Btw, this is an issue in retail as well: Tracking Shoppers Cell Phone?
"That is how you can see the Seattle Police Department's new wireless mesh network, bought from a California-based company called Aruba Networks, whose clients include the Department of Defense, school districts in Canada, oil-mining interests in China, and telecommunications companies in Saudi Arabia."
Aruba Networks are #2 in the world in wi-fi sales volume behind Cisco... I just found that statement hilarious.
To me this is a little bit of both. (Full disclosure, I work for a Meru and Aruba dealer). Wi-fi is not in my wheelhouse, but I do have a decent background, and I spoke to our head wireless engineer about this. It is 100% possible. It is also 100% unlikely and would require an insane amount of overhead to pick out specific devices by MAC while those devices were unassociated from the network, just based upon the volume and density of devices. So this would appear to be to be more of a slippery slope argument, but not impossible. If anyone from Seattle is really paranoid, just turn off wi-fi on your phone while youre downtown if you dont want to be tracked...
EDIT: Also they state "In fact, one of Aruba's major selling points is its ability to locate "rogue" or "unassociated" devices—that is, any device that hasn't been authorized by (and maybe hasn't even asked to be part of) the network."
That's like saying one of <insert VMS> major selling point is its ability to record only on motion.