August 28, 2003
Welcome to the August edition of ACTion News. Our newsletter is distributed each month in order to keep you up to date with events in the advanced card industry. This complimentary service is provided by ACT Canada; "building an informed marketplace". It is also available in the Resource Centre of our web site http://www.actcda.com. Please feel free to forward this to your colleagues.

If you would prefer to receive this newsletter in plain text please send your request to andrea(AT)actcda.com.

This newsletter has been sponsored by ACT Canada's 2003 Partner:

A Coinamatic Company

IN THIS ISSUE:
1. Editorial Comment
2. Target Says Its Success Is In The Cards
3. ACI Worldwide & HP Canada Host EMV Seminar In September
4. G&D Receives Security Certification For Digital Tachograph
5. ATM Swipe-&-Snap Scam Netted $620,000, Court Told
6. Shell Customers In Bulgaria Can Register For Smart Cards Online.
7. Schlumberger Easyflow Technology Used In London's Oyster Program
8. CATA & SMART Toronto Technology Alliance Merge
9. Rainbow Technologies Enters Into A Letter Of Intent To Acquire Chrysalis-ITS
10. Bank Of Moscow To Test EMV With Social Card


ACT CANADA WOULD LIKE TO THANK OUR NEW & RENEWING MEMBERS:

GENERAL:
Ingenico ~ member since 1990
MIST Inc./NBS Card Technology ~ member since 1995

ASSOCIATE:
IMS-MTE ~ new member


Breaking Through Card Barriers - stimulating consumer/public contact
Conference & Exhibition
October 16 & 17, 2003
Ontario Bar Association Conference Centre
20 Toronto Street, Toronto, ON

This unique event has keynote speakers and experts working directly with issuers through a series of small, focused discussion and work groups. Using case studies, delegates will learn how existing advanced card issuers successfully overcame these and other issues. This distinctive approach will help resolve the business and governmental concerns facing your customers. Visit our web site for more details - http://www.actcda.com/calendar/symposium.htm
1. EDITORIAL COMMENT
Source: Catherine Johnston, President & CEO, ACT Canada (08/27)
Meeting the Needs of Our Market
Over the past several months we have looked closely at the number of smart card conferences held annually. This is one of many indicators that reflect the health of an industry. During our analysis we looked at the state of each market, ranging from those where advanced cards are just emerging to those where the technology is widely deployed. At each stage of a market, conferences must deliver different content/services. In emerging markets such as ours, conference content can make a critical difference. It can help inspire, educate, overcome obstacles and validate delegate's thoughts. Good conferences provide networking opportunities, not only between suppliers and buyers but also between all stakeholders. These contacts form a valuable support mechanism. Our objective was to plan an event that would best serve our market.

Canada has entered a new stage at long last. Over the next 12 - 24 months acquirers, merchants, public and private sector issuers will seek out solutions to key issues in order to move existing plans forward. Had this happened 5 years ago, there would have been fewer resources available, but today we can learn from others who have already tackled those issues. Canadians have identified infrastructure, security, interoperability, standards and business cases as key concerns. To best serve our market and members, ACT Canada has designed a highly educational and informative program for the October 16th, 17th conference, "Breaking Through Card Barriers".

Through keynote speeches and roundtable case studies, we will demonstrate that other issuers have already overcome these same obstacles and have gone on to successfully implement smart cards. This process will help our delegates build or bolster business cases and develop confidence in their implementation plans.

To meet this goal, we have industry experts sharing their knowledge during 6 roundtable-working sessions. Each will prepare three case studies. The accumulated studies will be sent to each delegate in advance and during the conference, they will join the tables of their choice to meet with the experts and ask questions. Our desired outcome is to have delegates leave the event knowing that the issues can be resolved and that experts are available to help them.

We have asked the experts to choose case studies from Government, Financial, Transit and Transportation, Loyalty and other sectors. Each study will outline how Business Case, Infrastructure, Interoperability, Security, Standards, Efficiency & Privacy issues were handled. They will also delineate the issuer, acquirer, stakeholders, application(s) description, # of cards/readers and current implementation status.

