April 30, 2003
Welcome to theApril edition of ACTion News. Our newsletter is distributed each month in order to keep you up to date with events in the advanced card industry. This complimentary service is provided by ACT Canada; "building an informed marketplace". It is also available in the Resource Centre of our web site http://www.actcda.com. Please feel free to forward this to your colleagues.


IN THIS ISSUE:
1. Editorial Comment
2. ACT Canada Announces 1st User Of The Privacy Impact Assessment Procedure For Smart Cards
3. Amenity One™ Launches New Cale Devices With Smartcity® Cards
4. Chip-Based Passports Gain Momentum
5. Korean Credit Cards To Be Replaced With Smart Cards
6. U.S. Transportation Worker Pilot To Begin
7. U.S. Homeland Security Agency Plans Big Smart Card Rollout
8. Schlumberger Selected By Desjardins For POS Terminals
9. Metavante Launches Triple Des Processing With Software From ACI Worldwide
10. ERG Selected For Stockholm Transit Fare Collection Project
11. Keycorp Wins Order For POS Systems
12. Austrian Banks To Roll Out High-End EMV Cards
13. Three L.A. County Municipal Bus Operators Joining Regional Smart Card System
14. Pittsburgh Medical Center Expands Smart Card Use


ACT CANADA WOULD LIKE TO THANK OUR NEW & RENEWING MEMBERS:

GENERAL
CPI Card Group ~ member since 1999
Infineon ~ member since 1998
Mint Inc. ~ new member
WorkOne International ~ new member
1. EDITORIAL COMMENT
Source: Catherine Johnston, President & CEO, ACT Canada (04/29)
When is the right time to invest in an emerging market? As you can imagine, it is a question we are frequently asked. ACT Canada also asks the question as we look at our annual programs.

We carefully study indicators and rely on our fourteen years of experience in this market to forecast upcoming activity and trends. The most obvious indications of market growth come from the stories we share with you in this newsletter. Added to that is information that is gleaned from our network, both here and abroad. ACT Canada is very positive about the future of advanced cards in Canada and has invested in several new programs for this year.

In July (7 - 10) we will hold three EMV briefings in Toronto, Ottawa and Montreal. Interest in this payment application standard is growing across Canada as other countries move forward with their conversions. Governments, retailers, the financial sector and the industry are all asking about the opportunities and issues for Canada. We will look at the impact of existing conversions in other countries and how Canadian organizations could be affected.

On June 11th, 2003, MTE (Moving the Economy), in association with ACT Canada, will be holding two Cross-Industry Sessions, as well as a networking lunch, to discuss the opportunities and obstacles of implementing a multi-modal multi-application smart card system for Canada, and to bridge the dialogue across both public and private sectors. Our members have been invited to meet with key players from the transit and transportation sector (transit, highway, car sharing, parking, municipalities).

We are working with the Smart Card Alliance in support of their "Smart Cards in Government - 2003", July 15 - 17th at the Sheraton National Hotel, in Arlington VA overlooking the nearby Pentagon. ACT Canada has reserved a number of exhibit spaces exclusively for our members.

October 16th and 17th are the dates of our annual conference. Join us this year as we investigate, "Cardware: Smart Business". Our focus is on business cases and solutions.

17 other events sit on this year's calendar - each an opportunity for us to represent our members' interest ranging from the promotion of their products and services in the Canadian and export market, to driving market awareness and enthusiasm.

And speaking of investment, we are pleased to introduce our new partnership and annual sponsorship programs. As you can see, we have an unprecedented number of opportunities to raise our members' profiles. Partners have an exclusive opportunity as there will be only one issuer, one industry and one government partner - each an icon within our market.

For information on any of these opportunities and events, please contact us at info(AT)actcda.com. By the way, check out our new home page at www.actcda.com. We look forward to seeing you soon.
2. WORKONE INTERNATIONAL COMMITS TO CLIENT PRIVACY AS 1ST USER OF THE PRIVACY IMPACT ASSESSMENT PROCEDURE FOR SMART CARDS
 Source: ACT Canada (04/24)
ACT Canada is pleased to announce that WorkOne International Inc. is the first multi-action smart card provider to undertake a Privacy Impact Assessment (PIA) as part of its commitment to client privacy. Catherine Johnston, President and CEO of ACT Canada said, "This is a major step in demonstrating to Canadians that smart cards can protect their privacy."

