In addition to the $600,000 civil penalty, Marriott will have to cease blocking guests, hand over details of any access point containment features to the FCC across its entire portfolio of owned or managed properties, and finally file compliance and usage reports each quarter for the next three years.
I had to support the IT functions of a corporate event at the Gaylord Opryland convention center ~18 months ago. Wouldn't mind joining a class action even if I don't see a dime after attempting to mitigate their wifi interference for a week.
The power of the class action suit is that you don't need to call everyone up. You just need a representative group of clients (which can be quite small) for standing, and evidence and justification to convince the judge to certify a class.
Most folks are not aware they are in a class until they get a letter from the losing company with their $9 check or whatever is left over after lawyer's fees.
It was for exhibitors at the convention hall. That's actually very cheap so far as these things go. You should see what they charge for a trash can or a chair.
FWIW I have seen this in practice at other convention centers (not owned by Marriott). We attended a convention (as an exhibitor) this year in MN and had to spend $10k for 3 days of Internet connectivity over WiFi. Your choices were to pay (this was the cheapest plan, others went much higher), or use your own. If they caught you using your own, they would block you and shut down your booth at the convention.
Their rationale/justification was that because WiFi at scale (40k attendees, couple hundred exhibitors) the MiFis and other hotspots are using the bandwidth that the exhibitors have paid (a lot of money) for and caused issues with their demos (which the attendees paid entry fees to see).
Convention centers operate in the world of unrealistically high pricing that is rarely seen outside of airport newsstands . For example, they wanted to charge us $3k for renting a 42" TV for 3 days. We ended up just buying a 27" Thunderbolt display and saved a ton (and had a nice monitor to give to one of our devs after the show).
> the MiFis and other hotspots are using the bandwidth that the exhibitors have paid (a lot of money) for
EDITED: In the U.S., all RF bandwidth is administered by the FCC for the benefit of the public. AFAIK, even if there's a "traffic jam" in the local WiFi spectrum, private parties don't get to unilaterally block off the WiFi bandwidth and charge for access. That'd be like a shopping mall's dealing with its Black-Friday traffic jams by setting up toll booths to block the adjoining public highways and charging vehicles to go through.
(My original comment referred to cell-service bandwidth, which of course isn't the only problem, as @coleca correctly points out.)
Universities, large corporations, and other building owners frequently disallow "pirate" WiFi and a there are very popular and expensive network security products built for identifying and triangulating pirate WiFi hotspots.
It is the right of universities and employers to disallow WiFi hotspots as a condition of being on the property. Why shouldn't this apply to hotels?
If I understand correctly, there's a difference between saying "If you run a hotspot here, we will find it and eject you for violating our terms" and "If you run a hotspot here, we will interfere with its operation"
The first one is perfectly okay, your private property, your rules, the second is in violation of the law.
This device complies with part 15 of FCC Rules.
1) This device may not cause harmful interference.
2) This device must accept any interference received,
including interference that may cause undesired operation.
Sounds like the transmitter would be in violation of part 1, then. And I guarantee it's got a sticker along those lines somewhere on it.
My understanding of #2 in rule is that it's meant to protect against incidental interference causing complaints to the FCC. If the ham operator across the street makes your TV/dental fillings act weird, you can't ask the government to go shut him down.
In any case, it also probably depends on the precise legal definition of "interference", "must accept", and so on.
> It is the right of universities and employers to disallow WiFi hotspots as a condition of being on the property.
Citation, please? This is an area of the law with which I'm not too familiar.
I do recall from dim memory that private-property rights aren't without limits. For example:
+ The (U.S.) National Labor Relations Act puts limits on an employer's right to prohibit employee collective action on the employer's property;
+ Similarly, various civil-rights acts prohibit the owner of a business from refusing service to people on impermissible discriminatory grounds (race, national origin, etc.);
+ [ADDED:] Anti-trust law places limits on a business owner's ability to say, for example, I'll sell you my patented photocopier only if you agree to buy all your unpatented paper from me as well.
[EDITED:] I'm not saying the first two laws apply in this case. I am suggesting that anti-trust law, and perhaps federal communications law, might analogously limit the ability of the owner of a business to require guests, as a condition of admission, to forego their lawful access to the public spectrum. That practice seems roughly analogous to the conference company saying, "you can attend our conference, but only if you travel to the conference center in one of the expensive private limousines that we've arranged for, instead of in a cab."
Or, you can travel in our limousines, which will drop you at the front door, or instead, you may arrange for a cab, which may only drop you off at a designated cab dropping location, conveniently 3.2 miles away from our front door down at the bottom of the hill.