Supporting the goal of helping issuers move forward, our speakers will represent the best of today's experience. By limiting the number of speakers and giving them time to present detailed information, they will be able to impart knowledge and insight.

Our opening keynote speaker, Richard Adamson, President of Coinamatic, makes the case that successful smart card launches are not about technology. They are about building Innovative Business Models that consumers will reward, Distribution, Scale and Convergence that create value for all of the partners in the delivery channel.

Paul Maddox, of IBM Global Services is Programme Manager for the UK Chip and Pin Programme Management Organization (PMO) leads off Friday's sessions. Paul will share the latest information on this bank and retail migration effort, which is targeted to reach critical mass and liability shift point by the end of 2004.

Other leaders from within the telecomm, transit and transportation and federal government sectors will join Richard and Paul. To round out the program, we have a lunch and learn on Friday for members of the Purchasing Management Association of Canada, Integrated Mobility and Moving the Economy members, retailers and all others who are new to smart card technology. We are also currently planning a breakfast meeting for retailers. The ACT Canada Annual General Meeting will be held at noon on Thursday, as well as the first meeting of the newly formed Government Business Case Development workgroup and Identity Protection workgroup.

Our solution centre is a key component of building market confidence. Industry leaders will show the state-of-the-art products that will form the foundation for Canadian systems as they roll out.

We hope you will join us on October 16th & 17th as we help issuers, acquirers, governments, merchants and other stakeholders move forward. For more information, please see our web site at www.actcda.com or contact Melissa(AT)actcda.com. Your participation will help us build this market.

Blackouts and Cards
A week ago it was 34 degrees in our office and the lights were still out as we honoured the government's request for electricity conservation. More than 10 million people in Ontario were still without full power, in the eighth day since the blackout. An hour into it, we got our first news from a cell phone call from Ottawa on the other side of the province. We were surprised to discover they too were without power and we were told that the entire United States had been hit. There was speculation that cyber-terrorism was the cause. Now we know that the problem was not so widespread and not caused by cyber-terrorism and governments in both Canada and the United States are talking about the changes required to ensure this doesn't happen again. They will look at lines, generators, policies and procedures, but will they look at the potential threat posed by identity fraud?

We have been reminded of the importance of computers in our day-to-day lives. Commuter trains might have continued running, but power to the computers that run the switching system was down. Software systems running traffic lights were down, effecting emergency services. Without power, people in hi-rise buildings didn't have water, because the pumps weren't operational. To protect the infrastructure that supports us, we must be able to control access to our data networks. There is a link between this and identity theft. On a positive note, smart cards provide the counterfeit and tamper resistant technology to combat identity fraud and provide portable security to grant rights and privileges to card holders. They even have multiple methods to ensure that the person using the card is its rightful owner.

If we are to keep this problem from re-occurring, we need to ensure that everyone accessing computers that can impact our infrastructure are properly authorized for the actions they take. Today this is a problem, but smart cards are an important part of the solution. Our job is to make sure this isn't overlooked.
2. TARGET SAYS ITS SUCCESS IS IN THE CARDS
Source: CardLine (08/14)
Target Corp. reported second-quarter net earnings of $358 million, up 4% compared with $344 million in the same period last year. The Minneapolis-based retailer attributed the gain to the success of its Target Visa smart credit card and new store openings. Combined receivables for Target's private-label cards and Visa card were $5.75 billion, up 24% from $4.63 billion in 2002's second quarter. The Visa card had receivables of $3.9 billion, up 56% compared with $2.5 billion a year ago. Second-quarter Visa card revenues were $211 million, up 55% compared with $136 million a year ago. "The Target Visa card is the primary vehicle propelling this growth," Gerald L. Storch, vice-chairman, told analysts during a conference call. Storch said that all of Target's 1,191 stores had kiosks and point-of-sale terminals equipped to handle the smart card rewards program that began as a pilot in July. A gift card program for college students that parents can reload from a remote location will be launched this fall, Storch said. Write-offs on the Target Visa card portfolio rose steeply. Net write-offs on an annualized basis were 9.3% of average receivables, up 94% from 4.8% in 2002's second quarter. Target's private-label card saw receivables fall from $865 million in 2002's second quarter to $733 million this year, a 15% drop. In addition to the Target stores, Target Corp. operates the Marshall Field & Co. and Mervyn's stores. The Target Visa and the private-label cards for all three retailers contributed combined pre-tax profits of $160 million to the parent, up 24% compared with $129 million in 2002's second quarter. The proprietary cards for all three retailers reported revenues of $152 million, down 7% compared with $164 million a year ago. Target Corp. reported revenues of $10.9 billion, up 9% from $10.0 billion a year ago.

