Stakeholders Driving Payment Evolution and Digital Identity

June 2006 ACTion Newsletter

IN THIS ISSUE

1. Editorial Comment
2. ICC Solutions Announces Canadian Office
3. Gemalto First To Achieve New Security Levels Protecting Canadian Bankcard Holders From Identity Theft
4. SCM Microsystems Provides Smart Card Readers For European Netc@rds Health Care Project
5. 2200+ Canadian Internet Merchants Join MasterCard Securecode Program
6. Giesecke & Devrient Provides Multi-Factor Authentication Based On Smart Card Technology For Oracle Extended Identity Management Ecosystem
7. EDS Delivers 10 Millionth Smart Card To Department Of Defense
8. Wells Fargo Announces Contactless Card Rollout
9. JCB Launches NFC Pilot Project In The Netherlands
10. MasterCard To Launch First PayPass Pilot In UK
11. LaserCard Announces $2 Million Card Order
12. 20,000+ Canadian Merchant Locations Participating In MasterCard Quick Payment Service Program
13. Philippines Moves Toward A New ID Card
14. ICC Solutions Assists With Development Of Requirements For Interac Test Tools
15. Additional Stories Available In Members Only Section

ACT CANADA THANKS OUR NEW & RENEWING MEMBERS

GENERAL

Collis ~ new member
CoreStreet ~ new member
Credit Union Central of Canada ~ member since 1990
EWA-Canada ~ member since 2004
Interac Association ~ member since 1995
Loyalty Group ~ member since 2005
TDCT ~ member since 1996

ASSOCIATE

NeoTel ~ new member

COLLIS EMV ACADEMY TRAINING IN TORONTO

Collis EMV Academy announces open training courses in Toronto, Canada on September 21 & 22, 2006.

Collis EMV Introductory Workshop, Toronto, 21 September 2006
The Collis EMV Introductory Workshop is an easy-entry course for everyone looking for instant EMV knowledge. Attend, and find out all about the rationale behind EMV, its business drivers, benefits, costs, opportunities and risks. The Collis EMV Introductory Workshop is a non-technical workshop, aimed at a broad audience from both business and IT background.

Collis EMV Expert Course, Toronto, 22 September 2006
This course is for those who want to know all the details that make EMV work. The Collis EMV Expert Course will cover topics from transaction flow to issuer scripting and from EMV data elements to risk management, PIN handling and security. Practical exercises provide unique hands-on EMV experience. Become an EMV Expert with the Collis EMV Expert Course!

As Collis recently joined ACT Canada, we offer an introductory 20% discount on the training fees for ACT Canada members!

For the training program, location and pricing details, as well as for information about customised in-company training, please contact Mr. Maarten Bron, BU Manager, Collis EMV Competence Center: info@collis.nl.

1. EDITORIAL COMMENT
Source: Catherine Johnston, President & CEO, ACT Canada (06/19)

Re-thinking Identity Management

The question of who owns your identity is not as simple to answer as you might think - but it could be if we made a slight shift in how view the subject.

We bundle many things together when we think of our identity. We may be parents; we certainly are someone's children. We are employees, citizens, consumers and sometimes patients. We bank, shop, travel and do many other things over the course of a day or week.

In that process we often use cards to identify our rights or entitlements to do those transactions. Cards help identify our related rights and capabilities, but they don't identify us.

Your birth certificate identifies that you were born and the name by which you will be identified. Everything else simply links you to certain transactions such as paying for goods and services; status, such as being Canadian or eligible to drive; or entitlements such as government paid health care.

In each of these and other cases, a private or public sector entity manages a relationship with you. They enter into agreements with you and provide you with papers or cards for your use.

These are all very important to your day-to-day life, but only you own your identity. If you think of it this way, it becomes much easier for everyone else to accept that they are a part of your life, but they don't own your identity.

It is much easier to set policies, define rules and establish procedures when that distinction is made.

This became much clearer during the Cardware conferences this month. I'd like to thank everyone involved from those who attended to learn and share their ideas, to the sponsors, speakers and exhibitors who made it possible. I'd also like to thank Andrea, Sam, Joanne and all the volunteers who handled hundreds of things and made it a remarkable success.