Are we going to treat WiFi according to airspace protocol? Can a company or operation claim ownership to a quasi-physically-contained airspace? Perhaps invoke claims of trespassing by other non-approved, non-financially viable, sources? If you're living/working/visiting under my roof, then my rules, my WiFI.
>Because (1) a jammer is an unlicensed transmitter and (2) jammers do not just jam with discretion they jam for as far as they reach and it is impossible to operate a jammer in such a way that you cover all the territory without extending beyond it in some places.
Jammers can interfere with people's ability to contact emergency services. Obviously in the case of WiFi this is not an immediate concern because 911 is currently reached through a different wavelength, but WiFi is integrating into infrastructure (WoT, etc...) such that jammers can be a real cause for concern (especially if they are operated by poorly trained people).
>If you're living/working/visiting under my roof, then my rules, my WiFI.
What about the scenario where you have an ISP that offers city-wide WiFi to its subscribers. A Marriott is within the bounds of this area, they block access to a service I pay for and they have approval to provide me with. Who is in the wrong?
> Can a company or operation claim ownership to a quasi-physically-contained airspace? Perhaps invoke claims of trespassing by other non-approved, non-financially viable, sources? If you're living/working/visiting under my roof, then my rules, my WiFI.
That's one way to look at it. But it doesn't square with an important fact, namely that under U.S. law, you don't own the RF spectrum, even though RF waves happen to exist "on" "your" property.
Keep in mind that in a civil society, property ownership and the autonomy that goes with it are largely social constructs that can and are limited by the rest of us. Marriott might imagine that it "owns" a conference facility and can do what it wants with it. Certainly for most purposes that's a reasonable approximation of the truth. But: Marriott gets to exclude, say, Alice from walking into the conference facility, not by virtue of some natural right, but solely because the rest of us have tacitly agreed that our police and, ultimately, our armed forces will back Marriott up if it chooses to do so.
(That is, of course, unless Marriott happen to have access to a militia or other armed force; @Rayiner has written about related topics in other threads here.)
And whether Marriott likes it or not, the rest of us, via our duly-elected or -appointed representatives, have decreed:
1. that the public airwaves are no one's private property; and
2. that in certain circumstances, "tying" arrangements, in which a seller requires a purchaser to buy an unwanted product or service B as a condition of being able to buy wanted product or service A, are unlawful --- that is to say, the seller's autonomy in respect of its goods and services only goes so far. [1]
It's therefore not an incoherent argument that Marriott may not require Alice, while in the conference facility, to use only Marriott's expensive WiFi network, as opposed to using, say, the phone in her pocket as a WiFi hotspot of her own.
>It is the right of universities and employers to disallow WiFi hotspots as a condition of being on the property.
You may be confusing a wifi hotspot with a wifi router. It's certainly reasonable for the owners of a physical network to disallow users to plug in their own wifi routers, especially because it can cause problems, even potentially taking down the entire network with loops and rogue DHCP servers. There are ways the owner can prevent those problems, but it comes at higher cost of equipment
I don't see why a hotspot would be any different than a mobile phone. Some places tell you to turn them off, because it interrupts the movie, and they may ask you to leave if you don't. But they don't jam phones and provide high cost alternatives.
Yes but that's about controlling access to their own network. They don't ban you from operating a wifi hotspot using a 3G-connected device like a mifi or a phone with tethering.
Because (1) a jammer is an unlicensed transmitter and (2) jammers do not just jam with discretion they jam for as far as they reach and it is impossible to operate a jammer in such a way that you cover all the territory without extending beyond it in some places.
I was doing some research work in a downtown building that was next to a hotel a couple of years ago (not a Marriott) and I couldn't use my laptop next to the window because the hotel wifi seemed to swamp everything else. This wasn't such a big inconvenience and at the time I assumed the wifi of the place I was in was just not that great to start with, but with hindsight it might well have been a case of unlawful interference.
At my university, it was against the rules to plug WiFi routers or AP's into the university's network. The reason for that was that it's a huge security risk to allow anyone to run an AP on the network - if it's not configured correctly, it could allow unauthorized, open access to the network to malicious third parties.
You say it's a security risk "if your AP isn't configured correctly." It would be much more accurate to say "if the university network isn't configured correctly."
If you expose unrestricted access to sensitive stuff to everyone on the dorm ethernet, sinister wifi hackers on the sidewalk outside is the least of your worries. Your university IT was trying to cover their incompetence with random authoritarianism.
University networks generally implement 802.1x, WPA2/EAP, MAC registration, and similar authentication schemes so that every device is tied to an authorized user and malicious activity can be traced to a real person.
When a network device is attached that doesn't pass this authentication requirement onto its users (i.e. by NATing, or offering a public or common-key WiFi network) the university loses its ability to see who is doing what, and to deny access to people it doesn't want on its network. IT departments don't like that.
