ACTion Newsletter

January 29, 2009

Welcome to the January edition of ACTion News. This complimentary service is provided by ACT Canada; "building an informed marketplace". It is also available in the Resource Centre of our web site. Please feel free to forward this to your colleagues.

If you would prefer to receive this newsletter in plain text please email your request to andrea(AT)actcda.com.

IN THIS ISSUE:
1. Editorial Comment
2. Privacy Commissioner Wants Off Switch On New Ontario Driver Licenses
3. Bell ID Introduces EMV PIN Change Via The Internet
4. Giesecke & Devrient Unveils First MicroSD Card Uniting Smart Card And NFC Compatible Contactless Functions
5. Hypercom And TASQ Introduce Optimum T4205 Payment Terminal In Canada
6. Gemalto First To Market With MasterCard Advanced Authentication For Chip Card Reader
7. One In Four Victim Of Card Fraud - Member Only Access
8. Oberthur Technologies Wins First Order For Large Memory Dual Interface Cards For U.S. Government Agency
9. Miami First U.S. Port To Implement TWIC Contactless Biometric Solution - Member Only Access
10. Collis EMV PVT Supports Visa Global Chip Card Validation
11. Industrial Commercial Bank Of China Selects Aconite Affina Enterprise For Smart Card Issuance
12. New NFC Ecosystem And Players Emerge - Member Only Access
13. Bank Asya Deploys Smartsoft's Instant Issuance Solution To Deliver MasterCard EMV Cards In A Matter Of Minutes
14. Gemalto Provides Combined Innovative Identity & Payment Card Technology For Santander Universities Global Division In Brazil
15. Maritz Launches Real-Time POS Loyalty Platform - Member Only Access

ACT Canada Partners:

Collis is a leading provider of EMV, e-ID, and e-Passport test tools, consulting, and training in Canada. Contact us for EMV training and test tools for every step of the EMV Transaction life-cycle - Cards, Terminals, Acquiring host and Authorization host. Collis America at 1-651-925-5410.

Visa operates the world's largest retail electronic payments network and is one of the most recognized global financial services brands. Visa facilitates global commerce through the transfer of value and information among financial institutions, merchants, consumers, businesses and government entities.

ACT CANADA THANKS OUR NEW & RENEWING MEMBERS:

GENERAL:
Canadian Tire Financial Services ~ member since 2006
ICC Solutions ~ member since 2003
MasterCard Canada ~ member since 1999

CALENDAR OF EVENTS:

Cardware Connections Meeting + Merchant Strategic Leadership Team Meeting
February 10, 2009 (afternoon)
OBA Conference Centre
Toronto, ON, Canada
Visit www.actcda.com for more details

Cardware Connections Meeting + Inaugural Meeting of our New Strategic Leadership Team
March 23, 2009 (morning)
OBA Conference Centre
Toronto, ON, Canada
Visit www.actcda.com for more details

2009 CTST/Smart Card Alliance Annual Conference & Expo
May 4-7, 2009
Ernest N. Morial Convention Center
New Orleans, LA, USA
http://www.ctst.com
ACT Canada members receive discounts - please contact andrea(AT)actcda.com for details

Cardware 09: Payment Insights
Financial & Retail Sectors Conference
June 17-18, 2009
White Oaks Conference Centre
Niagara-on-the-Lake, ON, Canada
Visit www.actcda.com for more details

Cardware 09 Secure ID Insights
Government Sector Event
September 16, 2009
Hellenic Centre
Ottawa, ON, Canada
Visit www.actcda.com for more details

1. EDITORIAL COMMENT
Source: Catherine Johnston, President & CEO, ACT Canada (01/26)

Hurrah, we're twenty!

I remember the five year mark, but since then it has been a non-stop roller coaster ride. This market has been both up and down, but if you're going to learn a market well, you need to experience both.

Here are some of the things we've learned in those 20 years.

There is never enough dialogue between stakeholders.

Applications meeting issuers' needs must be the driving force. Technology is only an enabler.

People change jobs, so don't expect that a company has retained knowledge, even though it once participated in a trial or roll out.

As markets heat up, everyone wants a piece of the action. In this market, many international companies with EMV experience have come here to fill resource gaps. This is terrific, because it helps us move forward.

