Yesterday the FCC issued an order and consent decree (settlement details) DA 14-1444 in the investigation of Marriott International regarding blocking of personal Wi-Fi hot spots in the conference facilities of the Gaylord Opryland hotel property. The FCC imposed $600,000 fine. The decree mentions Marriott admitting that the blocking was performed using the rogue containment feature of a Wi-Fi monitoring system (We do not know which Wi-Fi monitoring system they used).
Marriott has taken position in the press that it was done to protect the guests of their own Wi-Fi service from rogue wireless hot spots. Some people conjure that this was done to force people into using Marriott’s paid Wi-Fi. Whatever the case may be, casual reading of these news flashes creates confusion around the propriety of using rogue containment as a security feature in Wi-Fi. However, careful review of the FCC order clarifies the logic behind the decision and brings out some important points.
Decree Makes Some Shrewd Observations
The following points stand out in the logic behind the decision – consumer protection, security relevance, and distinction between jamming and containment.
i) Consumer Protection
The following statement from the FCC order indicates the thinking that consumers can’t be deprived of legitimate use of the Wi-Fi spectrum.
“The growing use of technologies that unlawfully block consumers from creating their own Wi-Fi networks via their personal hotspot devices unjustifiably prevents consumers from enjoying services they have paid for and stymies the convenience and innovation associated with Wi-Fi Internet access.”
ii) Security Relevance
The following statement from the FCC decree indicates that security relevance of the containment action also weighed into the decision.
“Specifically, such employees had used this capability to prevent users from connecting to the Internet via their own personal Wi-Fi networks when these users did not pose a threat to the security of the Gaylord Opryland network or its guests.”
iii) Jamming vs Containment
To me the word jamming indicates transmission in the spectrum to prevent others from using the spectrum. On the other hand, I think the word containment is about disconnecting specific connections between the devices that are confirmed threats to the security. Containment transmissions (de-authentication packets) follow the agreed upon collaborative channel access procedures and generate insignificant level of wireless traffic.
The FCC decree has also made the distinction between jamming and containment. In this matter, the word jamming was used by the complainant to describe the situation. However, the FCC seems to have weighed in on whether the containment was used in a manner that resulted into jamming. I do not believe this decision generically equates containment to jamming, but attaches weight to the manner in which containment is used. The following statement directly precedes the security relevance statement in the decree and has the antecedent description of the consumer protection philosophy from the order.
“In the course of its investigation, the Bureau discovered that one or more Marriott employees had used the containment capability discussed in paragraph 5 in a manner that the Bureau believes violates Section 333.” (Section 333 is about jamming).
In this case, it seems FCC reached the conclusion that rogue containment was used in a manner to disrupt rightful communications of users even though they did not pose security threat to the Marriott network. I think everyone would agree with the FCC position here. Some may bring up the hotel Wi-Fi performance degradation issue due to personal hot spots, but Wi-Fi operates in the public spectrum and does not guarantee performance in the first place.
What May Have Tripped Marriott IT
It appears to me that the Marriott's wireless security system violated above mentioned principles stated in the FCC decision. IT must also have been devoid of evidence of any security threats that were created by such hot spots. This could be because their security system did not audit the occurrences of the threats or was not able to identify the threats from the innocuous wireless activity in the public spectrum. So, the system indiscriminately blocked the non-Marriott Wi-Fi access points detected at the facility, which also included the personal Wi-Fi hot spots.
"Among other features, the system includes a containment capability that, when activated, will cause the sending of de-authentication packets to Wi-Fi Internet access points that are not part of Marriott’s Wi-Fi system or authorized by Marriott and that Marriott has classified as “rogue.”
Rogue Wi-Fi Containment is About Surgical Accuracy and Not the Force of Brute
Rogue containment is a powerful feature to improve security of Wi-Fi environments. In addition, for large networks with potentially distributed sites, it is desirable to trigger rogue containment automatically, since manual intervention is impractical. However, if threat detection logic in the Wi-Fi monitoring system is fraught with false alarms, it disrupts benign neighborhood and personal networks. Safe rogue containment requires accurate threat detection logic in the Wi-Fi monitoring system to ensure security in compliance with the rules of the unlicensed spectrum.
[Tweet "Understanding FCC decision regarding Wi-Fi containment at Marriott"]
Past presentations and blogs by the author on the topic of rogue Wi-Fi detection and containment: