[SecurityRatty] tag: usi

Minneapolis Network Reports 10,000 Users

Tue, 12 Aug 2008 11:34:58 +0000

The Star Tribune writes that the Minneapolis USI Wireless network has signed up over 10,000 users: Steve Alexander, who has closely covered the network for his paper, writes that the network operator told him they're beyond break even. It's a fascinating result; the city remains unique for its size in having a functioning, privately operated Wi-Fi network. Alexander shares several comments from readers about the service, mostly but not entirely negative, which makes sense: people are emailing him when they have problems.

Metro Round-Up: Phila., Minneapolis, St. Louis Park (Minn.), Texas, Foster City (Calif.), Naperville (Ill.), Chehalis and Centralia (Wash.), Cambria C

Wed, 11 Jun 2008 10:33:41 +0000

Philadelphia may find operator for Wi-Fi network: The AP reports that the City of Brotherly Love's Wi-Fi network isn't yet down, or down for the count. While it's scheduled to be flipped off tomorrow (you can read whatever you like into the phrase "flipped off"), the city is talking to a party it won't disclose about the networks future. EarthLink sued Phila. in May to be able to remove its equipment and cap its liabilities. The city's wireless non-profit arm, Wireless Philadelphia, has made noises about what EarthLink's true liability could be; the non-profit has born some of the electrical cost, and might be seeking to have that repaid on top of penalties and other expenses.

Minneapolis suffers the heartbreak of leafage: Leaves are popping in Minneapolis, and Star-Tribune columnist Steve Alexander writes that residents are seeing some Wi-Fi reception problems on that city's Wi-Fi network. This is the only big-city network that can be currently described "successful," even though its long-term success has to be proven out. The firm responsible, USI Wireless, told Alexander they're working on adjusting about 5 percent of antennas to cope with the pesky greenery.

St. Louis Park sues ARINC over Wi-Fi network: The Minnesota town says the network never worked, and had earlier discussed a lawsuit. The city wants the value of the contract ($1.7m) plus a very modest amount in damages and fees ($50,000). The city plans to start removing gear if ARINC doesn't sometime in June. But they have to deal with 490 poles erected to hold the nodes and solar-charging gear--sunk into concrete. More recent testing showed that the network worked well in some areas, but the majority of the network did not, according to the Star Tribune.

Verizon builds out fiber in AT&T territory: Interesting sign of competition in otherwise monopoly-per-provider-type world. Verizon is using AT&T's hard-won statewide video franchising rules in Texas to build competitive fiber in Dallas suburbs. They're apparently not bringing telecom; they're acting like a cable TV firm with data. Verizon owns chunks of territory all over due to it encompassing GTE in a deal years ago. GTE serves suburbs west of Portland, Ore., and east of Seattle, for instance, while Qwest serves most of the rest of each state.

Foster City Wi-Fi dies on June 20: MetroFi is unlighting its cities, and Foster City opted not to spend the nearly $200,000 asking price MetroFi put on its equipment. MetroFi might still find a buyer, but June 20 is the network's current final day. Naperville, Ill., also expects a June 20 shutdown. They, too, were offered the network hardware for 200 grand.

Chehalis lights up: A small city in southern Washington votes to put in Wi-Fi hotzones. The cost is about $53,000 and annual fees $15,000. Funds will come from existing tax and grant sources. The city chose to install service to make sure they're not missing a checkbox on the amenities list for visitors and businesses rather than for a particular, measurable goal.

Nearby Centralia pulls its Wi-Fi: A pilot project in the larger city of Centralia, Wash., a bit north of Chehalis, is shut down when poles used to mount Wi-Fi radios are removed as electrical wires are buried. (The reporter here confuses broadband over powerlines (BPL) with broadband wireless.) The system might be restarted later.

Craig Settles writes up Pennsylvania's Cambria County wireless success: This is a network built for particular municipal purposes, part of Settles's long-time drumbeat about having applications first and then networks built for those networks second. He notes that Cambria built a 700 sq mi network that sounds nearly cost neutral through efficiency and cost conservation--it's cheaper to get much more service with this network than it was for a smaller array of services with incumbent-provided networks.

Santa Fe residents oppose Wi-Fi in the library on health grounds: You know what I have to say about how provable this has turned out to be in clinical studies. I am, however, as always, concerned about these people's health, even if I don't believe that Wi-Fi (or EMF) causes their problems. The group opposed to library-Fi is citing the ADA in this case, uniquely I believe. Six libraries suggested that EMF triggers seizures in epileptics, something I've never heard cited before; maybe CRTs (flickering), but EMF? Wired is substantially less kind than I am, pointing out that EMF other than Wi-Fi produces vastly higher signal strength. (They're sort of ignoring signal strength at a given point where an individual stands in relation to a transmitter, however.)