2. ICC SOLUTIONS ANNOUNCES CANADIAN OFFICE
Source: ICC Solutions (06/28)

ICC Solutions Limited is delighted to announce the opening of its Canadian office. The new office is located in Toronto, in the heart of the Financial District, and will be formally opened on Tuesday 4th July 2006.

Dave Maisey, Managing Director / Chief Executive of ICC Solutions, says: "We are very excited to celebrate the launch of our new office in Toronto. We are already thrilled to work so closely with significant organisations in the Canadian market, such as Interac Association, and now feel we are in a perfect position to further strengthen our activity in Canada, and to provide the best possible service to satisfy the requirements of our Canadian Customers. This is a significant milestone for ICC Solutions, and emphasises our total commitment to the Canadian chip migration."

Skilled technical experts, who are part of the core ICC Solutions team, will work out of the new office, located on the prestigious King Street West in Downtown Toronto.

ICC Solutions is a member of ACT Canada; please visit http://www.iccsolutions.com.

3. GEMALTO FIRST TO ACHIEVE NEW SECURITY LEVELS PROTECTING CANADIAN BANKCARD HOLDERS FROM IDENTITY THEFT
Source: ICMA Daily News (06/13)

Gemalto announced that it has achieved ISO/IEC 27001 certification for its advanced card personalization center outside Toronto, Ontario, Canada. This is the first card personalization center in Canada to receive the ISO designation. Gemalto adds this to existing certifications from Visa and MasterCard, demonstrating its commitment to exceeding the personalization needs of financial institutions in Canada.

"Our advanced center meets the most stringent standards for security, quality, equipment and processes specified from ISO, Visa and MasterCard. These certifications ensure our banking customers the highest confidence that their customers' data is protected through every step of the personalization process," said Francois Lasnier, vice president of banking for Gemalto.

The new certification, ISO/IEC 27001, is a globally recognized certification that details stringent requirements for the implementation of an information security management system, including security policy, organizational and personnel security, communications and operations management, as well as business continuity management.

Through its personalization center, Gemalto is assisting Canadian financial institutions as they begin converting an estimated 100 million magnetic stripe cards to microprocessor-based smart cards based on standards from Visa, MasterCard and others (EMV). Gemalto prepares and personalizes the smart banking cards, which includes loading appropriate cardholder data, and then packaging and sending the cards to banks or directly to cardholders.

Gemalto is a member of ACT Canada; please visit http://www.gemalto.com.

4. SCM MICROSYSTEMS PROVIDES SMART CARD READERS FOR EUROPEAN NETC@RDS HEALTH CARE PROJECT
Source: ICMA Daily News (06/13)

SCM Microsystems, Inc announced that it is providing smart card readers for the European NETC@RDS project during the 2006 Soccer World Cup in Germany.

SCM's SCR3311 smart card readers are being used to read data from new European health cards as well as the national health cards of various countries, enabling World Cup athletes, staff and visitors from participating nations to gain rapid access to health care services while at the games. In addition to providing a common software platform to read cards from multiple European countries, the readers make it possible for national health cards to be used as the base for billing with insurance companies while traveling. SCM's smart card readers are compatible with health cards from all countries participating in the NETC@RDS program and compliant to the relevant standards for e-health programs throughout Europe.

During the 2006 World Cup, SCM's readers are being implemented in about 20 hospitals near where the soccer matches will take place. A broader circulation of the readers to additional health care facilities in Germany will follow over the next several months.

SCM Microsystems is a member of ACT Canada; please visit http://www.scmmicro.com.

5. MORE THAN 2,200 CANADIAN INTERNET MERCHANTS JOIN MASTERCARD SECURECODE GLOBAL PROGRAM
Source: MasterCard (06/07)

MasterCard announced that more than 2,200 merchant customers of online payment processor InternetSecure are now participating in the MasterCard SecureCode program, a global e-commerce security solution for merchants and financial institutions. MasterCard SecureCode enhances the security of current MasterCard accounts by using a secret code to protect against unauthorized use of the MasterCard card when shopping online at participating merchants and retailers.

