Stakeholders Driving Payment Evolution and Digital Identity

October 2006 ACTion Newsletter

IN THIS ISSUE

1. Editorial Comment
2. Canadians Reactions To EMV Payment
3. Department Of Homeland Security Proposes To Expand Use Of Vicinity Radio Frequency Identification
4. Transit Smart Card Closer To Reality - GTA Multi-City Project To Start In Mid-2007
5. Giesecke & Devrient Opens State-Of-The-Art Smart Card Facility In Canada
6. NFC Pilot Project Launched In Europe
7. Gemalto To Supply The E-Passport Solution For Estonian Republic
8. Giesecke & Devrient Provides Cards For First Contactless EMV Card In Europe
9. Keycorp Buys Canadian ETPOS Firm
10. Consumers Acceptance Of Prepaid Cards Will Play Major Role In Profitability Of European Banks
11. Spain Launches ID Card Based On STMicroelectronics' Secure Smart Card Chip
12. Denmark Rolls Out E-Passports Based On Gemalto Technology
13. SCM Microsystems' Smart Card Readers Receive Qualification For Use In HSPD-12 Program
14. ACI Joins Consortium Of Suppliers To Develop And Deliver E-Passport Solution
15. Seoul Taxis To Accept Transit Cards
16. Additional Stories Available In Members Only Section

ACT CANADA THANKS OUR NEW & RENEWING MEMBERS

PRINCIPAL

Canadian Tire Financial Services ~ new

GENERAL

Integri ~ new
NXP ~ new
StepNexus ~ new

GOVERNMENT

Ministry of Government Services (Ontario) ~ new 

UPCOMING EVENTS

Cartes & IT Security 2006
November 7 - 10, 2006
Paris, France
http://www.cartes.com
Visit ACT Canada in booth 4H 061

1. EDITORIAL COMMENT
Source: Catherine Johnston, President & CEO, ACT Canada (10/27)

Border Crossing Identification: Haste makes Waste?

There is no question that good personal ID makes sense for border crossings, but is there a rush to implement a US card that might cause more harm than good? The US Department of Homeland Security and Department of State have drawn swift reaction from the card industry by proposing a technology that is not recommended for human identity management, but rather used to monitor the movement of goods.

If you have read my editorials, you know that I advocate taking steps to improve situations and raise the bar, rather than seeking the elusive perfect solution. While taking that route, the US government doesn't go far enough.

It is proposed that RFID tag technology be issued to Americans traveling to Canada and Mexico without passports. When returning home, the tag can be read 20 feet before the person reaches the border officer and the ID number opens the citizen's databased record. This is to meet the need for speed at the border, but does it? Is there not a need to ensure that all people in the vehicle have this ID and that the tag they carry is theirs? Was the shielded envelope so that the tag could be read? Are the tags authentic, or cloned?

The bigger issue is why they are rushing to implement a technology that differs from the electronic passport (ePassport) they require from Visa waiver countries. Should we be concerned that, unlike the ePassport, no third party standards body has been involved to develop specifications for the protection and use of personal information?

Does having two different technologies and procedures increase or decrease security at the border? Why add to the infrastructure costs? Does RFID provide sufficient security? For starters, they are easy to clone and the traveler must keep it in a shielded envelope. Any time it is removed the ID number is exposed. Will that envelope fit into a wallet and if not, how will people carry it? The personal data record sits on a database, raising security and privacy concerns and certainly costs.

So why should any of this be an issue for Canadians? If this is just for Americans it shouldn't impact Canada or Mexico, but let's look at the longer term. Neither country has access to the proposed database, so these cards are useless as a means to identify Americans crossing our borders. How long will it be until the US suggests they will provide access if we join this program? Are we ready or willing to share citizens' information? The answer should be no. We don't do that when passports are used and Canadians are very privacy conscious. The political backlash would likely be significant.

e-Passports, using tamper and counterfeit resistant contactless technology can meet the requirements for transaction speed, procedural and cost efficiency and most important - citizen security, privacy protection and global interoperability.

Haste makes waste in this case, but far more important are the issues of privacy and security, - and perhaps in our case - sovereignty.