Visa Canada Association is a member of ACT Canada. For more information, please visit their web site at http://www.visa.ca.
3. ACI WORLDWIDE & HEWLETT-PACKARD CANADA HOST EMV SEMINAR IN SEPTEMBER
Source: ACI Worldwide (08/26)
ACI Worldwide and Hewlett-Packard Canada are pleased to host an EMV Seminar in Toronto on September 15, 2003. This half-day morning seminar will cover the real-life experiences of successful EMV implementations in Europe. This will not be a detailed review or discussion of the EMV standard, but a discussion of an EMV implementation project itself. Speakers include Terry Gough, Technical Consultant, Nationwide Building Society, Allen Wright, Director of Chip Initiatives & Emerging Technologies, VISA Canada, and Terry McLoughlin, Director of Business Development, Ingenico.

For further details, please contact Binhaifa Meghji at (416) 813-3043 or at mbox-ca-marketing(AT)aciworldwide.com.
4. GIESECKE & DEVRIENT RECEIVES SECURITY CERTIFICATION FOR DIGITAL TACHOGRAPH
Source: Giesecke & Devrient (08/08)
Beginning August 2004, an EU regulation will require all newly registered trucks and buses to be equipped with digital tachographs. The devices will monitor more reliably than the current mechanical system whether or not drivers adhere to speed limits and rest times. Once introduced, tampering with a vehicle's tachograph will be impossible. Giesecke & Devrient (G&D) will provide the smart card technology necessary to install the corresponding infrastructure in each vehicle. For its technology, G&D has now received the required security certification from Germany's Bundesamt f|r Sicherheit in der Informationstechnik (German Information Security Agency), BSI for short. At the same time, the nation's Kraftfahrt-Bundesamt (Federal Motor Transport Authority), the KBA, has awarded G&D its "Functional Certificate" for the Tachosmart. Both are prerequisites for the device to be certified for use in vehicles on the road.

Every component supplier is obligated to provide government motor vehicle authorities with proof that it has obtained three different forms of certification before its digital tachograph can be approved by May of 2004. For at that time, according to the schedule laid down by the EU, truckers must be able to begin filing their applications for the cards they will need to operate their vehicles. The corresponding technology must have been given the green light for use in traffic. With the BSI and KBA having given their approval, G&D has overcome the biggest hurdle in the long and drawn out certification process. The agencies confirmed that the smart card to be used by the international technology group, including its operating system and application, meets the strictest security criteria. The "ITSEC E3 high" quality seal signifies that G&D's smart card technology fulfills the EU's criteria for the "evaluation of information technology system security". "We are proud that our technology has optimally met the EU's standard for the digital tachograph at this early point in time," comments Michael Nitz, head of G&D's Industry and Government Division.

A total of four different card types are being produced for use with the digital tachograph. Company cards, workshop cards, and control cards for the police will be issued in addition to the driver cards. By far the most significant in terms of volume are the driver cards. With around 500,000 new commercial vehicles being registered every year, several million of the chip cards will be needed across Europe over a period of five years.

Giesecke & Devrient is a member of ACT Canada. For more information, please visit their web site at http://www.gdai.com.
5. ATM SWIPE-AND-SNAP SCAM NETTED $620,000, COURT TOLD
Source: ICMA Daily News (08/11)
In the first case of its kind in Australia, a man has pleaded guilty to defrauding more than $623,000 from bank customers by electronically spying on them while they used ATMs.

Kok Meng Ng admitted in the District Court to taking part in an elaborate scheme in which an electronic skimming device and pin-head camera were planted in 36 ATMs in Sydney.

