Open WiFi hotspots, city-WiFi and anonymity

Last week European Commission president Jean-Claude Juncker proposed open city WiFi networks. This left us with some unanswered questions, e.g. about the rules for liability when it comes to copyright infringements. (Link»)

The very next day a ruling in the European Court of Justice (ECJ) brought some clarity. And raised some new questions.

The court finds that a measure consisting in password-protecting an Internet connection may dissuade the users of that connection from infringing copyright or related rights, provided that those users are required to reveal their identity in order to obtain the required password and may not therefore act anonymously, a matter which it is for the referring court to ascertain.

Ars Technica wrote…

Businesses such as coffee shops that offer a wireless network free of charge to their customers aren’t liable for copyright infringements committed by users of that network, the ruling states—which, in part, chimes with an earlier advocate general’s opinion. But hotspot operators may be required, following a court injunction, to password-protect their Wi-Fi networks to stop or prevent such violations. (…)

The implications are obvious: no more free and anonymous Wi-Fi access in bars, cafes, or hotels in countries within the 28-member-state bloc that can now use existing law to demand that users hand over their ID first.

Pirate Party MEP Julia Reda commented…

Juncker’s free Wi-Fi plan is aimed at travellers, refugees, and other groups that could not possibly be expected to identify themselves before using a public Wi-Fi. The commission is even advertising its new initiative as password-free. This ruling means that copyright holders will be able to foil that plan and require free Wi-Fi providers to restrict access to their networks.

Let me add to the confusion.

First, let’s have a look at the situation for traditional hotspot operators such as cafés.

It is not reasonable to expect a café owner to keep a database of all local WiF users. That would require an extensive and very privacy sensitive register that cannot be tampered with and that can stand up to legal procedures. And still, it would do nothing to identify an individual user on the cafés single IP address. At least not with the relatively cheap and simple WiFi equipment normally used in such places.

It all quickly gets complicated and expensive. This would effectively kill free WiFi with your coffee.

The same general questions can be raised when it comes to Juncker’s free city WiFi. But there is a difference. Public sector operated WiFi will have more money and can apply common technical standards. As the number of users in a city-WiFi can be expected to be substantially higher that at a single café – there would not only need to be some sort of password protection but also individual user names, linked to personal identity. At least if you want to meet with the ECJ ambition to be able to identify single users.

In both cases, anonymity will be more or less impossible.

And when it comes to city-WiFi, we can expect various law enforcement and intelligence agencies to show a keen interest.

/ HAX

Ars Technica: Wi-Fi providers not liable for copyright infringements, rules top EU court »