ACTion Newsletter

September 29, 2008

Welcome to the September edition of ACTion News. This complimentary service is provided by ACT Canada; "building an informed marketplace". It is also available in the Resource Centre of our web site. Please feel free to forward this to your colleagues.

If you would prefer to receive this newsletter in plain text please email your request to andrea(AT)actcda.com.

IN THIS ISSUE:
1. Editorial Comment
2. Chase Paymentech Partners With NBS Payment Solutions To Offer A Suite Of Chip-And-PIN Terminals
3. TJ Maxx Exec: Chip And PIN Needed In The U.S.
4. Gemalto Acquires MULTOS Business From Keycorp
5. INSIDE Contactless Honoured By Frost & Sullivan
6. EMVCO Looks To Broaden Industry Participation
7. 78% Want To Use Contactless Services On Their Mobile Phone - Members Only Access
8. ViVOtech & Giesecke & Devrient (G&D) Confirm Interoperability Between NFC-Enabled SIM Cards And OTA NFC Infrastructure Software
9. Europe Inches Closer To Full E-Passport Rollout - Members Only Access
10. Oberthur Technologies Gets Common Criteria Certification Eal 4+ For The 2nd Generation Of Electronic Passport With Biometric Fingerprints
11. Paragon Application Systems Teams With Smartsoft Information Technologies To Offer Complete EMV Solution
12. New York To Offer RFID-Embedded Driver's Licenses - Members Only Access
13. Department Of Veteran Affairs Enhances Integrity With CoreStreet Credential Validation Technology
14.INSIDE Contactless Targets Micropass-Based "ICAO-Lite" Solutions For Growing ID Market
15. New PCI Security Standard Falls Short - Members Only Access
16. Govt Of India Selects Gemalto For Electronic Passport Program

ACT Canada Partners:

Visa operates the world's largest retail electronic payments network and is one of the most recognized global financial services brands. Visa facilitates global commerce through the transfer of value and information among financial institutions, merchants, consumers, businesses and government entities.

Collis is a leading provider of EMV, e-ID, and e-Passport test tools, consulting, and training in Canada. Contact us for EMV training and test tools for every step of the EMV Transaction life-cycle - Cards, Terminals, Acquiring host and Authorization host. Collis America at 1-651-925-5410.

ACT CANADA THANKS OUR NEW & RENEWING MEMBERS:

GENERAL:
CoreStreet ~ member since 2007
Deloitte Inc ~ member since 2006
Oberthur Technologies ~ member since 2005

SME:
A LA CARD Marketing & Consulting Services Ltd. ~ member since 2004
aMail Inc ~ new member
CanCard ~ new member
E Card ~ member since 2007
NetSecure Technologies ~ new member

GOVERNMENT:
Royal Canadian Mint ~ member since 2005

ASSOCIATE:
FlexExports ~ new member
PJE Consulting ~ member since 2005

CALENDAR OF EVENTS:

ACT Canada is pleased to present:

Cardware 08 - Securing Payments
October 8 & 9, 2008
Kitchener Waterloo, Canada

Additional information is available at http://www.actcda.com/calendar/symposium.htm. ACT Canada members receive discounts for this event.

Smart Card Alliance 7th Annual Smart Cards in Government Conference 2008
October 22-24, 2008
Washington, DC, USA
http://www.smartcardalliance.org

CARTES & IDentification 2008
November 4-6, 2008
Paris, France
http://www.cartes.com

1. EDITORIAL COMMENT
Source: Catherine Johnston, President & CEO, ACT Canada (09/29)

Relationships, Triangles and Quadrangles

Communications are often the trickiest part of any relationship and even trickier when there is just a dotted line affiliation.

This brings us to financial institutions (FIs), merchants, consumers and acquirers - the quadrangle. What used to be a direct relationship between an FI and merchant, changed when most Canadian FIs sold their acquiring businesses. Although the direct connections are gone, the relationship between merchants, consumers and card issuers remains in play - the triangle. Each is dependent on the other two, as well as needing the acquirer/processor, to make payment transactions happen. Each wins when everything works and things work best when all the stakeholders have a clear line of communications.