On the other hand, some companies come in with little to no market knowledge, sometimes to run events or conferences. You have to ask yourself how much knowledge they have of our market. Associations such as ACT Canada, the Smart Card Alliance, Eurosmart and others work every day in their market, for years on end. This is where insight comes from. You also have to ask yourself if they provide a follow on value. Associations re-invest their profits in services to benefit the market throughout the entire year. In tough economic times, you have to be choosy!

This is not to say that we don't support other events, but we're very picky about identifying member value. Last year we declined to promote an event, but they contacted one of our members claiming I had said they should register. If we support something, you'll hear it directly from us, via our web site, an email or a phone call. If you are approached by anyone else, please let me know.

Now, as for recessions, there is an upside. I've seen planning and strategizing activities go up during each recession since 1980, followed by implementations as the market recovered.

So, back to my first point: dialogue among stakeholders is key. As you scale back discretionary spending, remember that this is an essential need. Working with peers and other stakeholders can help us overcome issues and pursue our goals. It can also be the timeliest and most cost effective tool available to us.

So, I invite you to join us for a banner year of events and Strategic Leadership team meetings, as ACT Canada celebrates our 20th year of supporting members, connecting stakeholders and sharing insights in the Canadian market!

2. PRIVACY COMMISSIONER WANTS OFF SWITCH ON NEW ONTARIO DRIVER LICENSES
Source: ITBusiness (01/09)

Ontario's Privacy Commissioner wants to give Ontarians the ability to turn off the RFID function on their new enhanced driver's licences.

More specifically, Commissioner Ann Cavoukian wants a simple switch added to the RFID chip in the enhanced driver's licence (EDL) that will soon be coming to Ontario. The new cards aim to meet new U.S. Homeland Security requirements that come into effect June 1, transmitting a unique number to border officials while drivers wait in line at the crossing.

The Ontario government passed the bill approving the EDL on Nov. 18. But now Cavoukian wants to revisit that legislation because of privacy concerns.

"The problem is that you'll be carrying these every day," she says. "The risk is that a lot of private information might be broadcast to readers that could receive the information."

RFID chip security has proved to be less than foolproof in the past and known to fall prey to hackers, she adds.

The ability for Ontarians to turn off the RFID function on their cards is a logical precaution.

Ontarians will have the option to use the RFID licenses or not. The cost of the license will be $40 in addition to the $75 cost of a regular driver's license.

Currently the U.S. requires that GEN2 vicinity RFID chips be used in the new licences. That type of chip can be read at 30 feet away with the right reader, and would speed up the border crossing process as officials would know who was approaching the border.

But Cavoukian plans to lobby U.S. Homeland Security to change that stipulation to a different method that will easily allow an on/off switch to be added. She plans to open up talks when the new administration takes power Jan. 20.

The GEN2 RFID chip standard was created by the non-profit global association GS1. Also the inventors of the barcode, the worldwide association plays a key role in creating inventory identification standards and its maintenance.

Officials from GS1 Canada downplayed the privacy concerns involved with the chip, saying these were due to public misperceptions about the technology.

The Commissioner and GS1 are working together to find a solution to include an on/off switch on the RFID chip.

3. BELL ID INTRODUCES EMV PIN CHANGE VIA THE INTERNET
Source: Bell ID (12/03)

Bell ID announced its new solution to enable PIN changes for EMV compliant cards via the Internet: the ANDiS I-PIN (patent pending). With this innovative application banks with or without their own ATM network can allow cardholders to choose their own PIN whilst ensuring that both online and offline PINs remain synchronised.

Bell ID's PIN change application can be integrated as an active component into the secure website of the issuing bank, regardless of the web browser used. Once cardholders have logged on to the website, they will be able to change their PIN by inserting their card into a commonly used USB PC/SC card reader. The application is able to synchronise the online and offline PIN through a web application using Bell ID's Script Delivery System (SDS).

Bell ID is a member of ACT Canada; please visit http://www.bellid.com.

