Public Transit Industry's Smartcards Innovation is Conditioning U.S. Consumers to Accept Mobile Payments Using Smartphones

Group Working on Open Standards for Smartcard-based Public Transportation

August 2, 2010

AVISIAN - Imagine jet-setting from L.A. to Boston to Paris, catching the subway in all three cities, and only having to buy a single transit pass to get around. If four smart card powerhouses achieve their goal, this could one day be the reality for transit users.

In January, smart card manufacturers Giesecke & Devrient and Oberthur Technologies and chip suppliers Infineon Technologies and INSIDE Contactless launched an initiative to develop a new secure solution for next-generation smart card-based public transport applications.

The solution would be built on an open-standard system the four companies are implementing, but an independent body would eventually govern it. Despite some of the companies being competitors, the partners say they formed the initiative because they need each other’s expertise to attain a fully interoperable system.

“We decided that to be successful, you needed to have a group of partners with different proficiencies,” said Werner Koele, marketing manager for the Personal and Object ID business line of Infineon, the company that spearheaded the initiative.

And the group is poised to add more partners. While Koele wouldn’t disclose names, he said the four companies are in discussions with other major players that could join the initiative in the coming weeks and months.

Transit evolution

In 2009, Infineon undertook a market analysis that identified several changes underfoot in the transport market.

Talks with transport agencies revealed that in the coming years, the market will split into low-, medium- and high-end applications, ranging from paper tickets on the low end to high-end solutions such as NFC (near field communications) or multi-application cards combining citizen services or payment. Contactless credit cards are getting more attention, and proprietary, closed-loop products have their own set of problems, according to Infineon.

At the same time, the public transit sector is expected to grow dramatically in the next 20 to 30 years, with governments worldwide spending large amounts of money on infrastructure. The biggest demand for projects will come from mega cities with populations of 5 million to 20 million, for which an open standard system would be well-suited, said Roland Magiera, adviser of Transit Segment Marketing, Government Solutions for Giesecke & Devrient.

“We think this (system) will be a higher value for the transit authorities and for the customers,” he said.

The initiative touts vendor independence, increased vendor choice, interoperability and cost savings among the benefits to transit operators.

The fact that there have been several public transit pilot programs involving NFC and payment cards shows that the technical dynamic is possible for an open-standard system, Magiera said.

“We think that new technology with an open standard could be very helpful for the industry and development,” Magiera said. “This is the main reason we’ve joined the initiative and are speaking with the other companies.”

Security benefits

After completing its market analysis last year, Infineon determined that the best course of action would be to get away from a proprietary, closed-loop system in favor of a more modern, open standard system that would allow for multiple companies and technologies.

One argument for the open standard is that proprietary products are seen as security risk. Magiera cites the 2008 security breach of NXP Semiconductors’ Mifare Classic, a proprietary chip commonly used extensively in transit passes and access control badges. The breach made it possible for someone to clone the chip.

Part of the initiative’s goal is to develop a unified security concept as the common base for a variety of products, according to Infineon. This concept is based on groundwork performed by Infineon, which developed a hardware-based security system specifically suited for public transportation smart card applications. It consists of an authentication scheme using the open and well-accepted Advanced Encryption Standard, which can be implemented in low-cost silicon.

“We believe that AES is the best for this market. It is well defined and proven,” Koele said.

Although the security concept and mandatory file types will remain the same, vendors will be able to differentiate their products from each other by offering additional features and better performance, according to Infineon.

“The goal is to come up with products that are interoperable, so different products can be used in the same system,” Koele said.

For instance, even though Infineon and INSIDE Contactless have different chips, either would work in the same system.

Need for collaboration

The looming logistical challenge the initiative faces will be to get the various transit agencies around the globe to cooperate so they will all be using the same system.

Transport agencies have the prime intention of bringing users from Point A to Point B, and payment and ticketing concerns are secondary, Koele said. By nature of being government-run, the agencies are driven by a slow, politically driven decision-making process on such matters.

“There are too many players in the market, and they have to align internally,” Koele said of the transit agencies. “Our standard for public transport could be the basis for such a scheme. And that’s the intention we have.”

The first cities are expected to run pilots using the initiative’s open system a year from now. The initiative is eyeing about three dozen cities for deployment. The system would take another three to five years to implement with widespread deployment in the next 10 to 15 years, Koele said.