*****
ACT Canada is pleased to announce that we are in the final review process of the Contactless and RFID Privacy Design Tool and Privacy Impact Assessment Procedure. Draft copies are now available.

2. CANADIANS REACTIONS TO EMV PAYMENT
Source: ACT Canada (10/27)

ACT Canada and Ipsos Reid are very pleased to announce the go-ahead for the "Chip Cards in Canada: 2006 " market research. The survey will be undertaken in Q4 and the report available early in the new year and will provide timely information for all EMV stakeholders.

As plans move forward, it will be important and valuable for issuers and acquirers, as well as merchants to understand how Canadians feel about chip, fraud, biometrics, loyalty, e-purse, fees, home banking and many other elements related to chip based payment products. This information provides insights for strategic plans.

For more information, please contact ACT Canada or David Saffran Senior Vice President, Ipsos Reid Corporation (416) 324-2006, David.Saffran@ipsos-reid.com.

3. DEPARTMENT OF HOMELAND SECURITY PROPOSES TO EXPAND USE OF VICINITY RADIO FREQUENCY IDENTIFICATION
Source: ICMA Daily News (10/18)

The Department of Homeland Security (DHS), in conjunction with the Department of State's proposed rulemaking on the new PASSport card, announced that it proposes to expand the use of vicinity radio frequency identification (RFID) technology at U.S. ports of entry. The vicinity RFID technology, to be compatible with the PASSport card, would allow a travel document to be read from several feet as a vehicle approaches inspection. The PASSport card, part of the People Access Security Service (PASS) System, is designed to meet the specific requirements of the Western Hemisphere Travel Initiative (WHTI) for U.S. citizens crossing U.S. borders by land or sea.

WHTI is the U.S. government's plan to implement a provision of the Intelligence Reform Terrorism Prevention Act of 2004, which requires citizens of the United States, Canada, the British Overseas Territory of Bermuda and Mexico to have a passport or other designated document that establishes the bearer's identity and nationality to enter or re-enter the United States. The proposal to expand the use of vicinity RFID technology is another step in the U.S. government's layered plan to enhance our nation's security, ensure the integrity of our immigration system, facilitate the flow of legitimate travel and trade, and protect the privacy of our citizens and visitors.

To protect the privacy of Americans who opt to use the PASSport card, no personal information will be stored or transmitted on the RFID chip on the card. The technology will transmit only a number between the card and the reader which will be matched against a DHS database. While no personally identifiable information will be transmitted, DHS is taking steps to help ensure that this number cannot be intercepted during transmission to an authorized reader at a port of entry.

The proposed PASSport card would serve as an alternative to a traditional passport book for use by U.S. citizens who cross the land borders and travel on cruises to Canada, Mexico and the Caribbean. Frequent border crossers would benefit most readily from this new limited-use PASSport card. It would provide evidence of identity and citizenship, would be convenient to carry and would cost less than the traditional passport book. U.S. citizens would be able to apply for the PASSport card using the same forms and procedures as currently exist for the PASSport book.

The proposed regulations on the PASSport card are available for public viewing and comment at the Regulations website ( Regulations.gov ) for a 60 day comment period. For more information, visit the Department of Homeland Security website or Travel Section of U.S. Department of State.

Editor's Note - Please see the editorial comment for ACT Canada's response to this press release.

4. TRANSIT SMART CARD CLOSER TO REALITY - GTA MULTI-CITY PROJECT TO START IN MID-2007
Source: Toronto Star (10/13)

IA fare card that can be used on any transit system in the GTA is one step closer after the province awarded the 10-year, $250 million contract to design and implement the system.

The system will be running by 2010 and will be built by Accenture, a management consulting and technology services company, a provincial official said.

Under the proposed system, commuters from several transit systems operating in the GTA would use the same payment card, called a smart card, to move between transit systems stretching from Hamilton to Oshawa - with one exception.

The Toronto Transit Commission is still deciding if it makes financial sense for TTC customers to climb on board.