4. GIESECKE & DEVRIENT UNVEILS FIRST MICROSD CARD UNITING SMART CARD AND NFC-COMPATIBLE CONTACTLESS FUNCTIONS
Source: ICMA Industry News (12/10)

Giesecke & Devrient (G&D) has developed the first mobile security card offering contactless smart-card security in addition to the usual data storage functions. The new security feature is provided by a cryptography controller with an NFC-compatible interface integrated in the microSD card along with the flash memory. The Mobile Security Card CL thus serves as an ideal basis for implementing security and payment functions in cell phones and for many other mobile applications

The mobile security cards designed by G&D are suitable for use in mobile phones, smart phones, netbooks and other mobile devices, and even in USB tokens. The only requirement is that they should be equipped with a slot for microSD cards. Such cards can provide security functions for all of these devices, as well as PCs and laptops, without the need for an external smart card reader. The latest product in this family of cards, the Mobile Security Card CL, has been enhanced to include a contactless interface in addition to the integrated smart card, based on the international standards ISO 14443 and MIFARE. In order to use the card in contactless mode, the device in which it is inserted must be equipped with an antenna for the contactless communication link. The card contains two additional standardized contacts for this purpose. A battery is not required to operate the contactless interface: The necessary energy is tapped from the radio field generated by the card reader. A secure communication link is established as soon as the antenna comes within a few centimeters of the reading device.

The range of possible contactless applications includes electronic access control to buildings, electronic event ticketing and transit ticketing, and electronic passes for companies, libraries and universities. The Mobile Security Card CL can also be used for contactless mobile payment. With its user-friendly interface for mobile phones and desktop or laptop PCs, it supports all of the usual smart card applications such as secure banking transactions, e-government, and the secure storage of digital certificates for public key infrastructure (PKI) applications. Other potential uses of the card concern the workplace environment, where it can be used for secure authentication when using single sign-on procedures to access enterprise networks, or for attaching digital signatures to documents or workflows.

Giesecke & Devrient is a member of ACT Canada; please visit http://www.gi-de.com.

5. HYPERCOM AND TASQ INTRODUCE OPTIMUM T4205 PAYMENT TERMINAL IN CANADA
Source: SmartCardTrends (12/09)

Hypercom Corporation and TASQ Technology announced that TASQ will market Hypercom's new 32-bit Optimum T4205 to the Canadian market place. This sleek entry-level device is an ideal terminal for small independent merchants throughout Canada.

The T4205 shares the same platform and compact form factor inherent in Hypercom's T4200 line of products. It features a clear and intuitive keypad, large memory and high speed processor for fast transactions, all secured by HyperSafe 32, Hypercom's exclusive RSA-based security infrastructure. The terminal is PCI PED approved and Interac certified. It supports three languages (French, English and Spanish) and can quickly and efficiently process debit, credit, smart card and value-added transactions such as gift/loyalty.

Hypercom is a member of ACT Canada; please visit http://www.hypercom.com.

6. GEMALTO FIRST TO MARKET WITH MASTERCARD ADVANCED AUTHENTICATION FOR CHIP CARD READER
Source: Gemalto (01/07)

Gemalto announced that its Ezio Pocket Reader is the first fully certified reader made available to the market for MasterCard Advanced Authentication for Chip. The Advanced Authentication for Chip specification allows two-factor authentication on any EMV card already in use, whether or not it has been personalized according to the MasterCard Chip Authentication Program (CAP). It also supports financial institutions in markets where off-line PIN is not used to verify online customers' identity. Therefore, the Advanced Authentication for Chip-certified Gemalto reader makes it easier for banks to deploy strong authentication to their entire base of online customers, as they no longer need to make any changes to their legacy cards. It also enables millions of new banking customers to benefit from increased security for online transactions, by making it accessible in every environment.

Toni Merschen, Group Head Chip at MasterCard, said, "We are pleased to see a leading vendor such as Gemalto delivering solutions to the market that are certified to our global and interoperable standards. Advanced Authentication for Chip is all about allowing Banks to cost-effectively secure remote channels for their customers, which is particularly relevant as they enter more prudent times."

Gemalto and MasterCard Canada are members of ACT Canada; please visit http://www.gemalto.com & http://www.mastercard.ca.

7. ONE IN FOUR VICTIM OF CARD FRAUD - Members Only Access

Available in the ACT Canada Members Only section of our web site. Click on the link below to access this section
http://www.actcda.com/members-only/news.htm

If you are a member of ACT Canada but do not have your login details please contact me - andrea(AT)actcda.com

8. OBERTHUR TECHNOLOGIES WINS FIRST ORDER FOR LARGE MEMORY DUAL INTERFACE CARDS FOR U.S. GOVERNMENT AGENCY
Source: ICMA Industry News (12/23)

Oberthur Technologies received its first large-volume order for its federally certified dual interface cards from the U.S. Government. The dual interface card, named ID One Cosmo v5.5 128K D, is a single chip multi-application smart card micro-controller with two communication interfaces - contact and contactless. It provides secure data storage and processing capabilities specifically designed for identity and government market needs. Utilizing more advanced cryptographic tools within the smart card, this marks the first usage of large memory to support U.S. Federal policy like HSPD-12 and other smart identity applications in the field.