The strength of the PIA procedure is that it provides an easy way for designers to assess privacy issues and identify appropriate solutions to achieve reliable levels of privacy in their company's smart cards as well as in corporate databases, paper forms and reports, and on remote devices. Johnston added, "Organizations can now produce useful applications that are sensitive to all privacy concerns by incorporating privacy protection through every stage of development and implementation."

The PIA procedure was developed by ACT Canada and the Office of the Information and Privacy Commissioner/Ontario (IPC) to help companies and organizations implement privacy protection. "I am pleased to see that WorkOne International has utilized our tool to assess the privacy capabilities of its smart cards," notes IPC Commissioner Ann Cavoukian. "I congratulate them on showing a commitment to protect the privacy of its card holders by being the first official user. I also applaud Catherine Johnston in her efforts to advance privacy protection."

WorkOne is a worker credentialing system that allows individuals to carry a smart card that stores their particular accredited job-related qualifications and certifications.

Don Mahnke, President of WorkOne said, "We believe it is critical to protect our clients' personal and business-related data. We found that the PIA procedure guided us through a very thorough assessment of the privacy requirements, which resulted in a stronger and better product."

WorkOne is a member of ACT Canada. For more information please visit their web site at http://www.workoneinc.com. The aforementioned PIA is available on the ACT Canada web site at http://www.actcda.com.
3. AMENITY ONE™ LAUNCHES NEW CALE DEVICES WITH SMARTCITY® CARDS
Source: Coinamatic (04/28)
Coinamatic Canada Inc., under its new international brand name Amenity One™, has added another smart card service to it's SmartCity® program by signing a long term, exclusive distribution agreement with CALE Access of Solna, Sweden, for the provision of CALE Pay & Display parking terminals across Canada.

The CALE devices are equipped with Coinamatic's proprietary SmartCity® smart cards and Coinamatic Token Technology™, which allow anytime self-issuance of parking and other permits by residents and consumers, and the ability for municipalities, universities, colleges, businesses and apartment owners to give free parking services on a controlled basis.

The AmenityOne™ program for residential, college, commercial and municipal accounts was developed by Coinamatic's SmartCity® Solutions Group. SmartCity® is a technology platform for retail loyalty, public transit, access control, vending and other applications using a single multi-purpose smart card, a national reloading infrastructure including cashless Debit-Credit reload centers, and a large user base with impressive demographics, all of which are available under the AmenityOne™ brand name.

The hybrid readers in the CALE devices contain single-slot technology that accepts both credit and smart cards. Consumers can also use e-purses on their SmartCity® card to pay for parking fees with either pre-defined "tokens" or loyalty points.

Coinamatic is a member of ACT Canada. For more information please visit their web site at http://www.smartcity-parksmart.com.
4. CHIP-BASED PASSPORTS GAIN MOMENTUM
Source: CardTechnology (04/24)
Facial recognition and contactless smart card chips will be the technology combination recommended for travel documents by a committee of the influential International Civil Aviation Organization at a meeting early next month. Jacques Perron, international liaison for the Canadian Passport Office who has been working with ICAO on the standards, says a passport-holder's facial image will be stored on the contactless chip so it can be checked when they cross a border. A contactless chip can be embedded into a passport cover or page and then read when held near a reader, which emits a radio signal. ICAO prefers facial biometrics because passport applicants already have their pictures taken, while privacy concerns make other biometrics less appealing, Perron says. ICAO, a Montreal-based organization of 188 nations that plays a major role in setting global travel standards, will make its recommendation s in an effort to insure interoperability between countries, Perron says. The ICAO recommendation could have a major impact in the next few years, as the United States is requiring all foreign nationals entering the country to present travel documents carrying biometric data by October 2004. The same legislation requires that the U.S. comply with the standard ICAO comes up with. The ICAO committee will officially endorse facial recognition and contactless chip at a meeting in Montreal May 6 - 9. But it will probably be another three months before ICAO officially approves the recommendation.