The security risk is not so much that you can now route certain internal IPs, but that IT has no way of determining who you are, or even your real MAC address, if it has questions about or objections to your traffic (whether
Hopefully no one is placing sensitive services on the same network as dorm rooms with no security, but being on the LAN is often used as a front line. For one thing, sitting on the right part of the campus network gets you access to most scientific journals based on IP whitelisting. The University is contractually not allowed to provide this access to people who aren't students/faculty/staff, so it has to control who can come from those IPs. We operate separate SSIDs for guests that route to the internet through IPs not in the whitelist. We also have certain intranet-only services like Facilities work orders, printing, etc. that could be on the public internet, but don't need to be, so better to those aging, likely vulnerable applications behind a layer than not.
Doesn't really have to be expensive; OpenBSD's hostapd can do this easily; take a look at `deauth` and `hopping` keywords at http://mdoc.su/o/hostapd.conf.5.
Likewise, it's probably trivial to ignore these deauth packets if you're running your own boxes (although it'll probably be more problematic if you wanted tablet / phone access, too).
I agree with you, but I was talking about the WiFi bandwidth not your 3G/4G bandwidth. There is only so much airspace for all that WiFi traffic when there are tens of thousands of devices using the same spectrum in such a small enclosed area.
Well, that's the downside of using an unlicensed band. Nothing says you can't get a license for a restricted band and set up shop there, then the FCC will help you shut down interlopers instead of smacking you down when you try to do it yourself. Of course, getting the appropriate equipment will be highly troublesome, but so it goes when you want to control what people transmit.
I imagine that a contract that says, "You won't run a hotspot, and if we catch you doing it, we'll kick you out" would be fine. But actually jamming the radio signals would not be.
They weren't using a radio jammer, but using techniques just like were described in the article. We tried getting our gear setup and couldn't get anything working, even trying to use Internet connection sharing over Wifi between a Macbook and an iPad right next to each other wouldn't work. Until we got a hold of the network engineer for the convention and got him to whitelist our MAC addresses on their own APs. Then all of a sudden all our gear sprang to life. He told us they were looking for rogue APs and were sending frames to their clients to disassociate. If you were an attendee and not an exhibitor you could use the free public WiFi that was available. But we were warned that was far too flaky to use for product demos and would require re-registration every hour.
We also had to use commercial grade APs (like Cisco, Aruba, etc.) that could have the signal strength turned way down so it wouldn't bleed too far out of our booth. The WiFi APs at your local Staples don't usually have this option; they only boost the signals, not lower them.
> that act of "forcing them to disassociate" would count as interference... and be rather illegal if it went to court.
i think if a teenager did it to the Marriot then a closest DA or an FBI office would be immediately having the teenager on "unauthorized access" at minimum if not on some nice terrorism charge
Buy a dozen Raspberry Pis with cash, configure accordingly, wander around Marriotts dropping them in inconspicuous locations (keep an eye out for cameras), leave.
Congratulations, first DDOS of a geographical site instead of a virtual one. :P
Note: This is kinda a dick move because you're probably screwing over the customers more than you are the IT douchebags. Maybe a better plan is to find the Marriott headquarters, mockup a visitor badge, and do it there.
I've even thought about this to more devious levels. Cut a portion of drywall out in the hotel room and seal the pi back up in it (Jacking into the power lines somehow of course) good luck finding it.
Thanks, that's really interesting, especially the report of how it looked from your end. I imagine if I was staying at a hotel that was doing this, I'd be driven absolutely mad when my stuff didn't work and I couldn't figure out why.
I work conferences, and this is totally true about unrealistically high pricing. Although I've never seen paid WiFi... there's usually 2 sets, a public Wifi, and a Wifi for internal for demos.
At CES, the company I worked for actually piped wireless signals directly from antenna to antenna with coax cable (or whatever it is that carries the signals from wifi) in order to reduce/eliminate the interference from thousands of other nearby devices.
Their rationale/justification was that because WiFi at scale (40k attendees, couple hundred exhibitors) the MiFis and other hotspots are using the bandwidth that the exhibitors have paid (a lot of money) for and caused issues with their demos (which the attendees paid entry fees to see).
These high-end WiFi systems are expensive to install and administer. But that those prices they were charging, they've paid for the system in, like, the first day. Maybe by lunch time.
I don't think what they did to you guys was legal:
"“Consumers who purchase cellular data plans should be able to use them without fear that their personal
Internet connection will be blocked by their hotel or conference center,”"
Get few of them, borrow to neighbouring stands, charging fairly for data usage, sell them after event. Congratulations - you just made few friends, some good karma and flipped off convention organizers, all at the same time.