The skimming devices read the data on the magnetic stripe on customer's cards, while the camera recorded the PINs as they were punched in, beaming a signal that could be received up to 400 metres away.

On 64 occasions between May 2001 and November last year, Ng, who was in Australia on successive tourist visas, transferred amounts of less than $10,000 to overseas accounts. Amounts over $10,000 must be reported by financial institutions.

The court heard that among the incidents, the scam was conducted on October 15 last year on a St George ATM in Darlinghurst, a Westpac machine in Bondi Junction a day later, and, four days later, on a Commonwealth Bank ATM in Chatswood.

The prosecutor, Sunil de Silva, said Ng was part of a gang that raided the bank accounts of 315 people, generally withdrawing less than $1000 . Ng also pleaded guilty to federal charges under the Financial Transactions Act. The federal charges carry a maximum five year jail term, and the computer crime charges a three year term.

David Bell, of the Australian Bankers' Association, said the law needed to be tightened to make possession of electronic skimmers a criminal offence. Skimming was being targeted by the fraud taskforce, he said. Banks were using new technology to detect unusual transactions, and educating customers and merchants so they could identify tampering, and data capturing machines.

A risk manager with Visa International, Ian McKindley, said 50 per cent of credit card fraud in Australia, worth $50 million, was the result of credit card skimming, up from 5 per cent two years ago.

He said 75 per cent of the skimming was from cards used in petrol stations. If customers saw an attendant swipe their card in a secondary device they should contact their bank's security immediately.

It was employees, not retailers, who "harvested" credit card details for the organised gangs, he said.

A woman was arrested in Sydney recently after allegedly offering store employees $150 for each card they skimmed.
6. SHELL CUSTOMERS IN BULGARIA CAN REGISTER FOR SMART CARDS ONLINE
Source: ICMA Daily News (08/08)
The regular customers of the filling stations of the Bulgarian subsidiary of Royal Dutch/Shell, Shell Bulgaria can register for Shell's programme for loyal customers SMART online, the company's PR office said.

A total 5.0 pct of the new SMART customers have already registered on the SMART Online, which is the Internet application of Shell's SMART programme. The company has already begun using the online registration for its customers in other countries.

The company offers its customers special smart cards. The customers are awarded points for each purchase in Shell filling stations or shops and the points are collected on the smart cards. The smart card owner is able to use the points for purchasing items from a special catalogue containing over 300 articles offered by Shell.
7. SCHLUMBERGER EASYFLOW TECHNOLOGY USED IN LONDON'S OYSTER PROGRAM
Source: Schlumberger (07/30)
Schlumberger Smart Cards & Terminals announced that the TranSys consortium is deploying Schlumberger Easyflow contactless smart cards for its groundbreaking London transport ticketing and payment program, Oyster.

Annual and monthly season ticket holders are already using the Oyster service - the first of its kind in the UK - to travel across the UK's capital city. Oyster cards are now available to annual and monthly Travelcard and Annual Bus Pass holders via the Internet. The rollout will be extended later to include 7-Day tickets and a pay-as-you-go facility, Pre Pay.

The Schlumberger Easyflow cards, which use Mifare contactless chips, help speed the movement of ticket holders in a system that services around six million users a day, since travel details can be validated by simply touching the card on a reader. Once issued, cards may also be reloaded for further periods of travel, and provide customers with greater purchasing flexibility. In addition, greater security is available, as registered Oyster cards can be hotlisted if lost or stolen.

The use of Easyflow cards in one of the largest contactless ticketing systems in the world further positions Schlumberger as the ideal partner for card deployment in large transport projects. One of the most ambitious city transportation infrastructure schemes in the world, Oyster is ultimately expected to handle five million daily transactions, and as such sets a model for urban travel in the 21st century.

Schlumberger is a member of ACT Canada. For more information, please visit their web site at http://www.smartcards.net.
8. CATA & SMART TORONTO TECHNOLOGY ALLIANCE MERGE
Source: CATA (08/14)
The Canadian Advanced Technology Alliance (CATA) and SMART Toronto Technology Alliance announced a merger that will see the services, memberships and resources of the two organizations amalgamated, immediately.