5. GIESECKE & DEVRIENT OPENS STATE-OF-THE-ART SMART CARD FACILITY IN CANADA
Source: ICMA Daily News (10/10)

Giesecke & Devrient (G&D) officially opened their new facility in Markham, Ontario, Canada. Situated in Canada's high technology capital, in the greater Toronto area, the facility hosts the latest technology in physical and logical security, equipment and processes. The new Canadian facility offers complete end-to-end smart card solutions for the North American market and will be developing innovative solutions based on smart card technology. With double the footprint of their previous facility, G&D Canada has enough capacity to meet North American demands for smart cards used in electronic payment systems, high security ID documents, and new applications, such as, customer loyalty programs.

The key physical focus of the new production facility is in the protection of client assets and data integrity. It has therefore been equipped with the latest in highly sophisticated security systems including biometric authentication.

The facility provides complete card solutions that cover the entire lifecycle of a smart card, from the development of card applications and card design through to printing the laminated cards, embedding the chips, card personalization, and shipping. The production facility is certified by VISA, MasterCard, and AMEX.

Giesecke & Devrient, MasterCard and Visa Canada Association are members of ACT Canada; please visit http://www.gi-de.com; http://www.mastercard.ca & http://www.visa.ca.

6. NFC PILOT PROJECT LAUNCHED IN EUROPE
Source: ContactlessNews (10/19)

JCB with CCV Holland B.V., Gemalto, KPN, Nokia, NXP Semiconductors (formerly Philips Semiconductors), PaySquare, and ViVOtech, announced they have successfully launched Mobile J/Speedy, the Near Field Communication (NFC) mobile payment pilot project in Amsterdam. Following initial trials in September, the pilot service is now being rolled out to a broader group of JCB's customers. The project marks Europe's first contactless international credit payment scheme using a mobile phone with an NFC chip.

This project is being carried out with close collaboration among these regional and global enterprises addressing the whole ecosystem for mobile payment applications. Selected JCB cardholders are provided with a mobile phone by Nokia, which is equipped with an NFC chip, developed by NXP and loaded with the JCB payment application specified by JCB and developed by Gemalto. At selected PaySquare merchants, cardholders can securely purchase items by just holding their mobile phone close to ViVOtech's contactless NFC reader/writer, which is attached to the payment terminal of CCV. KPN is taking the role of installing the application and personalizing the mobile phones, and CCV is processing the transactions. JCB designed the scheme and coordinated the project based on its successful experience in contactless technology in Japan.

Gemalto and NXP are members of ACT Canada; please visit http://www.gemalto.com & http://www.nxp.com.

7. GEMALTO TO SUPPLY THE E-PASSPORT SOLUTION FOR ESTONIAN REPUBLIC
Source: ICMA Daily News (10/20)

Gemalto announced it will supply the Citizenship and Migration Board of Estonian Republic with its e-passport solution for the future Estonian electronic passport. Under the terms of the contract, Gemalto will provide the Estonian authorities with a turnkey solution, from manufacturing and binding of passport booklets, using Gemalto Setec* technology, to the implementation of the personalization system in the premises of the Citizenship and Migration Board under the Ministry of Interior. First deliveries are scheduled to start in early 2007.

The agreement runs through 2012 with a possible extension to 2015. Considering present passports issuance rates and plans, it could involve up to one million electronic passports.

Gemalto is a member of ACT Canada; please visit http://www.gemalto.com.

8. GIESECKE & DEVRIENT PROVIDES CARDS FOR FIRST CONTACTLESS EMV CARD IN EUROPE
Source: ICMA Daily News (10/05)

Staff at the Royal Bank of Scotland's head office in Gogarburn, Edinburgh can now make payments by simply tapping their cards on a reader in a number of outlets on the Gogarburn site.

This summer, the Royal Bank of Scotland (RBS) began conducting a trial using dual interface EMV debit cards, the first financial institution in Europe to do so. The cards were supplied by Giesecke & Devrient (G&D).

RBS, MasterCard and G&D, working in close cooperation, have now brought a dual interface EMV product powered by MasterCard's PayPass technology to the UK market, and expect to see solid growth in this sector over the next three years.