How Paranoid Is It to Buy a Wallet With a Metal Shield for Your SmarTrip Card?

Originally Published on April 2, 2008

Washington Post - Stuck on the tarmac, flipping through a travel magazine, you're struck by the blurb for metal-lined wallets. Purpose: to prevent digital pickpocketing by blocking radio frequencies.

These handsome babies start at $79.99 and top out at the $225 Italian Leather Teju Lizard Embossed Travel Wallet.

Your reaction: Wow! Luxury accessories for paranoids!

But you would be wrong. Maybe.

Because, says electronic security expert Bruce Schneier, crystallizing the view of many:

"As weird as it sounds, wrapping your passport in tinfoil helps. The tinfoil people, in this case, happen to be correct."

The issue is bigger than just the new style of passports, which contain chips that emit information that can be read by a scanner. We're also talking about your Metro SmarTrip card, your employee ID/building access card, your automatic highway toll pass, the newest wave of credit cards and gas purchasing cards, even digital drivers' licenses being developed in some states.

All of these nifty and oh-so-convenient bits of plastic employ versions of what's known as radio frequency identification technology, or RFID. That is, they toss out bits of data that are caught by receivers, with little or no contact, just through the air in some cases. The new credit cards, such as MasterCard's PayPass, don't have to be swiped through a machine. Swiping is so retro, and takes precious extra seconds. You need only lightly tap the PayPass on a terminal to register a purchase.

Neato. It feels as if you're living in the future, or in an episode of "24," when you slap your purse on the Metro turnstile and the gate opens, or you wave your ID badge at a node on the wall and your office door beeps open (and then your face and all your recent movements around the office -- yikes! -- pop up on the security guard's computer).

DMV Explores SmarTrip Chips in Washington, DC

D.C. Department of Motor Vehicles is planning an initiative to embed SmarTrip computer chips inside every new D.C. driver’s license as the most efficient way to pay for transit service.

Originally Published on November 6, 2007

The Examiner - Privacy advocates are alarmed by a D.C. Department of Motor Vehicles initiative to embed SmarTrip computer chips inside every new D.C. driver’s license, making it easier than ever to track D.C. residents on their travels through the transit system.

The DMV will spend $830,000 a year to install SmarTrip chips in all driver’s licenses and identification cards starting in October 2008. SmarTrip “is the most efficient way of paying for transit service,” according to DMV documents, and lodging the chips in about 440,000 licenses “will allow all District residents access to SmarTrip cards and encourage transit use.”

DMV spokeswoman Janis Hazel said there was no plan to increase the cost of a driver’s license to offset the costs of the chip.

SmarTrip does, however, provide Metro and the government with a system to follow users, though Hazel said the agency “has no intention to track [a] person’s movements on the Metro system.”

“If you’re paying your fare with it, they’re going to have the ability to know by name who entered each Metro station at what time and who exited a Metro station at what time,” said Paul Stephens, director of policy and advocacy with the Privacy Rights Clearinghouse. “That can be used by the government to track your comings and goings. It’s an absolutely awful idea.”

Metro’s policy is to release Smar-Trip information to law enforcement purposes, or at a cardholder’s request. A Metro spokesman said the transit agency’s privacy rules are “very strict.”

The SmarTrip technology allows users to breeze through fare gates at Metrorail stations, to park at a Metro garage or to pay their fares on a Metrobus. SmarTrip cards usually cost $5 to buy.

Expanding SmarTrip into driver’s licenses offers “yet another opportunity to reduce vehicular traffic in the downtown area,” said D.C. Council Chairman Vincent Gray, whose government ID badge has a SmarTrip built in.

But Melissa Ngo with the D.C.-based Electronic Privacy Information Center said D.C. is “setting up an infrastructure where the government can track you all the time.” Combining a license, smart card, credit card and ID badge into one “leaves you open to identity theft on a variety of levels,” she said.

“It’s just not good security,” Ngo said.

The Maryland Motor Vehicle Administration has discussed a similar initiative, a spokesman said. It is unknown where Virginia stands.