Given the shitstorm they threw when they caught me carring a small mat to my booth (turns out I need to pay $100 and wait an hour for one of them to carry it), I can imagine what they'd do if they found cables between booths...
On one hand, if it was jamming guest Wifi in hotel rooms it seems Marriott was acting badly. On the other hand, if this is in the context of trying to provision wifi for a conference, where there may be a lot of users packed into a dense space, I'm not so sure it's as bad. Wouldn't outside Wifi routers be fairly disruptive where you're maybe configuring individual conference service routers to lower their power -- to essentially get smaller than normal wifi range 'cells' and serve more users?
The problem is that the FCC says that you can't interfere with legally-operating radio systems. Since conference-goers' Wi-Fi hotspots are operated and licensed under FCC regulation, the hotel had no legal right to block them.
So legally Marriott was wrong, but from a technical implementation standpoint does this policy lead to fewer users being able to connect to Wifi at a conference?
Are the regulations in this case meeting the end goal of the FCC - that good use is being made of the RF space?
You might be right, technically, but I'd much rather have the situation where no parties are allowed to interfere and manufacturers have incentive to develop sharing-friendly systems (spread spectrum, etc.), than the situation where entities can block my Internet access for their own convenience.
Were that not the case, I could enter an arms race with my neighbors where we all compete for the strongest Wi-Fi blockers so that our own signal is strongest, perhaps to the point that one of us might get a business-class connection and start allowing paid access to it. "Too bad our block can't use Wi-Fi. Say, neighbor, for $100 a month I bet I could let you share mine."
Exactly. This is the whole reason for the FCC's existence. It's only a popular misconception that their primary job is preventing the display of unwanted nipples on TV.
The FCC has to look at use of the RF space as a whole. Blocking Wifi inside a conference center is a good use of RF space for the purposes of the conference, but it's arguably a local maximum - if blocking technology were to come into widespread use the overall environment would be highly degraded. Suppose the landlord of the apartment building next to me wanted to squeeze out a little more rent and offered fast powerful wifi for all his tenants (blocking any attempts by the tenants at establishing sharing), but degraded the wifi in my house at the same time as an unfortunate side-effect.
One of the regulations of using the ISM bands is that you must not cause interference with other devices. In the case of wifi, this is achieved using both collision detection, and noise immune modulation methods.
Most of these mobile hotspots are going to be limited by the cell connectivity, not the wifi speed, so it would be pretty easy for multiple APs to exist on the same channel.
What I find interesting is this isn't jamming of the radio signal, but protocol-level interference by sending deauthentication packets. I find it a little concerning that the law is interpreted this way since it could give the FCC a very broad jurisdiction.
If you look on the back of your wifi gear, you'll likely see a stamp that says something to the effect of:
"This device complies with FCC part 15 and will not cause harmful interference".
The argument could be made that by using the device to send lots of deauth packets, that Marriott had modified the device beyond it's original scope, and was now using it to cause harmful interference (to other wifi devices).
The FCC is responsible for allocating what can be broadcast on any given frequency. It is well within their jurisdiction to say that such broadcasts must comply with standard protocol X plus additional restrictions.
This is really interesting - the college I went to used this kind of technology to prevent students from spinning up rogue hotspots. In fact, it is a pretty common practice. Anyone know if this law extends to that use case or if Marriot was doing something different?
Your college is mitigating what it considers an abuse of its network.
Mariott is, in effect, preventing people from using the cellular service they pay (a carrier) for. Except, instead of attacking the cellular part, they're attacking the WiFi part. But, in effect, it's very close to jamming cell phone calls.
> Once a rogue client is detected on the wired network, the network administrator is able to contain both the rogue AP and the rogue clients. This can be achieved because 802.11 de-authentication packets are sent to clients that are associated to rogue APs so that the threat that such a hole creates is mitigated.
Looks like the Cisco AP sends these deauthentication packets over wireless, it doesn't cut off the rogue AP from the network by filtering it or disabling a switch port. The rogue AP is certainly bridged to your network, but is the association between the clients and the rogue AP part of your network?
That doesn't look good. It is mentioned near the start about potential issues:
> rogue containment usually introduces legal issues that can put the infrastructure provider in an uncomfortable position if left to operate automatically.
The FCC also says selling these things is illegal:
> Federal law prohibits the operation, marketing, or sale of any type of jamming equipment
There might be a legal workaround in the case of unauthorized devices, as I doubt Cisco's legal team would allow such a feature if there was not something to base it off of. It is concerning though...
If you or I got caught doing it to their systems, we'd probably go to jail. But when they do it to us, they get fined a few days' profits. Lovely double standard.