Lately interactions between these stakeholders have become strained and as I talk with each group I see their individual pain points. In some cases there are assumptions that may have been true in the past, but are no longer reliable now that new payment products and form factors enter the market. In other cases, a focus on one business issue can keep stakeholders from talking about other things. Sometimes communication stops because of staff turnover. Newcomers simply don't know who to talk with. Finally there is the issue of workload. All these are understandable, but not helpful.

One thing is clear. There isn't enough communication between stakeholders, as is often the case in relationships. There isn't a widespread acceptance that all the parties are linked, even though not always through contractual arrangements. There is a growing belief that all could benefit from increased communications, but questions about how that would happen.

At ACT Canada, we talk and work with each of these groups. We are committed to helping our members meet this communication challenge to support their business goals. Through our day-to-day work, conferences, strategic leadership teams and other initiatives, we connect stakeholders. I invite you to join us and join the conversation!

2. CHASE PAYMENTECH PARTNERS WITH NBS PAYMENT SOLUTIONS TO OFFER A SUITE OF CHIP-AND-PIN TERMINALS
Source: Canada Newswire (09/18)

Chase Paymentech Solutions and NBS Payment Solutions are pleased to announce the release of two new wireless chip-and-PIN enabled payment devices for restaurants and mobile businesses. The payment terminals are certified by Chase Paymentech to support the latest industry standards including Interac, Visa and MasterCard, as well as new requirements for chip-and PIN card acceptance in Canada.

NBS Payment Solutions products certified by Chase Paymentech are available as long-range wireless terminals using a GPRS network, and as short range hi-speed wireless terminals using Bluetooth.

NBS is a member of ACT Canada and an exhibitor at Cardware 08; please visit http://www.nbsps.com.

3. TJ MAXX EXEC: CHIP AND PIN NEEDED IN THE U.S.
Source: Source: SecureID News (09/02)

Donald G. Campbell, vice chairman of the TJX Cos., told the Boston Globe that smart cards could have prevented the fraud that happened at its retail locations.

TJX has approximately 100 million credit and debit card numbers stolen when fraudsters used wireless connections to tap into two Marshalls stores TJX operated in Miami. The retailer discovered the breach at the end of 2006, and estimates it spent $202 million related to the breach including security reviews and settling consumer lawsuits.

Campbell told the Globe that hackers are focusing on countries that don't have high security. Using smart cards along with PINs would make it difficult for breaches such as what happened at TJX to happen again.

But is the cost of upgrading cards and point-of-sales terminals worth it? "Such an upgrade would likely cost billions to introduce in the United States, industry specialists estimate, including around $2 for each new credit card and up to $500 for each of merchants' 12 million card readers. TJX alone could spend as much as $20 million, Campbell estimated," the story states.

Fraud, overall, is still relatively low in the U.S. "David Robertson, publisher of The Nilson Report, a trade newsletter that tracks the payment industry, estimates that $1.24 billion was lost to fraud in 2007 in the United States, up from $1.14 billion in 2006. But in both years, that works out to just 5.7 cents for every $100 that customers charged on their credit cards. Worldwide fraud was $5.68 billion, or 4.8 cents per $100 spent.

4. GEMALTO ACQUIRES MULTOS BUSINESS FROM KEYCORP
Source: ICMA Daily News (09/04)

Gemalto confirmed that it has completed the acquisition of Keycorp's smart card business, the leading fabless provider of MULTOS(TM) products and services to the Financial Services and Government sectors, and of Multos Ltd, the company that operates the remote activation service and high-security facility that is at the center of the MULTOS security architecture. Gemalto is paying 25.7 million Australian dollars (approximately 15 million Euros, or 22 million US dollars) for Keycorp's smartcard business assets, IP portfolio, trademarks and Multos Ltd.

The assets acquired include Keycorp's implementation of the highly secure MULTOS smart card operating system, the MULTOS brand, the associated patents and the Key Management Authority (KMA) that manages MULTOS card activations worldwide. Approximately 40 MULTOS experts will join Gemalto, mostly based in Australia and UK. The acquisition will contribute over 15 million of annual revenues to the Secure Transactions and Government Programs segments of Gemalto on an annual basis, with over half of the revenues coming from Asia.

Gemalto is a member of ACT Canada and a sponsor at Cardware 08; please visit http://www.gemalto.com.

