Is intercepting WiFi signals legal in the United Kingdom?

Question

I want to use a software called Wireshark and its intentions are to collect packets (segments of information) from the WiFi radio spectrum.

However, the Regulation of Investigatory Powers Act 2000 and Wireless Telegraphy Act 2006 both say that it is illegal to intercept messages without authorisation.

• Considering WiFi are on public frequencies, does this mean it's legal to intercept (or in this case, collect packets)?
• If not, then why does my computer even allow me to (the manufacturers are committing a crime)?

Answer 1

Wireshark's intentions are not quite as stated in the question - following the link also shows that they (wireshark.org) are quite specific about using it on "your network", and that it's not limited to wifi.

If you were to intercept communications without authorisation, that would be the offence - not whether you used a particular network protocol analyser or even a particular piece of hardware (your computer) to process them. Unauthorised connection of a cable to a physical port could be covered by the same offence. The issue would be with your actions, not with the tool you used.

Keltari's example of the knife in the comments is a good one. I might add that ram raiding a shop is illegal, and cars are not, or that you could use your computer to physically assault someone regardless of the operating system and installed software, but that risks us drifting off into a series of obscure analogies.

It's the actions that are prohibited.

Answer 2

As with others in the comments, I am not a solicitor of any kind but this is an interesting question that I learnt about in a law class I had recently, where I asked this exact question.

It appears that this may be somewhat of a grey area in the Investigatory Powers Act 2016. This states, under section 3, that the "Offence of unlawful interception" shall be committed if a person "intentionally intercepts a communication in the course of its transmission".

It defines "Interception", in section 4, as "a relevant act in relation to the system" that makes any content available to a person who is not the sender or intended recipient.

Subsection 2(b) states that a "relevant act" means "monitoring transmissions made by means of the system". On the surface, this would seem to indicate that any monitoring is made criminal but in the relevant case law, "monitoring transmissions" seems to have been defined very narrowly as to only include proactive "acts" (I'm struggling to find the relevant cases on this).

If passive monitoring doesn't require any proactive "act" then I believe it can be argued that it does not constitute "interception". The only question remaining is if connecting to a wifi network is a proactive "act" or if it is passively listening to the network.

Answer 3

I think the key word here is "authorized". That is to say that if you were authorized explicitly, then it is reasonably legal. If there is an implication that is confusing or where there is uncertainty, I would air on the side of assuming it is illegal and seek clarity. In other words what are the conditions or wording (i.e. from a terms of use in some "pre-connection" agreement) under which you would feel authorized to conduct such activity?

You might also consider the potential for reasonable consideration such as providing an IT service to the providers of the public wifi such that the service necessitated the use of packet capturing. Though this would not cover providing some service to someone who falsly represented an organization or another client of the organization.

If you are capturing raw radio signals on the otherhand, then it may become more of a question related to encryption and breaking that encryption. While demodulating through software that uses some kind of standard protocol might be reasonable, the idea of breaking encryption may have more serious implications. Even if you do it using some kind of script kiddy software.

If you are anyone concerned about some implication from "testing out" some kind of script kiddy software and realize you may have done something illegal, I would not venture to build a defense on ignorance IMHO.