Except the corporation didn't do anything. And actual, living breathing human made a deliberate and criminal choice. And that dude belongs in jail.
Or rather,"those dudes". A good prosecutor would start at the bottom and work his way up the chain of command, not stopping until he reached the highest level person who was aware of this without immediately moving to shut it down. Then he'd throw the book at they guy.
Conference organization is a small world. Word would get out fast, and that really would be the end of it.
First of all, why not? If a corporation does something that would be worthy of prison in an individual, shut them down for a period of time as punishment.
Second, even if you accept that, you could at least fine them an amount that will cause harm, rather than an amount they'll barely notice.
Let's say a Mariott bus driver was caught racing down the freeway at 100mph in a company vehicle. Do you also wish to shut down Marriott, Inc for this offense? This is actually putting _lives_ at risk. Much more jailworthy than some mid-level manager's decision to violate some FCC rules, right?
If the corporation itself is not responsible, then the individual should be punished. If the corporation is somehow responsible (for example, they have a long history of systematic and deliberate violations with supporting policy), the corporation should be punished.
Here, neither is happening. The individuals responsible are, as far as I can tell, being completely let off the hook, while the company gets a completely trivial fine.
Why do you think that $600k is not commensurate with the offense? It may be a significant part of that business unit's income. It may be 10X the amount of revenue they obtained by breaking this particular law. It may have resulted in some people getting fired - possibly people who didn't even realize they were doing something illegal. Hell, there are at least a half-dozen switches I could flip in DD-WRT that will violate FCC rules and I have no idea which ones are which.
I don't know this, nor do you. The people that do know this are the prosecutors in this case, and they considered that $600k (and the rest of the consent decree) was punishment that fit the crime. Unless you have some special knowledge of this particular case, I don't see why you are in a position to second guess them.
There's a long history of wrist-slaps for huge corporate crimes. Two recent examples are BP and Bank of America, both hailed as massive, unprecedented fines for massive crimes, both of which barely hurt either company.
Proportionally, my cost for merely retaining a lawyer would affect me more than a $600,000 fine affects Marriott. Never mind the fact that I would probably go to jail and lose out on months or years of salary, not to mention freedom.
There's an odd disconnect between people who on one hand say "corporations are not people!" and then on the other hand anthropomorphize them as if they were a child who needs to be spanked. You can't compare the punishment of a corporation with the punishment of a human, because corporations are not people. They don't have minds, they don't "feel bad" for what they have done, they can't sit in jail and regret their decisions. The best we can do discourage unwanted behavior in the future.
Will this particular remedy be effective at preventing the behavior in the future, both from Marriott and other corporations? The prosecutors seem to think so, you think to seem not. You've given me no reason to trust your judgement more than theirs.
Well, you've given me no reason to trust their judgment more than my own, so unless you're making a "trust the authorities, they are Your Friend" argument, I don't really see the point of repeating that.
How would you block wifi then? Sending deauth frames is the only way to contain a rogue AP without physical access. Generally these systems are used to enforce corporate network security policies by making sure Joe in accounting can't breach your top-secret network by plugging in a $25 wifi router so he can use his iPad on the office network.
I'm not sure what the legal standing is once you get to publicly accessible spaces like colleges, stadiums, conference centers, etc.
This is a specious argument. The company is free to enact policies prohibiting the use of their own network in an unauthorized manner and enforce it in a legal way ( instituting the penalty of immediate firing usually works well). They don't have the right to jam public airwaves to enforce these rules.
Fascinating... wouldn't this be illegal? It falls into laws regarding hacking and network disruption. They're joining another network, and interfering with its activity.
If the reverse was happening, say a hacker was going through and deauthentication jamming THEIR network you can bet they would call the FBI.
Just in case it's not clear from the link/comments, the "jamming" happened at one convention location (Gaylord Opryland Hotel and Convention Center in Nashville, Tennessee).
It seems that the convention center was blocking mobile hotspots in an effort to control the Wi-Fi traffic in the center, possibly so that they could charge for their in-house Wi-Fi. This doesn't seem to have been a widespread issue or an issue for hotel guests.
However, I suspect that this is a common practice among convention centers and that the main point of this action by the FCC was to put everyone on notice that this is not acceptable behavior.
I find it ironic that it's always the expensive hotels that charge for wifi while the cheaper places mostly give it away for free. I guess business customers are more happy to pay since they can expense it.
I read somewhere (HN, maybe?) that the high-end hotels were the first to adopt, before the market for these things was well fleshed out, and often ended up in absurd, long-term contracts with 3rd party services/providers.
That, combined with the fact that, yes, businessfolk will just expense it, leads to the current situation.