Through the merger, SMART Toronto will retain its unique identity and operate as a division of CATA continuing to serve as the voice of the GTA's technology community - Canada's most important and recognized technology cluster. Synergies between the two organizations will result in the delivery of an expanded set of services and business development tools. In addition, a number of new initiatives, intended to leverage CATA's prominent position on the national innovation stage, will be delivered through SMART Toronto in the upcoming months.

SMART Toronto members will automatically become CATA members receiving access to the business development, advocacy, research, and networking services that CATA offers, in addition to locally delivered services and initiatives designed to address the unique needs of the GTA's technology community. The merger evolved from a formal partnership agreement signed by the two organizations in November 2002, according to Smart Toronto President Cindy Pearson. "We have been working closely with CATA for the past nine months, and found there were mutual advantages to making this arrangement permanent."

SMART Toronto is a member of ACT Canada. For more information, please visit their web site at http://www.stta.ca.
9. RAINBOW TECHNOLOGIES ENTERS INTO A LETTER OF INTENT TO ACQUIRE CHRYSALIS-ITS
Source: Chrysalis-ITS (08/15)
Rainbow Technologies, Inc. announced it has entered into a letter of intent to acquire, for cash, Chrysalis-ITS Inc. The transaction is subject to certain conditions, including approval by shareholders of Chrysalis-ITS. If approved, the company expects the transaction to close in about 45 days.

The product lines of both companies, while focused on different security needs make complex security easy to implement, deploy and use. The Chrysalis-ITS products are focused on the PKI and SSL-based web application markets and represent a complementary fit with the Rainbow products.

"I am very pleased to be making this announcement today," said Shawn Abbott, president Rainbow eSecurity. "Chrysalis-ITS has a long track record of delivering high assurance security solutions to the world's most demanding customers. They have a great team, and an excellent product line."

Chrysalis-ITS is a member of ACT Canada. For more information about either of the above listed companies, please visit their web site: http://www.chrysalis-its.com & http://www.rainbow.com.
10. BANK OF MOSCOW TO TEST EMV WITH SOCIAL CARD
Source: CardTechnology Magazine (08/08)
The Bank of Moscow launched a pilot that adds an EMV debit application to a multiapplication social benefits card used by pensioners, students and other state aid recipients.

The Moscow Social Card now delivers free or discounted fares on the Moscow Metro using a contactless transit application. It also identifies cardholders for some health services and allows them to make withdrawals and purchases from their pension or other benefits accounts, the latter with a magnetic-stripe-based debit application.

Now the bank plans to test cards with more sophisticated dual-interface chips that will combine the contactless Mifare transit application with a standardized EMV debit feature. The bank plans to issue 20,000 of the dual-interface cards over the next few months for the pilot, says Visa International, whose EMV application is being used. If successful, the bank will consider whether to convert any of the more than 2 million social cards on issue that carry a Visa Electron application on the magnetic stripe. The chip could also provide a platform for other welfare services, which could attract other government agencies interested in cutting fraudulent benefit claims. Since the Moscow Metro introduced contactless cards for fare collection in 1998, fraud related to the discounted or free fares it offers pensioners and others has reportedly dropped substantially. The Moscow Metro and other government agencies are involved in the Social Card project.

Meanwhile, government officials in St. Petersburg and other cities in the Commonwealth of Independent States are interested in the concept.
ACT Canada is an international non-profit association for the advancement of card technologies. We work on behalf of our members to promote the awareness, understanding and use of all advanced card technologies; including optical, smart, capacitive and emerging technologies. If you would like to learn more about ACT Canada membership please visit http://www.actcda.com or contact our office at (905) 426-6360 ext. 21.
Please forward any comments, suggestions, questions or articles to andrea(AT)actcda.com. If you would like to be removed from our newsletter distribution list please reply to this email with the word "REMOVE" in the subject field. Please note that articles contained in this newsletter have been edited for length, and are for information purposes only.
Andrea McMullen
AVP
ACT Canada
tel: 905 426-6360 ext. 24
fax: 905 619-3275
email: andrea(AT)actcda.com
web: www.actcda.com
mail: 85 Mullen Drive, Ajax, ON, L1T 2B3