There is a question on the Superuser forum wherein a bad actor is trying to trick someone into connecting to an access point, presumably so they can sniff information. They are doing this by setting up an access point with a very similar name to their victim.

Were the victim to turn the tables and deliberately make use of the provided connection, using a VPN to neutralise the threat, would they have "plausible deniability" being that the name of the access points were very similar (but bearing in mind they are using a VPN)?

Also, assuming this matter ever went to a court (which I assume is unlikely), could the user use a defense that the other party did not have clean hands? Would it matter if it was dealt with as a Criminal and Civil matter ?

I'm interested in the general concepts underpinning these concepts more then explicit statutes, so pick a jurisdiction if it can help the mental processes!


Given that both parties have committed criminal offenses (the 'bad actor' is attempting fraud and the 'victim' has committed unauthorized access to a computer system), no court would hear a civil case between these parties. As a matter of public policy, criminals do not owe a duty of care to each other so no one can win this case.

  • 2
    Does country matter? – jpmc26 Jun 9 '17 at 7:59
  • 7
    Why is using a VPN a crime? – Worthy7 Jun 9 '17 at 8:13
  • 12
    @newcoder There may not be explicit permission, but there is certainly implicit permission. The whole point of the bad actor's actions is that he wants the victim to use his network. I disagree that "no court would hear a civil case between these parties". 1. The clean hands doctrine only applies to equitable remedies. 2. Only a criminal court could determine whether or not the parties had committed criminal offenses, so a civil court will not be able to refuse to hear a case on this basis. – JBentley Jun 9 '17 at 9:56
  • 3
    Wait up, so what about all the free network hotspots that exist in the world. I think almost anyone can agree that if you own it and broadcast it passwordless, then it's your own funeral at who connects to it. Likewise to the person connecting to the AP. – Worthy7 Jun 12 '17 at 4:48
  • 2
    @DaleM Neither party has admitted to criminal intent. The person who set up the "spoof" network can claim that it wasn't a spoofing attempt at all: they just liked the name and decided to use it; the person with the VPN claims that they connected by mistake. Both of those claims are pretty obviously false but they're denials, not admissions. – David Richerby Jun 14 '17 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.