I used to work for a fairly large hotel chain that would charge ridiculous amounts for internet. Thinking back it wasn't too ridiculous (certainly not 10k for 3 days as someone said above) but it was still a high price.
The only people to really use the service were business people, and they'd always charge it back to their companies.
The WiFi itself was merely a luxury we offered to encourage business people to stay in the properties because "WiFi available" made for better advertisements.
The "10k for 3 days" is not the type of charge for a guest using wifi in a room. It's the type of charge for a large event using wifi in the hotel's convention/conference center. And that number is not so far off what a lot of places charge for such things.
I regularly help run events which have 500-ish people on the extreme low end, and 1000-1500+ and sometimes even larger on the high end. The quoted rates do not sound that far off from what I've seen.
Heck, I know one convention center that charges $1500 just to hang a small banner over the door of the ballroom with your event's logo on it.
Aside from the specifics of wifi, this is the way hotels work. Going higher up the chain means you get more employees, better location, better fixtures, and better amenities. Those amenities might include a real health club, a real restaurant, and a real bell hop instead of a room with a treadmill, a counter full of grocery store pastries, and a cart with wheels on it. In order to stay cost competitive, the fancy hotels don't necessarily charge everybody to use the amenities, they just charge those who use them. (You could substitute "overcharge" in that last sentence depending on how you feel about hotel chains.)
couldn't agree more. When I think of high end, I think of 'all inclusive' and other marketing speak intended to convey a sense of worrylessness, just pay and forget. And then they charge for checking email...I guess they probably know that someone looking to spend twice as much on a room (at least) is probably not bothered by a bit more for internet, but it seems like they should just tack it on to the rate if they are determined to squeeze out that tiny bit more revenue for internet. Granted, I don't know what their margins look like, maybe thats where they come from althought that would be pretty pathetic. I suppose if that is a decent way of adding margin, they can slightly lower their rate but given that most of their peers are probably in the same boat I can't quite reason why they wouldn't just include it.
Because most people shop hotels for the room price, not for the Wi-Fi price. I've been bit by this a couple times simply because I forgot to check and see if the hotel I'm staying at offers free Wi-Fi.
Simply to charge business clients more. The people behind these businesses are really archaic in their thoughts-- typically its the world's worst manager operating on the world's tightest budget and the service staff have to try to hold everything together.
I stayed at a Hilton in the UK and they had a 1L bottle of water on the desk in the room, with a little price tag on it: £3.95 (~$6.50). I thought it was very sneaky - guests are used to paying for things in the fridge but not those left out on the desk.
That's a fairly common practice throughout Europe and even in some part of the US (e.g. Vegas). You can even request certain brands of water be left in your room from their water menu.
As long as they clearly label them as a cost+ and provide you those dinky plastic cups you can drink tap water with, I am happy.
3 euros, 3 pounds sterling, or 3 dollars is common. I guess the US wins in the "over-priced-water-in-your-room" war. There must be something magical about the $3 price tag.
Hm, I assumed it was an American chain or 3-5* hotel thing. I've stayed >100 nights in hotels in Europe and only seen paid bottles of water perhaps a handful of times. I guess we stay at different kind of hotels.
Much more exciting have been the freebies (zero status/independent hotels): chocolates, biscuits, wine, platters of local delicacies, fruit baskets, free non-alcoholic mini-bar replenished daily... :-)
The same over here. I stayed at a DoubleTree (also a Hilton hotel) in Monrovia CA a few weeks ago. They also had a bottle of water on the desk with a $5 USD price tag.
Ironically, they gave me at least $5 worth of chocolate chip cookies when I checked in.
It doesn't seem that ironic to me - it doesn't really follow that a more expensive hotel would be more affordable when you arrive. The bar, restaurant, etc. are all more expensive, too.
That analogy breaks because the bars and restaurants are also much nicer, while the wifi at expensive hotels is no better. The better analogy is with basic toiletries, cots, and similar items of fixed quality where they really are more likely to be comped at a more expensive hotel.
Given the FCC's argument against Marriott, wouldn't it be illegal for Cisco to sell this now? (I'm not a lawyer, but 47 U.S.C. § 302a(b) makes it illegal to manufacture, import, sell, offer for sale, or ship noncompliant devices, and that document describes a feature whose specific purpose is to interfere with WiFi.)
IANAL but, it is kind of a grey area. That functionality is only designed to be used on a device which is attempting to spoof you (i.e. a device already disrupting WiFi).
So is it a disruption feature if in effect it neutralises disruption when used correctly? As I said, it is a grey area.