Much like the familiar authentication process required for payment card use at Automated Teller Machines (ATMs), MasterCard SecureCode requires cardholders to enter their personal code in an online window on their PC before their payment can be completed. With this simple step, cardholders can be confident their account is protected, and card issuers and retailers gain greater assurance about the identity of the person completing the transaction.

MasterCard is a member of ACT Canada; please visit http://www.mastercard.ca.

6. GIESECKE & DEVRIENT PROVIDES MULTI-FACTOR AUTHENTICATION BASED ON SMART CARD TECHNOLOGY FOR ORACLE EXTENDED IDENTITY MANAGEMENT ECOSYSTEM
Source: Giesecke & Devrient (06/23)

Giesecke & Devrient announced that its multi-factor authentication services on smart card technology will support Oracle Identity Management. Outfitted with a PIN and a smart card or token from the G&D StarSign product line, employees can present unique user credentials to Oracle Identity Management. This method (card and PIN) is called dual-factor authentication, and is far more secure than conventional user name/password systems. Oracle presented its ecosystem framework at the Burton Group's Catalyst Conference

The Oracle Extended Identity Management Ecosystem and Reference Architecture serves as a unifying framework to span the siloed security systems that have evolved at many organizations. It enables multi-vendor technologies to seamlessly interconnect existing physical access control solutions with the systems governing access to enterprise software programs, applications and networks.

The joint solution, can integrate various customer applications-including access control systems-without any customization. To manage access rights, the software relies on smart cards or tokens bearing unique user certificates. If the user certificate matches the access rights stored in the user database, Oracle Identity Management will allow the user to access the underlying applications. In addition to cards/tokens and PINs, biometric authentication methods such as fingerprint identification can be used to ratchet up security even more.

Giesecke & Devrient is a member of ACT Canada; please visit http://www.gi-de.com.

7. EDS DELIVERS 10 MILLIONTH SMART CARD TO DEPARTMENT OF DEFENSE
Source: EDS (06/15)

EDS announced it has delivered the 10 millionth smart card to the U.S. Department of Defense (DoD) under an aggressive five-year-old global security program managed by the Defense Manpower Data Center. It is the largest federal government advanced smart card program.

EDS also announced it has been awarded a new contract by the General Services Administration to provide additional smart cards to DoD and has received an initial delivery order for 1.25 million cards. The Java-based smart cards, known as common access or CAC cards, are provided to active duty, reserve, National Guard and DoD civilian personnel and provide authorized users physical access to military sites worldwide and need-to-know entry onto DoD networks and computer systems.

The cards combine identification, physical access and computer access capabilities on a single computer chip and help control access to more than 950 military facilities in the United States and 27 countries throughout the globe.

As the prime integrator for the program, EDS developed and deployed the common access card solution with DMDC beginning in 2001. The company and DMDC work closely to issue the cards, monitor the current database of existing cards and collect the cards when military members leave the service or no longer are required access to certain facilities.

EDS is a member of ACT Canada; please visit http://www.eds.com.

8. WELLS FARGO ANNOUNCES CONTACTLESS CARD ROLLOUT
Source: PRNewswire (06/14)

Wells Fargo & Company announced plans to begin distributing Wells Fargo(R) Visa Platinum Credit Card and Wells Fargo Visa(R) Signature Credit Card with Visa Contactless to customers in the second half of 2006.

"At Wells Fargo, we pride ourselves as being at the forefront of technology solutions that help our customers securely conduct their financial transactions when, where and how they want," said Peter Ho, Wells Fargo Card Services vice president and product manager. "We believe our customers will benefit from the speed and convenience offered by this exciting technology."

Visa Canada Association is a member of ACT Canada; please visit http://www.visa.ca.

9. JCB LAUNCHES NFC PILOT PROJECT IN THE NETHERLANDS
Source: ContactlessNews (06/12)

JCB, the Asia-based global payment brand, together with seven world-class players in payment systems, terminals, NFC and mobile technology, has announced the launch of a pilot project using an NFC contactless credit payment scheme this autumn in Amsterdam.