Three Essays on Muni-Fi You Should Read

Tue, 20 May 2008 08:50:08 +0000

In the aftermath of the last man standing, MetroFi, announcing its metro-scale Wi-Fi endgame, three useful essays have appeared: If you're trying to understand the past, present, and future of the space, I recommend you read these short opinion pieces.

First, Karl Edwards of Excelsio, a firm that consults on municipal broadband, lays out a pretty straight case as to why EarthLink, Kite, and MetroFi's networks, among other one-offs, were designed to fail. I've written about aspects of this over the last four years, but Edwards is succinct. In part, EarthLink offering to build Philadelphia's network at no cost to the city set the mold wrong for all networks to follow. We're resetting now, and Wi-Fi's moment may have passed.

Edwards offers as one the constraints set by cities, "Expectation that the network would cover 90-95% of the City with wireless coverage as opposed to just in the areas where there was a solid business case." This has been a problem I've had for a couple of years when it started to become clear that 90-plus percent coverage wasn't in the interest of the ISP--nor in the city's interest because these networks couldn't be completed.

Edwards also notes that when consulting for Grand Rapids, Mich., which chose Clearwire as its wireless partner, EarthLink told the city that they expected a conservative 22-percent uptake for their Wi-Fi service by end of the fourth year. Given that in mature markets, a high-single-digit uptake is considered very good, that's shows how the Excel spreadsheets were skewed. USI Wireless's estimates for break-even require less than 10 percent of the population in their covered areas to subscribe, and their numbers of subscribers to date are tracking that number closely.

He closes with a set of eight principles for wireless network builders to come to the table with and cities to adopt, all of which I agree with.

Next, Esme Vos suggests a very modest proposal: San Francisco should have required all its cafes to offer free Wi-Fi, and then Fon or others could have aggregated and bundled access to these locations. There's a long set of comments accusing Esme of communism, socialism, utopianism, and other isms. The post and the comments make for lively reading.

Finally, Craig Plunkett, who operates hotspot networks around New York City and Long Island, chimes in with a summary of these opinions and the notion that muni-Fi jumped the shark when Ocean City, N.J., decided to put Wi-Fi in garbage cans. He points out that "an infill strategy" of providing service where needed and then extending from there is effective.

Wee-Fi: Mesh in Devices, Florida-Fi, Minneapolis-Fi, LA No-Fi, Harbor-Fi, Parade-Fi

Mon, 28 Apr 2008 09:09:58 +0000

Out-of-sight, out-of-mesh: PacketHop announces first 802.11s mesh standard products based on the likely-to-be-approved current draft. The mesh standard is about endpoints, and I'd entirely lost track of it; it has nothing to do with how metro-scale devices mesh way up on poles. 802.11s mesh should allow end-point devices to form their own loose associations, which could improve throughput and range across parts of a network. Latency increases when you have a mesh network, because devices require more hops to reach a gateway, but depending on how smart meshes are about tokens and limiting power, they can exchange data at higher speeds among themselves without a central chokepoint. PacketHop, acquired by SRI International, is offering their technology as something hardware makers can integrate, rather than as a set of chips or a reference product.

Stalled-Fi in Florida: The Sun Sentinal newspaper looks at stalled, dropped efforts at city-wide Wi-Fi in Palm Beach County. Boynton Beach had a network early on, in 2005, but the city dropped the operator in March 31 due to complaints over maintenance. Delray Beach (E-Path) and West Palm Beach haven't advanced.

Minneapolis Wi-Fi requires booster for best use: This isn't an enormous surprise, or anything, and one of the consultants on the Minneapolis project said that USI Wireless starts with the notion that a booster is needed, which is highly sensible. Reporter Steve Alexander found service was highly variable outdoors with a standard laptop Wi-Fi adapter. The company sells boosters: a $160 high-gain laptop card and an $80 ($5/mo rental) home bridge. Alexander didn't re-test problem areas with the high-gain card. You can see the map of Alexander's test locations.

Orange Line in Los Angeles can't attract Wi-Fi operator: A spokesperson suggested riders should take advantage of "existing satellite" providers, where I think he'll be red-faced to know he should have said cellular. Or the reporter misheard. Say satellite and cellular each ten times fast. Now drink a glass of water.

