Historical Amnesia

At a recent talk Dan Geer mentioned that CERT no longer keeps archives of vulnerabilities or incidents since 2003. Apparently they thought the data they were getting was not good enough anymore. This is very unfortunate, since it makes tracking trends and correlating them with other data impossible for years after 2003. It’s hard to handle risk if you don’t know what’s happening.

-jsq

Wireless Cook County

A densely populated county goes wireless:
Cook County, Ill., is among the local governments jumping on the wireless bandwagon in a big way – in fact, it may well be the first county in the United States to go all wireless for its public safety communications system with help from IBM.
The suburban Chicago county has tapped IBM Global Services technology and systems to build a wireless government communications system that covers the county and all of its 128 municipalities.
“Their desire was to be the first wireless county in the country, and I believe that is the case,” says Diana Hage, director of wireless services at IBM.
Cook County Goes All Wireless with IBM, By Karen Brown, WirelessWeek, November 1, 2005
That last part isn’t true; since as we’ve seen multiple counties in Oregon participate in a wireless network. Funny how big metro regions always think they’re first, even if a rural area has already done it. Nonetheless, it’s good to see a densely populated county doing this. They plan to use it for emergency communications. And for video from patrol cars, which raises various interesting questions, such as whether individual citizens will start doing video from their cars.

-jsq

Home on the Wireless Range

What is reputed to be the largest wireless cloud in the U.S. is in Oregon. Conventional wisdom has it that only densely populated metropolitan areas can support wireless Internet services. This CNN story matches what I’ve seen here in Texas. Texas spent $200 million a year to start rural Internet projects (which is another story), but the only successful rural wireless ISPs I know of (two of them headquartered within 12 miles of my house) never took a cent of government grant money and ignored the conventional wisdom. They seem to be doing fine.

The Oregon WISP is taking government money, but not grants.

Continue reading

US: Broadband Backwater

It’s been the fall follies in U.S. ISPs. Two major ISPS (Level3 and Cogent) depeered each other. SBC raises DSL prices and brags about how it’s going to charge companies that want to use its bandwith for fast applications:

How concerned are you about Internet upstarts like Google (GOOG ), MSN, Vonage, and others?

How do you think they’re going to get to customers? Through a broadband pipe. Cable companies have them. We have them. Now what they would like to do is use my pipes free, but I ain’t going to let them do that because we have spent this capital and we have to have a return on it. So there’s going to have to be some mechanism for these people who use these pipes to pay for the portion they’re using. Why should they be allowed to use my pipes?

The Internet can’t be free in that sense, because we and the cable companies have made an investment and for a Google or Yahoo! (YHOO ) or Vonage or anybody to expect to use these pipes [for] free is nuts!
At SBC, It’s All About "Scale and Scope" CEO Edward Whitacre talks about the AT&T Wireless acquisition and how he’s moving to keep abreast of cable competitors, BusinessWeek, 7 November 2005

Meanwhile, back in Japan, NTT and others provide the pipes, and multiple application providers provide VoIP, video, and numerous other services on top of them. End-user speeds in Japan are typically 50 megabits per second over DSL, with 100 megabits per second available over fiber to the home (FTTH), both at prices less than what the average U.S. DSL customer pays. Why can Japan (and Korea) do it while the U.S. can’t?

Hint: the answer is not population density, nor government subsidies.

Continue reading

When the cyberlevee breaks

Interesting article about what to do when traditional Internet security measures fail:
The Internet today is in the same position as New Orleans was before the hurricane, a heavily fortified resource of incalculable economic and cultural value whose protections will one day inevitably fail.
What will you do when the cyber-levee breaks? Opinion by Bruce Levinson, ComputerWorld, SEPTEMBER 21, 2005
The article recommends distributed backups and diversified communication methods. It even recommends what it calls plenipotentiaries, i.e., someone in each office of a company who can act without checking with the home office. Those are good ideas. And I’m not sure why that last shouldn’t be more widely used; distributed agility should lead to more productivity in any case. And it’s been 200 years now since Admiral Horaio Nelson had his sailors trained so well that his orders before the battle of Trafalgar consisted of “England expects that every man will do his duty.”

Yet there’s something missing in the article’s recommendations. Continue reading

British Phantom ATM Withdrawals

One reason U.S. regulators are so suddenly be advocating two-factor authentication for U.S. financial tranactions may be that they doubtless know about what happened in the U.K. with one-factor ATM cards some years ago:
This is the story of how the UK banking system could have collapsed in the early 1990s, but for the forbearance of a junior barrister who also happened to be an expert in computer law – and who discovered that at that time the computing department of one of the banks issuing ATM cards had “gone rogue”, cracking PINs and taking money from customers’ accounts with abandon.
How ATM fraud nearly brought down British banking Phantoms and rogue banks, By Charles Arthur, The Register, Published Friday 21st October 2005 09:52 GMT
This problem had been going on since the 1980s, and there has been a class action lawsuit in process since 1992 trying to force the affected banks to replace the money stolen from their customers. Why have we only heard about it now? Continue reading

A Patent for Trouble

At Techsummit 2005 one of the big topics was software patents. Pretty much everyone knows there are problems with them; for example, a British firm recently tried to patent hyperlinks (I believe that one was rejected by a court), and many dubious patents have been approved by the U.S. Patent and Trademark Office (USPTO), the most famous of which are probably Amazon’s One Click Shopping patent and one for online credit card authorization. Such patents promote monoply and thus monoculture, which makes software, computers, the Internet, and the economy brittle and at risk. You can fight such patents after the fact, as EFF is doing, or perhaps more radical solutions are called for.

Continue reading

3-Way MessageLevel

In a previous item we were discussing two-factor authentication for banks, as recommended by U.S. federal oversight bodies, and Axel pointed out that it’s not enough to authenticate the user once; really every transaction needs to be authenticated, as apparently is already the practice in Europe.

Here’s another per-transaction authentication system, this one for electronic mail, by MessageLevel. Banks and other entities that do business online want to be able to send invoices and other auditable financial information via electronic mail. That’s difficult, partly because of phishing, which makes everyone distrust mail. MessageLevel offers a three-way handshake to deal with this problem. Continue reading

Cat Bonds Continue

Catastrophe bonds continue to be floated, apparently about one a month. For example, in August, Swiss Re and RMS were involved in issuing a bond to protect Zurich American Insurance Corporation against hurricanes and certain earthquakes. The earthquakes in question are on the New Madrid fault, named for New Madrid Missouri, which last shook in the winter of 1811-1812 with three magnitude 8 (that’s right magnitude eight; more on that later) quakes, that rang church bells in Charleston, S.C.

This cat bond, like most, has a high trigger: $1 billion in losses from a single hurricane or earthquake. With the current population of the to-be-affected area, a New Madrid quake could trigger it.

-jsq