interception (as defined by the statute) of wire communications is forbidden regardless of the speaker's expectation of privacy

The same reasoning would hold of electronic communication, since there is no "expectation of privacy" language in the definition of either wire or electronic communication – unlike oral communication. Thus the issue of "no expectation of privacy" falls by the wayside, and the interception is plainly illegal.

|improve this answer
  • Good points. I agree. – ohwilleke Jul 20 '17 at 22:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.