During the trial, RBS employees are using the cards to make purchases worth up to 10 British pounds on the Bank's premises in Gogarburn, near Edinburgh. The RBS facilities are ideal for the trial since they contain a range of outlets where the cards can be used, which together represent a miniature version of the "real" shopping world.

Giesecke & Devrient and MasterCard are members of ACT Canada; please visit http://www.gi-de.com & http://www.mastercard.ca.

9. KEYCORP BUYS CANADIAN EFTPOS FIRM
Source: The Globe and Mail (10/12)

Keycorp has acquired Optimal Services Group (OSG), a Canadian EFTPoS services provider, at a cost of A$3 million (US$2.23 million). OSG, which is based in Montreal, specializes in the installation and repair of point-of-sale systems for retailers and payment processors.

In a statement, Keycorp says that the acquisition will "provide the infrastructure platform to launch managed payment services in the Canadian market, services that Keycorp's leading customers are now requesting it provide." Keycorp supplies payment terminals, software and services in Australia and Canada.

"Our strategy is to continue to move away from straight product sales to managed services, software and solutions," Bruce Thompson, Keycorp's CEO, told corporatefile.com.au, an Australian investment news service. Thompson said that, with Canada's imminent move to EMV (Europay MasterCard Visa) chip-and-PIN technology, it is important for Keycorp to be in at the start of the EMV compliance program that the Canadian payments industry faces.

Keycorp is a member of ACT Canada; please visit http://www.keycorp.net.

10. CONSUMERS ACCEPTANCE OF PREPAID CARDS WILL PLAY MAJOR ROLE IN PROFITABILITY OF EUROPEAN BANKS
Source: ICMA Daily News (09/28)

Since the announcement of the Single Euro Payments Area (SEPA) directive - which requires cross-border payments to be treated in the same manner as domestic payments - Europe's movement towards a "harmonized" market has left many European banks challenged relative to becoming more profitable. SEPA is pushing banks to find new motivators to increase customer usage of low-cost payment instruments such as credit, debit, and charge cards, as opposed to high-cost instruments such as checks.

As European banks increase fees for cash and checks while providing discounts and incentives for online or card payments, new research from TowerGroup finds that a sharp rise in the deployment of prepaid products over the next 10 years will be key to supporting bank profitability. However, TowerGroup believes that European banks success will be elusive as long as the use of cash remains high - underscoring the need for a true debit-based alternative that does not include identity recognition as part of the electronic payment.

Prepaid cards offer a solution that can be as anonymous as cash, yet work with both online and offline payments. This direct substitute for today's cash and check options will offer Europe's banks an ideal mechanism to achieve efficiencies after SEPA goes into effect. TowerGroup estimates that by 2010, prepaid cards usage will be EUR75 billion, a 600% increase over 2005, with 375 million cards will be in circulation, a 1,000% increase over 2005.

11. SPAIN LAUNCHES ID CARD BASED ON STMICROELECTRONICS' SECURE SMART CARD CHIP
Source: SecureID News (10/10)

STMicroelectronics announced that its ST19WL34 secure microcontroller -- certified to the high 'Common Criteria' EAL5+ (Evaluation Assurance Level) security standard -- powers the new Spanish national ID Card scheme.

The ID Card roll-out started in February 2006, the successful culmination of a three-year development and qualification program with FNMT-RCM (Fabrica Nacional de Moneda y Timbre -- Royal Casa de la Moneda), Spain's national printing office. Spanish police issued around 7,000 cards as the project ramped up in the first half of 2006, in Burgos, near Madrid. Now it is available in 13 other cities, and 500,000 cards are expected to have been deployed by the end of the year, with 2 million forecast in 2007, and 6 million in 2008. Ultimately, more than 30 million Spanish citizens will benefit from the card.

STMicroelectronics is a member of ACT Canada; please visit http://www.st.com.

12. DENMARK ROLLS OUT ELECTRONIC PASSPORTS BASED ON GEMALTO TECHNOLOGY
Source: ICMA Daily News (10/03)

Gemalto announced that the Danish National Police has started issuing electronic passports that integrate its most advanced Setec* secure technology. For this nationwide deployment Gemalto manages the entire delivery process. In addition to its secure electronic passport software and high security polycarbonate data page technologies, Gemalto will provide passport booklet assembly and individual personalization of each passport.