Scarborough (Yorkshire Coast, UK) offers free Wi-Fi: 5.5m visitors pass through this coastal town each year, and a local business association has decided to unleash free Wi-Fi. The service will be pointed outwards for boats in the harbor, as well as inland.

Free Wi-Fi float in Sebastopol parade: The Apple Blossom Festival Parade last Saturday included "a fluorescent and sparkle-clad crew that shouted, 'Free Wi-Fi.' " The parade was led by a 1906 San Francisco Earthquake survivor.

Chipotle Mexican Grill employee information on USi stolen laptop

Sat, 26 Apr 2008 18:39:08 +0000

Technorati Tag: Security Breach

Date Reported:
4/15/08 (this incident is also the cause of Stolen USinternetworking laptop affects hundreds of SPX employees AND Stolen USinternetworking laptop also affects XL employees)

Organization:
Chipotle Mexican Grill

Contractor/Consultant/Branch:
USinternetworking ("USi")*

*From the USinternetworking "About Us" page:
Founded in 1998, USinternetworking, Inc. (USi), an AT&T company, is the most experienced Application Service Provider (ASP). We use a highly automated, efficient, systematic approach to deliver managed hosting, application management, remote management, professional services, SaaS enablement, and eBusiness development and hosting to more than 150 enterprise-level organizations in over 30 countries.

Victims:
Current and former Chipotle employees

Number Affected:
Unknown

Types of Data:
"name, address, Social Security number, and payroll information"

Breach Description:
"USi, a service company that was doing information technology work for Chipotle to support human resources and payroll, has notified Chipotle that on or about March 23, 2008, a USi employee residing in Columbus, Ohio was the victim of a burglary, during which a laptop computer, containing Chipotle information, was stolen."

Reference URL:
New Hampshire State Attorney General breach notification part 1
New Hampshire State Attorney General breach notification part 2

Report Credit:
The New Hampshire State Attorney General

Response:
From the online sources cited above:

USi, a service company that was doing information technology work for Chipotle to support human resources and payroll, has notified Chipotle that on or about March 23, 2008, a USi employee residing in Columbus, Ohio was the victim of a burglary, during which a laptop computer, containing Chipotle information, was stolen.
[Evan] USi was storing confidential information obtained from at least three different companies on a single, poorly protected laptop computer. Sad, but true.

Unfortunately, USi informs us that some information, including name, address, Social Security number, and payroll information for Chipotle employees and former employees was contained on the stolen laptop.
[Evan] "Unfortunately"? Is the cause of this breach attributed more to fortune than it is to poor information security management? I don't fortune has all that much to do with it.

USi has reported the theft to Ohio law enforcement authorities and believes the theft was a random act.

At this time, we have no evidence that this information has been misused, and USi indicates that the laptop was password protected.
[Evan] This statement (or very similar) appears in each of the three breach notifications that I have read about this incident. You could almost copy and paste it, eh? It is probably too early for any evidence of misuse (a smart fraudster would wait until the identity theft protection runs out, or would sell the information to someone else). Password protection (likely operating system) is little more than no protection. An operating system password would not suffice as adequate protection for most information security professionals.

we want to make you aware of the incident and the steps that have been taken to prevent a reoccurence
[Evan] USi also made this (or similar) statement in each of the breach notifications, but there were never any "steps" listed anywhere

access to Continuous Credit Monitoring and Enhanced Identity Theft Restoration at no cost to you for 2 years.

If you have questions or feel you may have an identity theft issue, please call ID TheftSmart member services at 1-800-588-9839 between 8:00 a.m. and 5:00 p.m. (Central Time), Monday through Friday

Chipotle sincerely regrets this unfortunate incident and is currently taking steps to ensure that its privacy policies are strictly followed to avoid similar issues.
[Evan] Chipotle, its employees, its investors, and its customers would all benefit from information security improvement, including (but certainly not limited to) vendor/contractor information security policies and mandatory standards, enforcement of the policies and standards, and periodic auditing of vendor compliance with the policies and standards. Information security is necessary at all phases of vendor relationships (need definition, negotiation, contractual language, etc.) just as it is at all phases of software development.

Commentary:
Well, I wonder if this is the last company affected by this single stolen USi laptop.