Interestingly enough, Cisco's own docs mention that there are some legal issues, especially when used against neighboring networks:
> "Containment can have legal implications when launched against neighboring networks. Ensure that the rogue device is within your network and poses a security risk before you launch the containment."
The wording in the FCC Consent Decree in this case suggests that this feature would actually have been okay if it was being used against actively hostile networks:
> "Specifically, such employees had used this capability to prevent users from connecting to the
Internet via their own personal Wi-Fi networks when these users did not pose a threat to the security of the
Gaylord Opryland network or its guests."
That's my take on it as well. Per the linked docs, the only modes natively supported are:
- Rogue on Wire - If a rogue device is identified to be attached to the wired network, then it is automatically placed under containment.
- Using our SSID - If a rogue device is using an SSID which is the same as that configured on the controller, it is automatically contained. This feature aims to address a honey-pot attack before it causes damage.
- Valid client on Rogue AP - If a client listed in ACS is found to be associated with a rogue device, containment is launched against that client only, preventing it from associating to any non-managed AP.
- AdHoc Rogue AP - If an ad-hoc network is discovered, it is automatically contained.
The kind of blocking in question here sounds more aggressive than any of these categories. Though it's certainly possible they were using some other vendor's gear which has additional options.
The AdHoc Rogue AP sounds very much like what they were doing; which may be reasonable in some contexts, but it would seem not to be in semi-public building.
One of the important issues here is that wireless communication doesn't respect boundaries. It seems they could have easily been interfering with networks on neighboring properties.
Knocking down an AdHoc AP of two guys privately playing Starcraft on a LAN would likely be against FCC policy, for example, and automated AdHoc containment is dangerous unless you can identify the source, as it may not be part of your network or operating on your equipment.
One thing I'm curious about: If it's just actively jamming hotspots that got the hotel in trouble, couldn't hotels instead use physical materials to construct conference centers with limited signal?
Like, I know whenever I go into my local supermarket, I'm lucky if I can get a signal once I venture past the front door. There's no active jamming going on; it's just the way the building is constructed (I assume).
If hotels really want to force their own Wi-Fi on people, couldn't they do the same thing -- make use of physical impediments?
That would also block cellular signals. Which might be a detriment or an additional "feature" depending on your perspective.
I personally wouldn't book a conference center which didn't allow the use of cellphones. Just too impractical as a lot of people use them as de facto 2 way radios (e.g. the people setting up booths, employees of the conference center, security, et al).
If word got out that a conference center was passively blocking cell phone signals by design, I'd venture that the business would pretty much dry up to zero.
Yes the hotel could do these things and the FCC probably wouldn't care since it's on their own property and doesn't affect anyone else.
However, when you start jamming other people's signals that's in direct violation of FCC regulations, so of course the hammer is going to drop. I'm really glad it wasn't just a token slap on the wrist. FCC made it clear that they are serious about this.
At the very least, it's a lot more money than they made renting wi-fi access during the event in question. Therefore, this behavior is unprofitable and will stop.
It's also enough to get the people who decided to do this fired.
It'd be about break-even if they have a convention each week, and get 25 exhibitors pay $500 each. So if they had a lot of exhibitors they convinced to pay, they could have easily made a profit after the fine.
The fine was small. Getting that money back is the job of a class-action lawsuit as suggested elsewhere.
The other conditions of the decision put a stop to the activity, and require them to report on compliance for three years. That will be more onerous than writing a check, and may convince them to stop being such greedy dickheads.
It isn't really in their interest to have cell phones not work in any of their conference rooms. I imagine a lot of people (and businesses) would very quickly start booking elsewhere if they did that.
Most hotels that host business meetings or have many business travelers will install small cell distributed antennae systems to boost cell and data coverage because business travelers who don't have service in the rooms won't come back to the hotel.
>>> There's no active jamming going on; it's just the way the building is constructed (I assume).
You're correct there. Cell signals don't play very nice with concrete and steel. It also depends on who your carrier is and what technology their using.
Verizon uses CDMA, which uses a lower frequency (around 800MHz) which gives you better building penetration, as opposed to say T-Mobile that runs on higher frequency (1.9MHz) which tends to have issues getting through all that concrete and steel.
Slight correction, CDMA can be on any frequency. Verizon uses lower ones because they could afford to outbid everybody else for the licenses from the FCC.
This seems more like a slap on the wrist than anything. Especially since they were charging guests up to $1,000 per device to connect to the internet. Wow.
Edit: That's the $/connection point not $/guest. That's a bit more reasonable then.
I don't think it's a slap on the wrist at all. The $600k is probably not a big deal, but now they will have to figure out a process for verifying and reporting compliance across all their US properties. That's likely going to cost a hell of a lot more than the actual fine.