This project is being run by a joint cooperation among JCB, CCV Holland B.V., Gemplus, KPN, Nokia, PaySquare, Philips and ViVOtech. With the contactless credit payment scheme, consumers can benefit from the convenience of using their mobile phone to make small payments in Amsterdam.

Selected cardmembers will be supplied with a Nokia mobile phone equipped with Philips' NFC chips, loaded with the JCB payment application. Cardmembers will be able to pay at merchants by just waving their mobile phone at the contactless payment terminal.

In the first stage of the pilot, JCB will be targeting approximately 100 card members located in Amsterdam and merchants in and around the city's World Trade Center. On this scale, the pilot is primarily designed to evaluate technological aspects and operational feasibility including customer ease-of-use. The companies involved in this project are hoping to expand both the card member base and merchant locations as the project evolves.

JCB's partners in this pilot are CCV Holland; Gemplus; KPN; Nokia; PaySquare; Philips; and ViVOtech.

10. MASTERCARD TO LAUNCH FIRST PAYPASS PILOT IN UK
Source: CardTechnology (06/15)

The Royal Bank of Scotland will become the UK's first bank to introduce a MasterCard PayPass contactless debit card, an RBS spokesperson tells Card Technology sister publication CardLine Europe. According to the spokesperson, the bank will launch a trial of the cards, which allow consumers to make low-value purchases by tapping the cards against a reader, in Scotland later this month. In the trial, about 3,000 RBS employees who work at the bank's Gogarburn headquarters outside of Edinburgh will receive the cards, which they can use to make purchases below a £10 threshold. The spokesperson says the pilot will pave the way for a large-scale launch of the contactless program across the UK before the end of this year.

MasterCard is a member of ACT Canada; please visit http://www.mastercard.ca.

11. LASERCARD ANNOUNCES $2 MILLION CARD ORDER
Source: LaserCard (06/15)

LaserCard announced receipt of a $2 million order for a sports membership card project in the European Union.

The project will be implemented by MCB Company, a long time LaserCard value added reseller based in Ljubljana, Slovenia. The card order was received from Prevent, a local Slovenian company supporting this program. Shipments are expected to begin this month and be completed in July.

Slovenia has a strong history of supporting the development of sports within its borders, and currently has a paper based sports association membership booklet, which contains information related to the holder's membership and sports history. According to MCB, these paper booklets may be replaced over the coming year with the new, electronic membership card could contain health information, securely stored on the optical memory, in addition to the existing basic data. MCB plans to market the use of this application to other countries.

Richard Haddock, CEO of LaserCard Corporation commented, "According to MCB there are several hundred thousand members in the sports association in Slovenia, and the development of this new application provides an innovative platform for conversion of other such sports membership card programs internationally. We look forward to assisting with the implementation of this program in the coming months."

LaserCard is a member of ACT Canada; please visit http://www.lasercard.com.

12. MORE THAN 20,000 CANADIAN MERCHANT LOCATIONS NOW PARTICIPATING IN THE MASTERCARD QUICK PAYMENT SERVICE PROGRAM
Source: MasterCard (06/05)

MasterCard announced that more than 20,000 merchant locations across Canada are enrolled in the MasterCard Quick Payment Service (QPS) program, which facilitates credit card payment at quick service retailers. MasterCard QPS offers consumers and merchants quick, secure and easy transactions by eliminating the need for a signature or receipt for purchases made with a MasterCard card (up to a specified floor limit per merchant category). MasterCard made the announcement at the Retail Council of Canada's annual conference, STORE, taking place June 5-6 at the Toronto Congress Centre.

MasterCard QPS was developed for use in retail and service environments where speed of payment is critical to the transaction, such as movie theatres, parking garages and quick service restaurants. In 2006, MasterCard QPS was expanded to 12 categories including convenience stores, gas stations and drug stores.

MasterCard is a member of ACT Canada; please visit http://www.mastercard.ca.

