<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: toledo]]></title>
    <link>http://securityratty.com/tag/toledo</link>
    <description></description>
    <pubDate>Sun, 13 Apr 2008 17:14:52 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[MetroFi Plans Market Exit: Sale or Shutter]]></title>
      <link>http://securityratty.com/article/64f008fcfc8f27ab4b858e3eaa8d471c</link>
      <guid>http://securityratty.com/article/64f008fcfc8f27ab4b858e3eaa8d471c</guid>
      <description><![CDATA[MetroFi will sell its networks, but plans to shutter if there are no buyers: Ah, folks, the trifecta has arrived, and I'm nothing but sad about it. MetroFi's chief Chuck Haas emailed me this evening...]]></description>
      <content:encoded><![CDATA[<p><img src="http://wifinetnews.com/images/muni_icon.jpg" align="right" hspace="5" height="80" width="80" border="0" /><strong>MetroFi will sell its networks, but plans to shutter if there are no buyers:</strong> Ah, folks, the trifecta has arrived, and I'm nothing but sad about it. MetroFi's chief Chuck Haas emailed me this evening with the news that his firm has decided that they will sell their networks in nine cities, including their first cities in the Bay Area (Cupertino, Santa Clara, and Sunnyvale), and their largest muni deployment in Portland, Ore. If no buyers emerge--including the cities in question--Haas said that MetroFi would have a shutdown plan for gradually unlighting the networks.</p>

<p>MetroFi was one of the three most prominent pure play metro-scale Wi-Fi firms, if you count EarthLink's municipal wireless division as a separate operation, and Kite Networks, which was a subsidiary of a larger telecom firm. Each company had made a unique network hardware choice--MetroFi, SkyPilot; Kite, Strix; and EarthLink Tropos plus Motorola--and each had a sort of specialty. Interestingly, a fifth firm, BelAir powers Toronto (a small but super-fast Wi-Fi network) and Minneapolis (the only putatively completed large-city Wi-Fi network), and will be behind Cablevision's nearly $350m New York Wi-Fi plan.</p>

<p>MetroFi was the only major firm to back ad-supported no-fee access, coupled with paid, no-ads service, and higher tiered commercial offerings. They built mostly smaller cities, with Portland being their only real big city win. The firm began with the notion of building Wi-Fi out gradually as a way to provide broadband in communities that lacked service, with no municipal involvement. That plan required sparser networks and typically a home signal booster designed by SkyPilot. (Kite mostly focused on the Southwest; EarthLink on big cities.)</p>

<p>EarthLink was in many ways largely responsible for the mess that all Wi-Fi providers found themselves in last year by offering to build Philadelphia's network back in 2005 at no cost to the city--in fact, paying the city and the local utility fees. That set the stage for nearly all the RFPs that followed where, if EarthLink were a bidder or the city was aware of the alternatives, the notion was that no city dollars would be spent, even if taxpayer money wasn't "at risk"--that is, even if a city could save money by switching current line items in their telecom and data budget to a wireless network.</p>

<p>Haas noted via email that MetroFi has been working towards anchor commitments by cities for nearly two years, but the inertia of those early networks led municipalities to reject those options. In Toledo, where MetroFi had negotiated an anchor commitment, a change in administration led a new mayor to retreat from the plan. </p>

<p>Is there a future for metro-scale Wi-Fi? Yes. With thoughtfully constructed, outdoor-focused deployments centered on municipal purposes, with public access a secondary issue, it seems like these networks could still provide an inexpensive way for relatively high bandwidth compared to the alternative of cell data networks.</p>

<p>However, that advantage is likely short lived in larger markets. The near-future certainty now that there will be multiple provides offering wired broadband speed service starting later this year with Sprint/Clearwire's WiMax, and continuing through into 2012 with significant network buildout by Verizon and AT&T in several bands (including their new 700 MHz holdings).</p>

<p>While Sprint/Clearwire is talking about 120m to 140m homes passed by 2010 with their network, obviously focusing only on major markets, many of the 700 MHz licenses purchased by AT&T and Verizon carry buildout requirements with penalties. So cities outside the top 100 population markets and rural areas will still see some benefit. In those mid-tier markets, there's also the 3.65 GHz band for shared licensed use, which is a model that Azulstar is pursuing with new WiMax deployments, as <strong><a href="http://wifinetnews.com/archives/008313.html">I wrote about recently</a></strong>.</p>

<p>Competition will likely push the cost of mobile broadband far below its $60 per month 2-year contract rate of today, which then would beg the question why a city or county with good commercial coverage would need to build its own Wi-Fi network. There are still plenty of reasons to build dedicated, first-responder 4.9 GHz public safety networks, of course.</p>

<p>I've always described Wi-Fi on a metropolitan scale as the <em>best, worst technology</em>. The best, because everyone has Wi-Fi in their laptops and increasingly in handhelds and gadgets. The worst, because the technology is absolutely not designed for the purpose, unlike CDMA and GSM evolved cell standards and mobile WiMax.</p>