5. INSIDE CONTACTLESS HONOURED BY FROST & SULLIVAN
Source: Business Wire (09/22)

INSIDE Contactless announced the company has been recognized with the 2008 Frost & Sullivan North American Contactless Smart Cards Growth Excellence of the Year Award, in recognition of its role as a leader in shaping contactless payment technology in the smart card industry. The Frost & Sullivan Growth Excellence of the Year Award is bestowed each year upon the company that has demonstrated excellence in implementing and sustaining growth within shipments, revenues and profitability, and whose strategy will have a lasting impact on the market.

Frost & Sullivan credits INSIDE as one of the first companies to have designed a multi-application platform for contactless payment functions. The research and growth consulting firm recognized that such an early move propelled the company into a position of excellence in terms of technology innovation, enhanced its understanding of the market, and helped it gather valuable experience to stay ahead of competition. Frost & Sullivan also attributed INSIDE's exponential sales growth primarily to its low-power, flexible MicroPass intelligent payment platform, which is designed specifically to support the contactless bank card market with extension into transit fare collection, access, control, and retail loyalty applications.

Frost & Sullivan's Best Practices Awards recognize companies in a variety of regional and global markets for demonstrating outstanding achievement and superior performance in areas such as leadership, technological innovation, customer service, and strategic product development. Industry analysts compare market participants and measure performance through in-depth interviews, analysis, and extensive secondary research in order to identify best practices in the industry.

INSIDE Contactless is a member of ACT Canada and a sponsor at Cardware 08; please visit http://www.insidecontactless.com

6. EMVCO LOOKS TO BROADEN INDUSTRY PARTICIPATION
Source: EMVCo (09/22)

EMVCo, the EMV standards body owned by JCB International, MasterCard Worldwide and Visa Inc., has announced plans to broaden industry participation in the development work of the organisation and establish a regular, formal dialogue between EMVCo and the global payments industry, through the launch of a new website subscription programme and annual user meeting.

To be launched during the first quarter of 2009, a new subscription programme delivered through the EMVCo website will allow interested parties to access advance information regarding revisions to EMV Specifications, draft documents and upcoming meetings. Subscribers will also be able to make direct contact with EMVCo to solicit feedback or guidance in respect of technical issues. EMVCo will introduce this subscription programme, at a nominal annual fee of 750 USD per user, in recognition that many parties, such as vendors, consultants, laboratories, payment schemes, merchants and regional associations, can benefit from providing input into the development work of the EMV Specifications.

The introduction of the subscriber service will not affect the royalty-free availability of final and published versions of EMV Specifications, bulletins and application notes, type approval process documents and approval lists. EMVCo remains committed to ensuring free industry access to these documents from the EMVCo website.

Where can merchants turn for help with POS & new payment option questions?
Join us at Cardware 08 - Securing Payments, October 8 -9 in Kitchener-Waterloo
visit http://www.actcda.com/calendar/symposium.htm to register

7. 78% WANT TO USE CONTACTLESS SERVICES ON THEIR MOBILE PHONE - Members Only Access

Available in the ACT Canada Members Only section of our web site. Click on the link below to access this section
http://www.actcda.com/members-only/news.htm

If you are a member of ACT Canada but do not have your login details please contact me - andrea(AT)actcda.com

8. VIVOTECH AND GIESECKE & DEVRIENT (G&D) CONFIRM INTEROPERABILITY BETWEEN G&D NFC-ENABLED SIM CARDS AND VIVOTECH'S OVER-THE-AIR (OTA) NFC INFRASTRUCTURE SOFTWARE
Source: Giesecke & Devrient (09/09)

Giesecke & Devrient (G&D) and ViVOtech announced that their respective technologies are interoperable following successfully concluded testing between their NFC products. Now applications stored on NFC-enabled SIM cards made by G&D can be managed through NFC over-the-air (OTA) provisioning server software developed by ViVOtech.

The G&D and ViVOtech interoperable solution is the first to enable OTA provisioning of not only the financial account applet (virtual card) but also provisions the complete payment applet to the SIM card. The companies jointly confirmed the test was successfully performed using multiple Single Wire Protocol (SWP) prototype mobile phone models. ViVOtech and G&D plan to use this joint technology infrastructure as the basis for an upcoming NFC field trial with a Large European MNO and Issuer Bank.