Honestly, I figure that just the initial analysis of what they need to do will cost them that much before they actually start hiring personnel and putting the preventive actions in place.
Then factor in all the bad press they will get from this and the final bill will be well into the millions.
Just to be clear, it was $250 to $1,000 per hotspot/AP that they were charging, not per device. (That is, if your convention needs 3 hotspots, presumably you would pay $750 to $3,000, no matter how many people connected.)
Considering a conservative estimate of $1000/week for a single year across a dozen hotels is already over $600k, this fine is particularly really meaningless.
Again, this is not the type of charge for guest-room wifi. This is the type of charge for convention/conference center wifi, where an event wants to do something like live streaming. Typically the most cost-effective option is for the event to bring its own gear with a high-speed cellular connection; the conference/convention facilities at this Marriott were actively jamming such gear to force use of the Marriott's own connectivity at high prices.
Interesting that sending de-auth packets to shut down rogue (from Marriott's viewpoint) wireless access points resulted in this fine. I mean, this is a standard feature of your average wireless intrusion prevention system. We have something similar set up to control unauthorized or inappropriate network access, because end users attaching their own networking equipment (and breaking our network as a result) is a real problem for us.
I just checked our Meraki configs, and we don't have containment enabled. If we were to enable it, the only option we'd have would be to disable rogue WAPs attached to our network. That's materially different from interfering with other people's hotspots in my mind.
Is it any surprise that companies act like this? They're rarely punished for malfeasance, and when they are the penalty is barely noticeable.
It's like putting someone in front of a big trough of money and allowing them to take as much as they want, with the caveat that every few months they will get a mosquito bite.
This makes me very happy. Even though the amount is fairly small, the ruling establishes a very clear precedent on what is and is not acceptable. I think it would definitely make hotels and convention centers think twice before trying to fleece event attendees with overly expensive Internet connections.
Wow, don't know why, but if feels good, to see FCC (or any part of government), punish someone who is messing with internet connectivity. I must be very naive in this regard but still feels very good.
$600,000 is enough to make the entire venture very much unprofitable. Whoever in the management chain was responsible for this will have trouble meeting their targets, not to mention keeping their job. The PR damage is massive.
The FCC has no place setting fines based on the total size of a corporation. It seems rather proportionate to me, given that they were attempting to profit from willful interference, and that's in the ballpark of how much they probably made. I doubt Marriott, or any other major US hotel chain, will ever attempt this again. Seems to me the punishment worked, without having to get dragged into courts, appeals, and legislation if they had, for example, fined them $1 billion.
The document in question mentions them having over 4,000 managed properties, assuming an average of $1,000/month for each one of those, across the 2 years between October 2012 and now, that's $96,000,000. I seriously doubt $600,000 is enough to make the venture unprofitable.
Even if I'm off by two full orders of magnitude it'd still be $960,000, and it's possible I'm undercutting the truth.
It sounds like they were only blocking connections at one specific property (Gaylord Opryland Hotel and Convention Center in Nashville, Tennessee), which changes the math a bit.
Also, don't forget the cost of doing compliance audits across all of their properties for the next three years, which is not going to be cheap either.
I think $600,000 for this incident makes the net venture still profitable. I'd bet that $1,800,000 for each future incident (assuming treble damages because they'd already been penalized for this once) would make it very unprofitable very quickly.
I'm never sure how to understand fines like this one. I don't believe they actually pay that money. Why aren't there follow-up stories that explain how the payment process was like? Do the deposit the money? They write a check? How on Earth is this enforced? What about transparency? Where can citizens check that the money was indeed paid and how it is being used? With such large amounts of money, corruption must be an issue.
Its crazy to me how this would even happen. I just imagine an upper manager/exec going "Man, if we could only just jam existing WiFi hotspots and force people into our own for absurd prices. Yeah that doesn't sound the least bit illegal whatsoever."
Might be a stupid question, but: how did they do this? I mean their own WiFi must have been operating on the same frequencies (2,4Ghz band as the personal hotspots ), wouldn't a jammer also disrupt their own signal?
/edit: i see, deauthentication packets.
The devices promiscuously listen for MAC addresses, and only send de-auth packets to those which aren't white-listed or already connected directly to it, so any packets they see flying around are targeted.
I'm not surprised. Marriott hotels will do anything for a dollar, including turning off the air conditioning to both of their hotels (4 and 5 star) in Cancun, Mexico (a rather hot and humid location) while denying that they had done so.
they should of used a cyborg unplug hardware anti-surveillance device instead of a jammer: https://plugunplug.net/ it uses FCC approved hardware and blocks devices based on mac-addresses
Source: http://www.slashgear.com/marriott-fined-600000-for-jamming-g...