Past Breaches:
Chipotle:
Unknown
USinternetworking:
April, 2008 - Stolen USinternetworking laptop also affects XL employees
April, 2008 - Stolen USinternetworking laptop affects hundreds of SPX employees

Stolen USinternetworking laptop also affects XL employees

Thu, 24 Apr 2008 11:07:36 +0000

Technorati Tag: Security Breach

Date Reported:
4/16/08 (this incident is also the cause of "Stolen USinternetworking laptop affects hundreds of SPX employees")

Organization:
XL Global Services, Inc.

Contractor/Consultant/Branch:
USinternetworking, Inc.*

*From the USinternetworking "About Us" page:
Founded in 1998, USinternetworking, Inc. (USi), an AT&T company, is the most experienced Application Service Provider (ASP). We use a highly automated, efficient, systematic approach to deliver managed hosting, application management, remote management, professional services, SaaS enablement, and eBusiness development and hosting to more than 150 enterprise-level organizations in over 30 countries.

Victims:
Employees

Number Affected:
Unknown

Types of Data:
Names, addresses, and Social Security numbers

Breach Description:
"A personal computer was recently stolen from an employee of one of our vendors, USinternetworking, Inc. of Annapolis, Maryland ("USi"). The personal computer contained the personal information of employees of XL Global Services, Inc. or its affiliates ("XL")"

Reference URL:
The New Hampshire State Attorney General breach notification

Report Credit:
The New Hampshire State Attorney General

Response:
From the online source cited above:

I am writing to inform you about a security breach.

A personal computer was recently stolen from an employee of one of our vendors, USinternetworking, Inc. of Annapolis, Maryland ("USi").

The personal computer contained the personal information of employees of XL Global Services, Inc. or its affiliates ("XL")

This information included names, addresses, and Social Security numbers of employees
[Evan] Why this information is permitted to be stored on a laptop computer is anyone's guess. Allowing this information to be stored on a laptop computer alongside another client's information (see "Stolen USinternetworking laptop affects hundreds of SPX employees") and without encryption (we are assuming that there is none because none was mentioned) is shoddy. Our vendors are not allowed to co-mingle our data with that belonging to another company. Our vendors are not permitted to store "confidential" information without employing encryption. Our vendors are audited for compliance no less than semi-annually.

USi also informed us that the laptop itself was password protected and the two files containing the personal identifying information of Company employees would not be immediately evident.
[Evan] So? Password protection (probably OS-level) and security through obscurity are both ineffective.

At our request, USi immediately reported the theft to local law enforcement in Columbus, Ohio to investigate the matter.

the investigation has not yet been successful.

Although we have no evidence that this information has been improperly accessed or misused, we want to make you aware of the incident and the steps that have been taken to prevent a reoccurrence.
[Evan] I found nothing in the breach notification that reflects what the companies plan to do or have done to "prevent a reoccurrence".

We have sent multiple e-mail notifications to the affected employees to notify them of the breach and the status.

The notices describe, among other things:
(1) the general nature of the incident resulting in the potential information security breach,
(2) the type of personal information that was the subject of the possible security breach,
(3) the precautionary measures USi is taking (at XL's request) to help protect personal information from unauthorized use,
(4) contact information for inquiries, and
(5) how to enroll in Kroll's identity theft restoration and continuous credit monitoring services, which are being made available by USi (at XL's request) to affected individuals free of charge for two years.

XL takes privacy and security matters very seriously.

If you have questions or feel you may have an identity theft issue, please call ID TheftSmart member services at 1-800-588-9839 between 8:00 am and 5:00 pm (Central Time), Monday through Friday.

On behalf of USi and the Company, we sincerely regret this incident.

Commentary:
These are the types of breaches that always get under my skin. I don't get it. These are two respectable companies. I understand that *&^% happens, but people can prevent this *&^%!

On a side note, does anyone know if Thomas Dunbar still runs information security at XL? He is the 2006 SC Magazine CSO of the Year.

Past Breaches:
Unknown

Stolen USinternetworking laptop affects hundreds of SPX employees

Tue, 22 Apr 2008 16:58:03 +0000

Technorati Tag: Security Breach

Date Reported:
4/15/08

Organization:
SPX Corporation

Contractor/Consultant/Branch:
USinternetworking, Inc.*

*From the USinternetworking "About Us" page:
Founded in 1998, USinternetworking, Inc. (USi), an AT&T company, is the most experienced Application Service Provider (ASP). We use a highly automated, efficient, systematic approach to deliver managed hosting, application management, remote management, professional services, SaaS enablement, and eBusiness development and hosting to more than 150 enterprise-level organizations in over 30 countries.

