He stands out from the crowd of government workers, techies and managers at the annual ICE ("Inspire. Connect. Educate.") Technology Conference here.

Dressed mostly in black, and a bit younger than the average delegate, he lurks near the entrance of the conference room as several hundred delegates file in, fiddling with his computer gear.

Then, when it's his turn to speak, Brad Haines shocks many with what he's discovered about their wireless devices. People throughout the room reach for their laptops, cellphones and PDAs to turn them off. "I've personally discovered over 140,000 devices in North America, about 70,000 in the Edmonton area alone," he boasts. "In fact, I've stopped counting."

Haines calls himself "Edmonton's local wardriving geek," a reference to his favorite hobby of looking for networks and devices that are broadcasting their presence to the world.

Tom Keenan, Business Edge
Brad Haines and TeddyNet are ready for action.

He directs the audience to the website www.wigle.net which, at last count, had tracked 7,910,944 access points around the world, complete with their exact locations. Sure enough, zooming in on the interactive map of Edmonton produces a dense cloud of access points with names such as poohbutt, Zeus and Henry the Network, but also, ominously, Accounting and Epcor, an Alberta utility company.

Not that anyone is saying major corporations have their networks sitting out there ripe for the picking, but at least they're discoverable by anyone who cares to look.

While Haines may look out of place at a mainstream computer conference, he fits right in at the notorious "hacker cons" such as Defcon and ShmooCon.

He proudly displays TeddyNet, an electronics-packing teddy bear that went to DefCon 2006 in Las Vegas. If you cover up the wire it looks pretty normal and, hey, there are far stranger people walking around DefCon than a grown man carrying a plush animal.

Haines speaks with reverence about "Simple Nomad" (aka U.S. computer security whiz Mark Loveless), whose ShmooCon presentation, "Hacking the Friendly Skies," is still causing waves and is archived at his Nomad Mobile Research Center website (www.nmrc.org). The author claims that the ban on using electronic devices during takeoff and landing is simply about keeping the aisles clear in case you need to evacuate, so "it's the same reason you have to stow your tray table and put your seat in its full upright position."

Once you are allowed to turn on the computer, Simple Nomad suggests you use it to sniff the plane for other laptops that are turned on. Having found another computer, he outlines devious ways to take it over, basically exploiting bad design in the way Microsoft Windows XP deals with wireless networks.

The ultimate purpose? To pass the time on the flight making other people's computers display mildly pornographic images or play embarrassing sound files such as "how much for a quickie in the lavatory?" during the drink service.

Like many in the hacker community, Simple Nomad exhibits that interesting blend of mature sophistication with technology and a totally infantile sense of humor.

Of course, if he can make your computer play rude files, he might also peek at your data files - especially if you have "open shares.”

And that can be a worry. I accidentally turned on my computer's wireless on an Air Canada flight and was astounded to find another onboard machine happily broadcasting the ID "Department of National Defence.”

That's definitely someone who should be putting his or her "enable wireless access" switch in the "off" position!

In his presentation, Haines calls Bluetooth "the forgotten wireless," because many people forget they even have it. Sure enough, he's been running his detection tool on the audience and calls out the names of a few embarrassed people. "Better turn off that PDA," he suggests.

Never underestimate the childishness, or the danger, of people with a little hacker-type knowledge and some time on their hands. A website devoted to BlueJacking (sending unwanted messages to Bluetooth-enabled phones) tells you how to fire off messages such as, "I like your pink top" to unsuspecting phone users.

But they could equally do BlueSnarfing, the clandestine grabbing of data off laptops, cellphones and PDAs via their Bluetooth connectivity.

"Many people who have taken pains to secure their computer's WiFi have totally ignored the Bluetooth connection, leaving open a back door into their computer," Haines explains.

They can even come in via Bluetooth, then jump across and go out on the WiFi connection. There have also been reports of Bluetooth-enabled phones making calls to expensive premium numbers without the owner's knowledge or consent.

Haines gives some practical advice to people who are concerned about wireless vulnerabilities:

* Read a lot. There is indeed plenty of information on the various wireless security forums. People who discover new vulnerabilities and back doors generally can't resist telling the world about their brilliance, unless they plan to make a fortune by selling the secrets to some rogue state.

* Try the tools, since it's useful to know what your opponents have in their arsenal: Haines calls Kismet a free, very effective tool for Linux operating systems and notes that there's now a Windows version called Kiswin.

* Hire a professional, since of course it's hard to keep up on everything in the fast-changing world of wireless technology if that's not your full-time job. This may sound a bit self-serving, since Haines does this kind of work and notes on his website that he "cleans up quite nicely for corporate work."

But he certainly knows his stuff. He's the co-author of RFID Security as well the just-published Kismet Hacking, both from Syngress Publishing.

But most of all, Haines implores the audience, "do something, because if you don't secure wireless you might as well drag a big network cable into the parking lot and say, 'connect to me.' " (Tom Keenan is a professor at the University of Calgary and an expert on technology and its social implications. He can be reached at keenan@businessedge.ca)