The results of a social experiment in London suggest that on-the-go Internet users are not being as careful as they should be when connecting to unfamiliar networks. In order to connect to a rigged Wi-Fi network set up by mobile security firm F-Secure, six users agreed to sign over their first born children to the company.
In the experiment, F-Secure set up a “poisoned” Wi-Fi hotspot on a table in Café Brera, a busy coffee shop in London’s Canada Square. To connect to the Wi-Fi network, which the company cobbled together from US $200 worth of parts that included a Raspberry Pi microcomputer, a battery pack, and some rubber bands, users needed to agree to a specially constructed terms and conditions page. Those terms—which, again, six people agreed to—included the following notice: “In using this service, you agree to relinquish your first born child to F-Secure, as and when the company requires it. In the event that no children are produced, your most beloved pet will be taken instead. The terms of this agreement stand for eternity.”
In an accompanying experiment, F-Secure set up the same hotspot at Broad Sanctuary, a public space not far from the houses of parliament. This time, they were testing to see how many people would log on to a public Wi-Fi network with no idea who it was being run by. The answer: kind of a lot. According to a report by the company, 33 devices connected to the Wi-Fi hotspot in just a half hour of operation. From those connections, F-Secure’s rigged hotspot gathered 32 MB of Internet traffic such as Web searches and e-mails sent by passersby. You can watch video of both experiments on F-Secure’s blog.
As for the dozens of folks who shared their information over F-Secure’s cobbled together hotspot, they don’t need to worry about the security of their data this time. “We have not logged any user information,” a spokesperson for the company said in a blog post, “and during the experiment a lawyer supervised all our activities to avoid breaching any laws.”
Presumably, F-Secure does not intend to enforce the clause assigning them custody of users’ children, either.