Victims:
SPX employees from the APV acquisition

Number Affected:
403

Types of Data:
Names, Social Security numbers, and banking information

Breach Description:
"Please be advised that on March 25, 2008, we received notice from one of our vendors, USintemetworking, Inc. (USi), that a USi laptop was stolen from the home of one of its employees. USi originally informed us that the laptop included personal identifying information, including names, Social Security numbers, and banking information, on approximately 329 individuals" "We later received word from USi that an additional 74 individuals were affected by this incident"

Reference URL:
The New Hampshire State Attorney General breach notification

Report Credit:
The New Hampshire State Attorney General

Response:
From the online source cited above:

Please be advised that on March 25, 2008, we received notice from one of our vendors, USinternetworking, Inc. (USi), that a USi laptop was stolen from the home of one of its employees. USi originally informed us that the laptop included personal identifying information, including names, Social Security numbers, and banking information, on approximately 329 individuals

We later received word from USi that an additional 74 individuals were affected by this incident

USi provides payroll processing and data management services for SPX companies, and has been a trusted partner for many years.
[Evan] What kind of "service" is unnecessarily exposing confidential information? I can only imagine how many confidential records USI collects, creates, stores, and transfers for their clients. USI is a large company with the resources to know better than to store confidential information on a poorly secured laptop (assuming little more than password protection).

Upon learning of this incident, in an effort to notify affected individuals as soon as possible, we forwarded a copy of the USi's March 25, 2008, communication to each of the affected individuals.

we have and continue to take steps to protect the security of the personal information.

Also, in addition to continuing to monitor this situation, we are reexamining our current data privacy and security policies and procedures to find ways of reducing the risk of future data breaches
[Evan] One improvement that I can suggest is to mandate baseline information security controls through policy and contractual language. SPX should also audit vendors for information security compliance on a regular basis.

USi has reported the theft to law enforcement authorities and we believe the theft was a random act, based on the fact that other items, including a television set, were stolen from the home.
[Evan] Statements like this have become common in breach notifications. If this were the case, then why do we read headlines like "The FTC estimates that as many as 9 million Americans have their identities stolen each year."

The laptop was password protected and we have no evidence that your employees' personal information has been, or will be, used for unauthorized purposes.
[Evan] Organizations should almost not even mention "password protected" anymore. It almost insults peoples' intelligence.

However, as a precaution, we are notifying you that the possibility exists that this information could be used to open or access your employees' credit or bank accounts.

Furthermore, USi is going to offer to your affected employees, free of charge, one year of credit monitoring and identity-theft protection

USi deeply regrets this incident and apologizes for any inconvenience this may have caused you or your employees.

USi is taking steps to enhance the protection of the information you have entrusted to us to avoid future such incidents.
[Evan] Like what? This statement means nothing to me.

SPX has established a help line you can access at (704) 752-7499 with questions or concerns.

We take this very seriously and we apologize for any inconvenience this incident may cause.

We treat all sensitive employee information in a confidential manner and are proactive in the careful handling of such information.
[Evan] Based on what I have read and assumptions where there were gaps, this statement is simply not true.

Commentary:
Again, assuming that the laptop was not encrypted. USi clearly did not take adequate steps to reduce the risk of exposure to a generally acceptable level. There was no mention of encryption or what USi's policies are in regards to storing confidential information on mobile devices. Readers only get "USi is taking steps to enhance protection" blah blah blah. Frustrating.

Past Breaches:
Unknown

Metro Round-Up: St. Louis, Minneapolis, Tempe

Sat, 12 Apr 2008 17:15:38 +0000

St. Louis's downtown Wi-Fi network goes live: AT&T overcame the problem that led them to cancel a city-wide Wi-Fi network--a lack of 24-hour-a-day power on utility poles--by building just a square mile out with nodes placd on traffic lights. The lack of power is rather difficult to overcome, and traffic lights are spaced too sparsely to replicate this deployment city-wide. AT&T is offering free, ad-supported 512 Kbps service and paid 1 Mbps. This seems rather paltry given the 72 access points that the reporter told me were being placed across that square mile. (That number is what led to my estimate of at least $500,000 in cost in the first year.)

BelAir's radios praised in Minneapolis deployment: Okay, they're praised mostly by BelAir and its customer USI Wireless. That's buttressed by details from a Novarum survey of the city that was done before the network was complete over a limited area.

Tempe moves to cancel Gobility's contract: The city could choose to take ownership of the network, but has opted for canceling the service, which would lead to other steps. This article notes that Gobility isn't communicating with city officials, but then a city official states late in the article that Gobility is still looking for a buyer for its assets.