That's easy enough to solve: you are only allowed to defend your SSID if you have taken reasonable steps to minimise the chance of a random name collision, and if this is really the most reasonable answer given your threat model.

For example you can't block all "Netgear WLAN" hotspots, but you can block all "Hotel Sunrise NY Guests" networks. And you can not block SSIDs similar to your private network simply because you are too lazy to specify the routers MAC in all your five devices.

> Hotel Sunrise NY Guests

But what if we are "Hotel Sunrise NY Guests"? Why wouldn't i use that name as a guest? I think if you want defensible randomization, you actually randomize it.

No. Because these are realistic rules enforced by real and reasonable people.

If you walk into Hotel Sunrise and start walking up to people and saying "I'm with Hotel Sunrise Guest Satisfaction, can I ask you some questions?" the defense "Well, I'm a Hotel Sunrise Guest and it was for my Satisfaction!" is not going to absolve you of any consequences that arise.

Hotel Sunrise guests would certainly connect to APs advertising that SSID. It would be pretty shady for them to set up their own APs with that SSID however.

> no one owns the SSIDs

Actually, that's a completely different issue.

I think that because the area involved is so local, the FCC is optimistic unlicensed spectrum users can come to consensus on that matter, otherwise it's going to have to deal with it in the more explicit, costly, and user inconvenient manner that it has done so in the past with identifiers used over less locally constrained, longer wavelength frequencies.

I think optimism is warranted. If someone local to you is being a dick with your SSID, you use technical (protocol level) countermeasures to disrupt them. This has been standard practice for a decade. If the attacker uses those countermeasures against legitimate users, apparently the FCC is now willing to respond with financial countermeasures against the attacker if it can.

If there were somehow a situation where the FCC was technically unable to respond, like say the attacker had a swarm of invisible drones equipped with access points advertising your SSID, then it would be helpless. The only solution would be to wait for vendors to come together through the IEEE or IETF with a standard to thwart the evildoers. (Probably years)

And it may yet come to that. But for now, the FCC clearly represents, at least within the United States, that corporate evildoers cannot blatantly perpetrate denial of service attacks on public spectrum without fear of sanction.