The agreement runs through to 2009, with an option for two additional years. The Danish authorities plan to incorporate the electronic capability in all new passports from now on and are expected to issue some 250,000 by the end of 2006. Between 700,000 and 800,000 traditional passports are issued annually.

Gemalto is a member of ACT Canada; please visit http://www.gemalto.com.

13. SCM MICROSYSTEMS' SMART CARD READERS RECEIVE QUALIFICATION FOR USE IN HSPD-12 PROGRAM
Source: SecureID News (10/19)

SCM Microsystems, Inc. announced that nine of its secure smart card readers have been determined to be compliant with Homeland Security Presidential Directive (HSPD)-12 and have thus been included on the Government Services Administration's (GSA) Approved Product List. The GSA list governs which products and services may be purchased by federal agencies for the HSPD-12 program.

HSPD-12 is the presidential order that requires all government employees and contractors to carry a standard identity credential that works across all agencies. The credential, in the form of a smart card, is intended to be used for secure access to facilities (physical access) and for securely logging on to government computers or networks (logical access). Over six million federal workers and contractors are expected to carry an identification card under HSPD-12 by October 2007. Smart card readers will be required at all agencies to support both physical and logical access. These will be installed over the next few years.

SCM Microsystems is a member of ACT Canada; please visit http://www.scmmicro.com.

14. ACI JOINS CONSORTIUM OF SUPPLIERS TO DEVELOP AND DELIVER E-PASSPORT SOLUTION
Source: ACI Worldwide (10/19)

ACI Worldwide announced that the company has been selected as the exclusive supplier of the Travel Document Management System for the Electronic Passport System (e-Passport) of the Immigration Department, Hong Kong. The e-Passport project will leverage ACI Smart Chip Manager software to offer the Hong Kong Immigration Department an end-to-end solution for e-passport issuing and lifecycle management - including stock management and post issuance updating.

The e-Passport project was started in January 2006. The system is set up to produce 3500 electronic travel documents per day.

ACI Worldwide is a member of ACT Canada; please visit http://www.aciworldwide.com.

15. SEOUL TAXIS TO ACCEPT TRANSIT CARDS
Source: ICMA Daily News (10/23)

The Seoul metropolitan government said that transportation cards including pre-paid, T-money and credit cards can be used in taxis starting next year.

According to the plan, about 3,500-5,000 taxis will be equipped with the transportation card device for a three-month trial operation, and the city will install the devices in all taxis in Seoul during the first half of the year.

Currently, Seoul has 72,000 taxis and they accept only cash. After receiving feedback from citizens, the city government will consider making it compulsory for taxi drivers to install the card devices.

16. ADDITIONAL STORIES AVAILABLE IN ACT CANADA MEMBERS ONLY SECTION

These additional stories are available to ACT Canada members via the Members Only section of our web site. Click on the link below to access this section.
If you are a member of ACT Canada but do not have your login details please contact me - andrea@actcda.com.
http://www.actcda.com/members-only/members-only-news/

FRENCH BANK TO COMBINE NFC WITH EMV FOR PAYMENT TRIAL

French banking group Crédit Mutuel-CIC, along with MasterCard Worldwide and a French mobile network operator, plans to launch a test next month of contactless payment using handsets that comply with Near Field Communication technology…


STANDING OUT FROM THE CROWD; A FEW BANKS HAVE PUT NEW APPLICATIONS, SUCH AS LOYALTY PROGRAMS AND CONTACTLESS PAYMENT, ONTO EMV CARDS. WHAT'S HOLDING BACK THE REST?

A chip-based loyalty program came first. Then, earlier this year, Turkey's Garanti Bank began issuing some 20,000 contactless payment cards with MasterCard Worldwide's PayPass application. It was Europe's first commercial PayPass pilot...

For more information, please contact Andrea McMullen at 1 905 426-6360 ext 124 or email andrea@actcda.com.

Please forward any comments, suggestions, questions or articles to andrea@actcda.com. Please note that articles contained in this newsletter have been edited for length, and are for information purposes only.