A pair of Comcast customers has sued the company for turning Xfinity Internet routers into public Wi-Fi hotspots, saying Comcast’s actions pose risks to subscribers and are taken without seeking their authorization.

Plaintiff Toyer Grear and daughter Joycelyn Harris of Alameda County, California, filed the suit on December 4 (PDF) in US District Court in Northern California, seeking class action status on behalf of all Comcast customers who lease wireless routers that broadcast Xfinity Wi-Fi hotspots. “Without authorization to do so, Comcast uses the wireless routers it supplies to its customers to generate additional, public Wi-Fi networks for its own benefit,” the complaint states.

The plaintiffs seek financial damages and an order preventing Comcast “from using residential customers’ wireless routers to create Xfinity Wi-Fi Hotspots without first obtaining authorization.”

The San Francisco Chronicle reported on the lawsuit yesterday. Also yesterday, the court issued a summons ordering Comcast to answer the complaint within 21 days.

Grear and Harris allege that Comcast violated the US Computer Fraud and Abuse Act as well as California laws on unfair competition and computer data access and fraud. They claim that the public hotspots, broadcast from the same equipment used for subscribers' private Wi-Fi networks, raise customers' electricity costs and harm network performance. But they also make what Comcast says is a false allegation regarding network security.

The lawsuit claims that “unauthorized broadcasting of a secondary, public Wi-Fi network from the customer’s wireless router subjects the customer to potential security risks, in the form of enabling a stranger who wishes to access the Internet through the customer’s household router, with the customer having no option to authorize or otherwise control such use.” The suit goes on to say that “upon information and belief, any activity on the Xfinity Wi-Fi Hotspot will appear as though it originated from the Comcast customer’s IP address.”

A Comcast spokesperson told Ars today that this is false, that a customer's private network and the public hotspot "have separate IP addresses." A Comcast FAQ says the public hotspots are "completely separate from your secure Wi-Fi home network."

An article on How-To Geek agrees, saying that “because the public Wi-Fi signal these features provide is treated as a separate connection, you won’t get into trouble for anything anyone does with it. It should be a separate IP address and usage will be associated with the account the other person signs on with.”

Grear and Harris have further complaints, however. “One side effect of this practice is that these wireless routers use more electricity than would a regular router generating only a single Wi-Fi network for the customer’s benefit," their lawsuit says. "This additional electricity usage is a cost born[e] by the unwitting customer.”

The public hotspots also slow down the speed of the customer’s private, home Wi-Fi network by increasing wireless congestion, the plaintiffs claim.

Comcast has previously defended the hotspots, saying they use minimal extra power, do not pose security risks because they are walled off from each customer’s private network, and do not cause any noticeable performance drop.

Comcast also offered a general response to the lawsuit today, saying, “we disagree with the allegations in this lawsuit and believe our Xfinity Wi-Fi home hotspot program provides real benefits to our customers. We provide information to our customers about the service and how they can easily turn off the public WiFi hotspot if they wish.“

Opt out—if you can

Comcast announced the program in June 2013, saying it intended to “create millions of Wi-Fi access points” by adding an “xfinitywifi” SSID to each Xfinity router. This allows any Comcast customer to get online by logging into a hotspot with their Comcast username and password.

Although the hotspots are turned on by default, customers can turn them off by calling 1-800-XFINITY or online at http://customer.comcast.com/. Tom’s Guide published more detailed instructions on how to disable the hotspot a few months ago.

Some customers have complained that the opt-out functionality is difficult to use or broken.

“My ability to turn WiFi off via the 'Users & Preferences' page (does) not exist," one customer wrote on the DSLReports forums. “Calling the 800 number and going to internet support gave me someone who only suggested trying to disable & re-enable bridge mode (which didn't eliminate 'xfinitywifi'). He then suggested I (get this!) read up on the Comcast customer forums on their website as ‘there are constantly updates to the firmware in our modems and this is probably just an update that has an issue at the moment.’”

“Of course there's an easy solution here,” wrote DSLReports editor Karl Bode. “Go buy your own modem and router/gateway, and save yourself both the headache of not being able to control your own devices—and Comcast's soaring monthly hardware rental fees, which net Comcast $300 million in additional revenue per quarter.”

Electricity costs and bandwidth

The lawsuit against Comcast points to a test in June by a company called Speedify that found the hotspot can raise a customer’s electricity $20 or more per year even if the hotspot is always idle. Comcast objected to that test, asking Speedify to test on newer equipment and on the company’s residential hardware instead of its business equipment to get a more accurate depiction of the effect on residential use. "There shouldn't be any discernible difference in the amount of electricity you're using, because your router is already plugged in to do your own wireless in your home," Comcast spokesperson Joel Shadle told Ars at the time.

The plaintiffs claim the "results were even worse" on the re-test. Speedify did say that the new devices used more electricity than the old ones overall, but that there wasn't as much difference between using the router with and without the public hotspot turned on. "The new router under Xfinity public Wi-Fi load only translates to about $8 extra in electricity costs per year, which no longer seems like much next to the $20-28 per year it’s pulling while idle," Speedify wrote.

While Comcast says the public hotspots use different bandwidth than is allocated to a customer’s home Internet service, the lawsuit argues that they can create wireless congestion in areas with many Wi-Fi networks.

The suit quoted a PCMag article in which the writer said, “This may be a legitimate concern, especially for areas that have lots of apartment buildings and multi-tenant dwellings within close proximity of one another. In my building, just about every apartment has a Wi-Fi router. Those routers are transmitting on the same channels for their 2.4GHz and 5GHz signals, leading to RF competition. Now, if you take that scenario and give everyone in that apartment another wireless network to broadcast, those networks are competing, too, and adding to interference. Comcast's FAQ about Xfinity's hotspots doesn't go into any details about channels and bands, but the company should be clear about how adding these hotspot networks affects the performance of existing WLANs—especially in business use.”

Comcast acknowledges that there could be a performance hit because the Wi-Fi networks use shared spectrum, but it says it designed the system "to support robust usage" and that there should be only "minimal impact."