MTA to Bring Smart Cards to Buses

Originally Published on May 24, 2007

SecondAvenueGas.com - The WMATA in Washington, DC, never bothered with MetroCard technology. They went from fare cards straight to SmarTrip cards, an RFID-powered chip that allows for contactless payment. You don’t have wait to swipe the card.

On buses, these SmarTrip cards are particularly useful because the technology allows for a one-touch fare pass-through. No more waiting for someone to figure out how to dip a MetroCard into the reader.

Well, the MTA is finally hopping on board the smart card technology train. After a successful pilot program on the Lexington Ave. line incorporating the Mastercard Blink technology, the Authority is ready to try out smart cards on buses.

Rides would be automatically deducted from credit or debit cards, but MTA officials are still figuring out how to incorporate existing MetroCard features, such as monthly passes and transfers, onto the smart card…

“It works on the Lexington line,” said MTA spokesman Jeremy Soffin. “The purpose of the extension is to learn how it would work in a wider usage. There is still a lot to be learned.”

No word yet on which buses are going to be adopted this technology first, but the more, the merrier, I say. There’s nothing quite so irritating waiting on line at a bus stop as someone attempts to put a MetroCard into the reader backwards and upside-down.

Cards Let Metro Collect Data on Riders, Track Trips

Originally Published on May 17, 2005

The Washington Times - Metro's SmarTrip fare cards allow the transit agency to monitor passengers' travel with little regard for privacy concerns, a group focused on privacy issues says.

The SmarTrip fare card, which includes an embedded radio frequency identification (RFID) chip, tracks each rider's travel and can be matched with the rider's name, address and credit-card number, according to the District-based nonprofit Electronic Privacy Information Center (EPIC).

"Our basic point is that there is a lot of detailed information being collected," said Marc Rotenberg, executive director of EPIC, a public-interest group established in 1994 to focus attention on emerging threats to civil liberties. "The privacy protections, in our opinion, are inadequate."

According to documents obtained by EPIC through the Freedom of Information Act, the SmarTrip card can record a Metro passenger's time of arrival in the Metro system, the passenger's destination and the amount of time the passenger spends traveling from point to point.

It even records the gate through which a passenger leaves the station.

But transit officials say they have addressed the privacy issues with a policy expected to be passed by the Metro board at its monthly meeting Thursday.

According to the new policy, personal SmarTrip information may be released by Metro only in what are called "limited instances" -- the request must be made by the registered user of the SmarTrip card, there must be a court order, or the request must come from law enforcement when the information is required in the course of an investigation in which time is of the essence.

"Basically, it means nobody can get an individual's SmarTrip data," said Lisa Farbstein, a Metro spokeswoman. "The policy is being established as a way to regulate and safeguard individual data."

If passed, the new policy will take effect Oct. 1.

Since 2000, Metro officials have governed the release of private information through their Public Access to Records Policy. The policy is similar to the federal Freedom of Information Act.

Miss Farbstein said that safeguards on the release of personal information always have been in place and that Metro never has sold or released the information it has collected from SmarTrip cards. The information can be stored indefinitely and used to track ridership trends.

"People still can't get your SmarTrip information, but this clarifies things," she said.

The issue became more relevant in June 2004, when Metro began requiring a SmarTrip card to pay for parking at its lots. The shift spurred sales of the plastic cards, which also can be used to pay for Metrorail and Metrobus fares.

Prior to the start of the SmarTrip-only parking payment program, sales of the cards averaged 8,000 per month between May 1999 and May 2004. Metro officials estimated last year that customers were purchasing between 3,000 and 4,000 of the cards per day, most directly from new SmarTrip vending machines that are located inside 30 Metro stations.

Mr. Rotenberg said he thought the new Metro privacy policy is a good idea but that it was important to notify the public about the type of information that is being collected. He also said there is the potential for abuse when there is "this type of effort to record where people are going."

Washington Metro’s SmarTrip® Program Issues 300,000 Contactless Cards to Area Commuters

Originally Published on December 1, 2002

SecureIDNews.com - Washington, D.C. made history when it became the first U.S. city to deploy a contactless smart card system- wide for mass transit. The Smar- Trip® card has gained widespread acceptance in the Washington, D.C. area, particularly in the past year. Washington Metropolitan Area Transit Authority (WMATA) has more than 300,000 SmarTrip® customers and adds an average of 3,000 new customers each week.

Read More...