13. PHILIPPINES MOVES TOWARD NEW ID CARD
Source: CardTechnology (06/21)

With a Supreme Court decision this spring clearing the way for the project to proceed, the government of the Philippines is planning a 2007 launch of a new identification card carrying biometric data that will replace a variety of health and benefits ID cards. Ultimately, some 25 million Filipinos could carry the new card as part of the project known as the Unified Multi-Purpose Identification System. However, the government has not decided whether the card will carry a chip, magnetic stripe or bar code, and it is possible different agencies will use different technologies.

All the cards will carry a Common Reference Number, which will identify the individual to all the participating service providers. That will enable citizens to access a variety of services with a single card, says Carmelita N. Ericta, administrator of the National Statistics Office and chair of the UM-ID Technical Working Group that is overseeing the technology to be used in the project. "He does not have to present many cards, as we experience now, just to transact with government and private services," Ericta tells Card Technology.

She says there will be a three-month pilot late this year, followed by a rollout in 2007. Among the first to receive the cards will be 1.3 million government employees covered by the Government Service Insurance System (GSIS). Cards will also be distributed to those who receive health care or other benefits from such other government as the Social Security System and the Philippine Health Insurance Corporation. All those over the age of 18 covered by the participating programs will have to carry the ID card, some 25 million individuals.

One side of the card will carry the Common Reference Number plus 14 pieces of information mandated by the executive order creating the program. That data includes name, address, sex, a picture, a signature, date of birth, place of birth, marital status, name of parents, height, weight, biometric data from two index fingers and both thumbs, any distinguishing marks and tax identification number. Each agency issuing the card can use the other side of the card for its own logo and any specific information it requires. To protect privacy, the data from the required fields will be held in a national database to be built by the National Statistics Office, while agency-specific data will be held by the issuing agency.

14. ICC SOLUTIONS ASSISTS WITH DEVELOPMENT OF REQUIREMENTS FOR INTERAC TEST TOOLS
Source: ICC Solutions (05/19)

Publisher's Note: Last month this article ran with an incorrect headline. We apologize for the error.

ICC Solutions is pleased to announce that the company has been selected by Interac Association in Canada to assist with the development of requirements for test tools for the testing and certification of IDP (INTERAC Direct Payment) and SCD (Shared Cash Dispensing) terminal applications, and integrated circuit cards. Additionally, ICC Solutions shall assist with the further definition of testing and certification processes, based on the existing Interac Association "Chip Strategy for Testing and Certification".

The objective of this work is to ensure that Interac Association and its Members have clearly defined requirements for the testing and certification of terminal applications and integrated circuit cards for the INTERAC Shared Services in a chip environment.

The Interac selection decision was partly based on the wealth of experience accumulated by ICC Solutions in chip implementations globally, and because of their broad and intensive knowledge of EMV, specifically with regard to testing and certification activity.

ICC Solutions and Interac Association are members of ACT; please visit http://www.iccsolutions.com & http://www.interac.org.

15. ADDITIONAL STORIES AVAILABLE IN ACT CANADA MEMBERS ONLY SECTION

These additional stories are available to ACT Canada members via the Members Only section of our web site. Click on the link below to access this section.
If you are a member of ACT Canada but do not have your login details please contact me - andrea@actcda.com.
http://www.actcda.com/members-only/members-only-news/

UK BANKS EXPECTED TO MOVE TO DDA EMV CARDS

Of the 6.2 billion card transactions in the UK each year, one in five occurs offline, which increases the risk of cloned cards being used at a retailer's POS terminal. In short, a cloned credit or debit card may go unidentified if a transaction is not sent to a bank for approval…

LED BY BELGIUM, CITIZEN SMART CARDS IN EUROPE FORGE ON

Despite a few initial delays, Belgium is becoming the first European country to standardize the electronic identity card. By the end of 2009, every Belgian citizen will be required to own an e-ID card -11 million cards…

For more information, please contact Andrea McMullen at 1 905 426-6360 ext 124 or email andrea@actcda.com.

Please forward any comments, suggestions, questions or articles to andrea@actcda.com. Please note that articles contained in this newsletter have been edited for length, and are for information purposes only.