<p>It's possible that in the long term, looking five years out, that Wi-Fi on a metro-scale will only be needed in small towns, odd markets, and for highly particular purposes. Or, perhaps in a bit of irony, where companies like Cablevision feel Wi-Fi is necessary to retain the loyalty of their highly wired customer base.</p>]]></content:encoded>
      <pubDate>Thu, 15 May 2008 17:47:12 +0000</pubDate>
      <category domain="http://securityratty.com/tag/metro-scale wi-fi">metro-scale wi-fi</category>
      <category domain="http://securityratty.com/tag/wi-fi">wi-fi</category>
      <category domain="http://securityratty.com/tag/large-city wi-fi network">large-city wi-fi network</category>
      <category domain="http://securityratty.com/tag/wi-fi providers">wi-fi providers</category>
      <category domain="http://securityratty.com/tag/wi-fi network">wi-fi network</category>
      <category domain="http://securityratty.com/tag/york wi-fi plan">york wi-fi plan</category>
      <category domain="http://securityratty.com/tag/city">city</category>
      <category domain="http://securityratty.com/tag/city dollars">city dollars</category>
      <category domain="http://securityratty.com/tag/super-fast wi-fi network">super-fast wi-fi network</category>
      <source url="http://wifinetnews.com/archives/008322.html">MetroFi Plans Market Exit: Sale or Shutter</source>
    </item>
    <item>
      <title><![CDATA[An internal breach at the University of Toledo exposes 6,500]]></title>
      <link>http://securityratty.com/article/03fb9c009e114711b88a0053bae8eea6</link>
      <guid>http://securityratty.com/article/03fb9c009e114711b88a0053bae8eea6</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/13/08

Organization
University of Toledo

Contractor/Consultant/Branch
None

Victims
Employees that worked on the Health Sciences Campus from 1993 to...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/toledo.jpg" align="right" height="199" width="199"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/13/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.utoledo.edu/">University of Toledo</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Employees that worked on the Health Sciences Campus from 1993 to 1999<br><br><span style="font-weight: bold;">Number Affected:</span><br>6,500<br><br><span style="font-weight: bold;">Types of Data:</span><br>W-2 Forms, including names, addresses, and Social Security numbers <br><br><span style="font-weight: bold;">Breach Description:</span><br>"TOLEDO -- A university spokesperson said Sunday that personal information involving nearly 6,500 university employees was accidentally placed on the the university's server last month, which all employees would have been able to access."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.wnwo.com/news/news_story.aspx?id=120506">NBC24 News</a> <br><a href="http://abclocal.go.com/wtvg/story?section=news/local&amp;id=6078444">13ABC News</a> <br><a href="http://toledoblade.com/apps/pbcs.dll/article?AID=/20080413/NEWS21/804130353">The Toledo Times</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>NBC24 News<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Personal information of nearly 6,500 University of Toledo employees - the majority having worked on the Health Science Campus in 1993 and 1999 - last month was inadvertently placed on a server to which all employees had access.<br><span style="font-style: italic;">[Evan] This information seems a little old to still be kept by the school.&nbsp; I don't know about Ohio's legal requirements, but I know that neither the IRS and Department of Labor require that payroll information be kept for so long.&nbsp; Maybe a data retention policy would be in order.</span><br><br>A data file, once only visible to those in UT's payroll department, was mistakenly placed on a shared network.<br><br>An employee in the payroll department authorized to work with the data accidentally moved it to the wrong folder on the morning of March 4.<br><br>It was discovered in the wrong place by an information technology employee on March 5, said Bob Hogle, interim information technology chief operating officer.<br><span style="font-style: italic;">[Evan] Excellent work by the information technology employee.&nbsp; I wonder how he/she became aware.</span><br><br>It is common for large data files, such as these spreadsheets, to be stored on the internal server, but they are typically kept in folders where only employees of that department have access, Mr. Hogle said.<br><br>"There were about 6500 employees w-2 forms primarily from 1993 and 1999," says UT spokesperson Jon Strunk.<br><br>The personal information, including social security numbers, were made available to all university employees. University officials doubt the information was ever stolen. <br><br>"The likelihood that an employee who didn't know the file was there to begin with would chose to search the obscure part of the data, and further would have malicious intent seems unlikely," says Strunk<br><br>Strunk says the incident happened back on March 4th and was corrected the very next day, but those effected weren't notified until this past week. <br><br>"Letters were sent out on Thursday. The reason for the delay there being we wanted to ensure, as these were former employees, we had the most accurate addresses we could find to send them out a letter," explains Strunk. <br><br>The temporary folder where the information was accidentally placed has been removed, he said.<br><br>If you received a letter and have more questions, or if you didn't and want to know if you were effected, you can e-mail the Compliance Office at the University of Toledo at complianceoffice@utoledo.edu<br><br><span style="font-weight: bold;">Commentary:</span><br>Employees make mistakes.&nbsp; They are human.&nbsp; What are some of the things that we can do as information security professionals to reduce the frequency and severity of employee mistakes?&nbsp; This issue is a big challenge.&nbsp; The risk of identity theft or further damage is probably pretty low due to the fact that this was an internal exposure.<br><br>Of course, you can't expose information that you no longer possess.&nbsp; Why does the school still have this information?&nbsp; Does the school have a data retention policy?&nbsp; Like many breaches, there are more questions than answers. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>August, 2007 - <a href="http://breachblog.com/2007/08/02/university-of-toledo-two-stolen-computers-unknown-number-of-victims.aspx">University of Toledo, Two Stolen Computers, Unknown Number of Victims</a></font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/04/13/toledo.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Sun, 13 Apr 2008 17:14:52 +0000</pubDate>
      <category domain="http://securityratty.com/tag/university">university</category>
      <category domain="http://securityratty.com/tag/university officials doubt">university officials doubt</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information security professionals">information security professionals</category>
      <category domain="http://securityratty.com/tag/university employees">university employees</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/toledo">toledo</category>
      <category domain="http://securityratty.com/tag/employees">employees</category>
      <category domain="http://securityratty.com/tag/expose information">expose information</category>
      <source url="http://breachblog.com/2008/04/13/toledo.aspx">An internal breach at the University of Toledo exposes 6,500</source>
    </item>
  </channel>
</rss>
