If you never change the WEP key, then they just have to listen in for 15 minutes of active traffic each day for a week..