The Canadian Passport Office is a member of ACT Canada. For more information about either of the above listed organizations, please visit their web site: http://www.passport.gc.ca and http://www.icao.int.
 
5. KOREAN CREDIT CARDS TO BE REPLACED WITH SMART CARDS
 Source: ICMA Daily News (04/23)
The Financial Supervisory Committee (FSC) decided on April 22 that it will introduce high-tech smart cards to eliminate counterfeit cards by 2008.

It also determined to increase the password digits from the current 4-digits to 6 digits as part of its plan to introduce smart cards. It will announce its final decision at the end of this month after coordinating with related authorities.

The FSC will phase in smart cards and will make it mandatory to apply IC to cash cards, credit cards and terminals beginning from next year.

The related industry predicts that with the introduction of smart cards, a new market worth 6 trillion won will be created over 5 years till 2008. This figure is calculated based on the 1.5 trillion won for replacing 160 million cards and 4.5 trillion won for upgrading 60 thousand ATMs. The industry expects that the smart card market will be facilitated beginning from next year.
6. U.S. TRANSPORTATION WORKER PILOT TO BEGIN
 Source: CardTechnology (04/01)
The U.S. Transportation Security Administration plans to begin a five-month pilot later this month to evaluate technologies for a planned standard ID card for some 12 million U.S. workers in airports, seaports, railyards, trucking and bus terminals. The test will take place in the Philadelphia and Los Angeles areas, a TSA spokesperson says. Following the test, the TSA plans a 7-month prototype phase, and could roll out the Transportation Workers Identification Credential, or TWIC, as early as next year. The pilot will evaluate five technologies for storing biometric and other personal data: smart card, optical memory stripe, magnetic stripe, linear bar code and two-dimensional bar code. Congress has allocated TSA $35 million for this fiscal year to develop the TWIC card. The government's fiscal year ends Sept. 30.
7. U.S. HOMELAND SECURITY AGENCY PLANS BIG SMART CARD ROLLOUT
 Source: CardTechnology (04/21)
In what is likely to be the second-largest smart card ID program in the U.S. government, the Department of Homeland Security plans to issue a chip card that incorporates features of the Department of Defense Common Access Card and adds some new features. The department expects to begin issuing the new ID cards this fall, and should complete a rollout to between 180,000 and 200,000 employees within a year, says Joe Broghamer, security architect for the agency formed this year to coordinate domestic security efforts. Like the Defense Department card, which has been issued to more than 2 million civilian and military personnel on the way to a rollout of 4 million cards, the Homeland Security card will be based on the Java Card operating software and will carry three digital certificates to cardholders can identify themselves to computer networks, encrypt electronic documents and digitally sign e-mail. The Homeland Security card, however, will carry 64 kilobytes of rewriteable memory for applications and data, compared with 32K for the current Defense Department card. And Homeland Security plans to add a second chip, a contactless chip that communicates with readers via radio frequency, for building access. That chip will conform to the ISO 14443 standard for contactless smart cards, Broghamer says. He says it likely will be fall before there are such dual-chip cards with 64K of memory on the contact chip available from at least smart card vendors, a requirement before the agency can go ahead with its rollout. He adds that two chips provides additional security, because, even if hackers were able to crack the security of the contactless chip they would not have access to the even more crucial security codes on the contact chip, which are used to identify cardholders accessing corporate networks and exchanging data electronically. The Department of Defense also plans to move to 64K or memory and to add contactless capability for building access, features that could be added to the Common Access Card starting next year, say Pentagon officials.
8. SCHLUMBERGER SELECTED BY DESJARDINS FOR POINT-OF-SALE TERMINALS
Source: Schlumberger (04/07)
Schlumberger Smart Cards and Terminals announced the deployment of terminals for the Canadian company, Desjardins. Desjardins has given an order for a multi-million dollar project for point-of-sale terminals incorporating the state-of-the-art MagIC 9000 product family (corded, cellular and radio frequency models).

The terminal's open platform and multi-application capabilities allows customers to use the terminals in retail stores, hospitality and industry solutions, restaurants, theaters, gas stations and for transit operators.