G&D, as a leading manufacturer of SIM cards, has developed the ProxSIM product line of NFC-enabled SIM cards for this purpose. It is based on Single Wire Protocol (SWP) standard defined to link the SIM card with the NFC chip in a mobile phone. The European Telecommunications Standards Institute (ETSI) adopted this standard in October 2007.

Using the joint solution, NFC applications are loaded onto the SIM card through special OTA servers - that is, via the mobile network - and updated by the same means throughout their lifecycle in the field. ViVOtech is a leading provider of NFC OTA provisioning servers that are used by Trusted Service Managers (TSM) to provide OTA services to mobile network operators and service providers while ensuring that the applications remain under the full and exclusive control of the respective service provider.

Giesecke & Devrient and ViVOtech are members of ACT Canada and Giesekce & Devrient is a Cardware 08 exhibitor; please visit http://www.gi-de.com & http://www.vivotech.com.

9. EUROPE INCHES CLOSER TO FULL E-PASSPORT - Members Only Access

10. OBERTHUR TECHNOLOGIES GETS COMMON CRITERIA CERTIFICATION EAL 4+ FOR THE 2ND GENERATION OF ELECTRONIC PASSPORT WITH BIOMETRIC FINGERPRINTS
Source: Oberthur Technologies (09/09)

Oberthur Technologies has been awarded with the Common Criteria EAL 4+ certification for its chip ID One ePass V2, according to the protection profile EAC1 in both configurations RSA2 and elliptic curves.

Oberthur Technologies has developed a second generation chip designed to meet all the international requirements including biometric features such as the fingerprint or iris. It will be protected by a new feature, extended access control (EAC) as well as basic access control, thus strengthening the security and protection of the data.

This new chip will be available for all the new European passports - where the EAC features will be mandatory from June 28th 2009 - and for all the countries which have a travel document project based on ICAO3 specification.

ID One ePass V2 is entirely compliant with the ICAO international specifications and answers the European specification EAC V1.11. Furthermore, this product underwent all the physical and logical known attacks and was certified as being highly resistant. It has also been awarded for the interoperability tests and EAC compliance organized by the Brussels Interoperability Group (BIG).

Oberthur Technologies is a member of ACT Canada; please visit http://www.oberthur.com

11. PARAGON APPLICATION SYSTEMS TEAMS WITH SMARTSOFT INFORMATION TECHNOLOGIES TO OFFER COMPLETE EMV SOLUTION
Source: Paragon (09/23)

Paragon Application Systems announced a partnership with SmartSoft Information Technologies (SmartSoft-IT), a leading provider of EMV solutions, to offer end-to-end software solutions for EMV migration. Paragon Application Systems will resell SmartSoft-IT solutions in North and South America.

As businesses migrate their ePayment systems from magnetic stripe cards to EMV chip-based cards to help reduce fraud, they need software solutions to make the appropriate changes to cards, devices (including ATMs and point-of-sale terminals), and to their systems in order to accurately process EMV transactions. SmartSoft-IT offers software solutions for EMV card issuance, card personalization and EMV processing changes for devices. Paragon Application Systems offers test tools to simulate the entire online EMV transaction including cards, devices, hosts, issuers, acquirers and switches. Together these solutions offer a complete package for EMV-from EMV card personalization and issuance through online testing.

Paragon Application Systems and SmartSoft-IT will be demonstrating their solutions for EMV at ACT Canada's Cardware 08 Conference, October 8th and 9th in Kitchener-Waterloo, Ontario, Canada.

Paragon Application Systems is a member of ACT Canada and a Cardware 08 exhibitor; please visit http://www.paragonedge.com.

12. NEW YORK TO OFFER RFID-EMBEDDED DRIVER'S LICENSES - Members Only Access

13. DEPARTMENT OF VETERAN AFFAIRS ENHANCES INTEGRITY WITH CORESTREET CREDENTIAL VALIDATION TECHNOLOGY
Source: Business Wire (09/08) 7)

Driven by Homeland Security Presidential Directive 12 (HSPD-12) goals and implementations, CoreStreet announced that the Department of Veteran Affairs (VA) will leverage CoreStreet's credential validation technology for the validation services required as part of its HSPD-12 smart card program.