The versatile, multi-application Schlumberger MagIC 9000 terminal can serve as a stand-alone payment terminal and be integrated with third party software. Additionally, the MagIC 9000 terminal can also house gift certificate and loyalty applications for the service provider. The common platform allows for portability of applications through out different products and services, and the wireless application increases the speed of time-to-market for the customers' businesses.

SchlumbergerSema is a member of ACT Canada. For more information about either of the above listed companies, please visit their web site: http://www.slb.com/smartcard and http://www.desjardins.com.
9. METAVANTE LAUNCHES TRIPLE DES PROCESSING WITH SOFTWARE FROM ACI WORLDWIDE
 Source: ACI Worldwide (04/03)
ACI Worldwide announced that Metavante Corporation, the financial technology subsidiary of Marshall & Ilsley Corporation, is using ACI's BASE24® Transaction Security Services software to provide Triple Data Encryption Standard (DES) processing services. Metavante is making the Triple DES services available to its EFT and Card solutions clients and has implemented Triple DES-capable ATMs for Peoples National Bank, Fairfield, Ill.

Metavante is ACI's first customer to add the new Transaction Security Services module to its BASE24 production environment to launch Triple DES processing services. Transaction Security Services is built on ACI's new multi-platform Enterprise Services software and manages all cryptographic functions, such as PIN verification, message authentication, chip authentication and card verification. The module provides an end-to-end Triple DES processing solution across the entire transaction path, including PIN encryption at ATMs, PIN verification during authorization, and encryption for switching to and from card networks.

Triple DES - which replaces the current personal identification number (PIN) encryption standard - triples the encryption algorithm used to protect PIN data. Its use was required by April 1, 2003, for MasterCard members and processor host systems and financial institutions that accept MasterCard or Cirrus transactions at any new, relocated or replaced ATM installed after April 1, 2002.

ACI's Transaction Security Services combines support of Single and Triple DES, allowing customers to process in a mixed environment until card association and network mandates require them to completely adopt Triple DES. The module is certified with NCR, Diebold and Fujitsu brand ATMs, and supports hardware security devices from Thales e-Security, HP Atalla Security Products Group and Eracom Technologies.

ACI Worldwide is a member of ACT Canada. For more information about either of the above listed companies, please visit their web site: http://www.aciworldwide.com and http://www.metavante.com.
10. ERG SELECTED FOR STOCKHOLM TRANSIT FARE COLLECTION PROJECT
Source: ERG Group (04/01)
ERG Group signed a contract with Stockholm's public transport authority, AB Storstockholms Lokaltrafik (SL), to implement a smart card based automated transit fare collection system throughout the city and county of Stockholm. The project, known as Resekortet (the Travel Card Project), will generate revenues in excess of A$49 million (SEK 250 million) plus maintenance to ERG over the term of the system implementation.

The contract involves the upgrade of the current magnetic ticketing system to ERG's faster, more efficient smart card platform. The contract provides for the integration using smart cards across SL's entire public transport network, comprising 150 rail and metro stations and more than 1,800 buses. ERG will install its central computer processing system to manage the smart card database, financial reconciliation and management reporting. The network currently handles over 2.4 million passenger trips a normal weekday and generates approximately A$690 million (SEK 3.5 billion) in ticketing revenue annually.

The project calls for the issue of 1 million smart cards within the next 2½ years. Work is expected to commence on the project by early April 2003, with revenues flowing from 1 April 2003. The new system is expected to be fully operational by the fourth quarter of 2005.

"I am delighted that this project is now under way and that the citizens of Stockholm city and county will be provided with a state-of-the-art ticket system throughout all our various modes of transport," said Mr Gunnar Schön, Managing Director of SL. "Furthermore, the new system will also be an important cornerstone in establishing the Swedish transport smart card specification (the RKF specification) throughout all of Sweden's Public Transport Authorities. An equally important cornerstone will be the possibility to establish a seamless travel card system in the Mälardalen Region, the single biggest public transport network in Sweden covering 75% of all public transport in our country."