The VA will use distributed Responder Appliances from CoreStreet to provide immediate validation of Federal Information Processing Standard (FIPS) 201 compliant Personal Identity Verification (PIV) credentials used throughout the central and regional offices of the Department.

Verizon Business, a leading global provider for managed information security solutions to businesses and government agencies worldwide, will host and manage the Veterans Affairs credential solutions in a secure Verizon Business data center that is supported 24 hours a day, seven days a week, with critical services backed up by redundant systems including a hot back-up site with round-the-clock support.

CoreStreet is a member of ACT Canada; please visit http://www.corestreet.com.

14. INSIDE CONTACTLESS TARGETS MICROPASS-BASED "ICAO-LITE" SOLUTIONS FOR GROWING ID MARKET
Source: Business Wire (09/24)

Anticipating the need in the market for faster, lighter-weight versions of ICAO-compliant identity chips, INSIDE Contactless announced it is building upon its MicroPass® platform to support a variety of "ICAO-Lite" identity applications. With faster read times and lighter weight memory options than standard ICAO solutions, INSIDE's MicroPass ICAO-Lite offerings deliver a flexible, cost-effective solution for creating mid-range ID cards and documents that meet ICAO standards, but with less data storage.

ICAO (International Civil Aviation Organization) has set standards for ePassports and eVisas based upon the use of contactless chip technology with large EEPROM memory requirements to store high-resolution biometric data and other identity information. But ePassports, eVisas and other heavyweight ICAO ID applications represent only about 10 percent of the overall identity market, leaving a huge, unserved potential market for INSIDE's ICAO-Lite solutions

The new MicroPass ICAO-Lite solutions feature 16-bit RISC microprocessors, a file manager, hardware DES encryption, ISO 14443-B or 15693 RF interfaces, an option for Basic Access Control (BAC) application support, and 4 or 8 kilobytes of EEPROM data memory instead of the large, 64-kilobyte EEPROM found in standard heavyweight ICAO-compliant chips. While INSIDE's ICAO-Lite solutions maintain the same logical data structure as a standard ICAO chip, the dramatically reduced on-chip data storage results in faster transaction times. By building upon the MicroPass architecture, INSIDE is able to offer its ICAO-Lite solutions at significantly lower cost compared to standard ICAO-compliant products, and INSIDE can customize the data structure to meet specific customer requirements.

INSIDE Contactless Is a member of ACT Canada and a sponsor at Cardware 08; please visit http://www.insidecontactless.com

15. NEW PCI SECURITY STANDARD FALLS SHORT - Members Only Access

16. GOVT OF INDIA SELECTS GEMALTO FOR ELECTRONIC PASSPORT PROGRAM
Source: Asia Pulse (09/17)

Gemalto announces it has been selected to supply Gemalto's Sealys eTravel solution to India's National security printer, India Security Press.

This solution is used to start India's electronic passport rollout for Indian Officials and Diplomats. This marks a major milestone for the Indian Government's Ministry of External Affairs, India Security Press, National Informatics Centre and Gemalto in improving immigration processing at airports and border control points as well as bolstering national security.

This Sealys eTravel offering forms the integral security and contactless communications component of the electronic passports that are manufactured by the India Security Press. It includes the advanced secure operating system and microprocessor that stores and protects the holder's digital identity as well as the communications antenna. The passports have been launched for Indian Diplomats & Government Officials initially and in a second stage, the Indian government intends to deploy it for the general public.

Gemalto is a member of ACT Canada and a sponsor at Cardware 08; please visit http://www.gemalto.com.

ACT Canada is an international non-profit association for the advancement of card technologies. We work on behalf of our members to promote the awareness, understanding and use of all advanced card technologies; including optical, smart, capacitive and emerging technologies. If you would like to learn more about ACT Canada membership please visit http://www.actcda.com or contact our office at (905) 426-6360.

Please forward any comments, suggestions, questions or articles to andrea(AT)actcda.com. If you would like to be removed from our newsletter distribution list please reply to this email with the word "REMOVE" in the subject field. Please note that articles contained in this newsletter have been edited for length, and are for information purposes only.

Andrea McMullen
VP, Operations
ACT Canada
tel: 905 426-6360 ext. 24
fax: 905 619-3275
email: andrea(AT)actcda.com
web: www.actcda.com
mail: 85 Mullen Drive, Ajax, ON, L1T 2B3