ERG Group is a member of ACT Canada. For more information please visit their web site at http://www.erggroup.com.
11. KEYCORP WINS ORDER FOR POS SYSTEMS
Source: Keycorp (04/02)
Keycorp Limited announced it has secured an order for over 1000 K26 terminals and peripherals from Global Payments Inc. This order, following the announcement of a multi-year agreement on 28 August 2002, will further enhance the already solid relationship that Keycorp Canada Inc and Global Payments have developed over a number of years.

Global Payments, one of the world's leading providers of electronic processing services, serves more than a million merchant locations in Canada and the US, processing over 2.7 billion transactions a year.

Global Payments will offer the Retail @dvantage K26 and the Travel and Entertainment @dvantage K26 developed jointly by Keycorp and Global Payments for small and mid-sized merchants in the general retail, travel and entertainment industries. Global will be able to offer its clients express processing ability by providing increased memory, client-specific logo and graphic download ability, secure backlit PINpad, and a built-in high speed thermal printer.

"Helping our customers accept payment cards more effectively and efficiently is critical," said Jordan E. Cohen, President of Global Payments Canada Inc. "The features and added functionality of the K26 POS platform and our flexible suite of applications enables Global Payments to provide our Canadian customers with a wider choice of products to meet their demanding needs."

"One of the key factors in our relationship is the way we work together to develop value-added solutions that are tailored to the requirements of the Global Payments client base," said Paul DeRosse, Managing Director, Keycorp Canada. "Keycorp's local resources will ensure Global Payments is able to meet the demands of its customers for high performance, accessible point of sale solutions."

Keycorp Canada is a member of ACT Canada. For more information about either of the above listed companies, please visit their web site: http://www.keycorp.net and http://www.globalpaymentsinc.com.
12. AUSTRIAN BANKS TO ROLL OUT HIGH-END EMV CARDS
Source: CardTechnology (04/17)
Austria promises to be the first country where banks will complete a rollout of EMV debit and credit cards that support the high-end authentication process, dynamic data authentication.

The country's banks and their issuing, acquiring and processing arm, Austrian Payment Systems Services, plan to begin in January to replace their domestic chip-based payment cards with cards that comply with international EMV specifications, says Max Paul, marketing director for Vienna-based Austria Card, the card supplier. They are scheduled to complete the 8-million-card EMV rollout by the end of the year.

Because banks in Austria process most of their card transactions offline, at the point-of-sale terminal, they decided not to begin their rollout with cards that support the low-end authentication process available in the EMV specifications, known as static data authentication, or SDA-as banks in the United Kingdom and other countries are doing. Instead, the five large Austrian banks or banking groups and others in the country will jump right to high-end DDA security for their 6 million debit cards and 2 million credit cards, Paul says. DDA is more secure than SDA for offline transactions because when a POS terminal challenges a card to authenticate itself, the card processes a unique crypotographic response for each transaction. SDA cards do not and are, thus, more vulnerable to offline fraud. The banks plan to launch a test of the DDA cards in September.

In addition to the EMV application, the cards will carry Austria's chip-based domestic debit application, its "Quick" electronic purse and a digital signature application. The latter will remain dormant until cardholders activate their digital certificates stored on the cards. At least one bank plans to use this application to test a home-banking service, Paul says.
13. PITTSBURGH MEDICAL CENTER EXPANDS SMART CARD USE
Source: CardTechnology (04/08)
The University of Pittsburgh Medical Center plans this summer expanded tests of smart cards for patients and doctors. Between 1,000 and 5,000 patients will receive smart cards that carry their personal and insurance data, as well as records of their allergies, medications and medical conditions. This is an expansion of a test with 300 patients who can register themselves at one clinic by inserting their smart cards into a kiosk. That has cut the registration time from 10 minutes to 6 minutes, says Scott Gilstrap, director of technology solutions at the medical center, a network of 19 hospitals in western Pennsylvania. In addition, 300 doctors will get smart cards in May that will enable them to access data from an Internet site, building on a test with 10 physicians that began in December. Gilstrap says smart cards appear to be a cost-effective way to improve access to patient data and to comply with the Health Insurance Portability and Accounting Act, a U.S. law coming into effect this month that provides stiff penalties in the event of the unauthorized release of e