The ID One Cosmo is fully certified by the U.S. and Canadian Governments. Oberthur is the leading provider to achieve this certification and handles all its card manufacturing for the U.S. government at its Exton, PA-based ISO 9001 facility.

Oberthur Technologies of America Corp. manufacturers cards for more than 75 federal agencies and government-sponsored programs including the Department of Defense's Common Access Card, Transportation Worker Identification Credential (TWIC) and Registered Traveler.

The development of these cards is based on Homeland Security Presidential Directive 12 (HSPD-12). That policy sets a common ID standard and credentialing process for Federal Employees and contractors to ensure enhanced security, reduce identity fraud, and protect the personal privacy of those issued card-based government identification.

Oberthur is a member of ACT Canada; please visit http://www.oberthur.com.

9. MIAMI FIRST U.S. PORT TO IMPLEMENT TWIC CONTACTLESS BIOMETRIC SOLUTION - Members Only Access

10. COLLIS EMV PVT SUPPORTS VISA GLOBAL CHIP CARD VALIDATION
Source: Collis (12/18)

The Collis EMV Personalisation Validation Tool (Collis EMV PVT) is a market leading tool designed to check if your cards are personalised correctly. The Collis EMV PVT gives you reliable quality control over the personalisation process. As a Card Issuer or Personalisation Bureau, you can ensure that your cards have been developed according to the mandatory card personalisation regulations from the payment associations. You are able to check the consistency between magnetic stripe data, contact chip data, contactless chip data and embossing data. The Collis EMV PVT has an easy?to?use user interface and is customisable. It can be used during development and production. This helps to ensure that you have correctly personalised and interoperable cards.

The new Visa Module in the Collis EMV PVT implements the Visa Global Chip Card Personalisation Validation (GCCV) version 1.0 test specification. This test specification focuses on the correct personalisation of Visa Credit, Visa Electron, Plus, and dynamic passcode applications, both for contact cards (VIS 1.4) and for contactless cards (VCPS 2.0, qVSDC, MSD).

Dirk Jan van den Heuvel, CEO Collis, adds: "Collis is very pleased that the Collis EMV PVT's GCCV implementation has been confirmed by Visa for use in connection with Visa Inc. programs. Collis' EMV Personalisation Validation Tool continues to offer the latest in comprehensive testing for card personalisation. With extensive coverage of Visa test scenarios, this test tool is a must have for those parties who wish to ensure correct card personalisation and enable worldwide acceptance".

Collis is a member of ACT Canada; please visit http://www.collis.nl.

11. INDUSTRIAL COMMERCIAL BANK OF CHINA (ICBC) SELECTS ACONITE AFFINA ENTERPRISE FOR SMART CARD ISSUANCE
Source: Aconite (01/27)

Aconite announced that their strategic partner, Datacard Asia Pacific, has been awarded the contract to supply Aconite's smart card management solution, Affina Enterprise to ICBC for the management and post-issuance of their smart card portfolio.

ICBC is China's largest bank, offering corporate and personal banking services to 2.72 million corporate customers and 170 million retail customers internationally. They were looking for a post-issuance card solution that would enable them to personalise cards services at both the regional and individual level through the upload of new smart card applications onto the cards after issuance. Following an extensive review and evaluation of the available solutions, Datacard Asia Pacific was selected to supply Aconite's Affina® Enterprise as a part of their complete card management solution as it met ICBC's functional requirements and offered the desired levels of service and security.

Aconite is a member of ACT Canada; please visit http://www.aconite.net.

12. NEW NFC ECOSYSTEM AND PLAYERS EMERGE - Members Only Access

13. BANK ASYA DEPLOYS SMARTSOFT'S INSTANT ISSUANCE SOLUTION TO DELIVER MASTERCARD EMV CARDS IN A MATTER OF MINUTES
Source: SmartSoft (01/15)

SmartSoft announced that its EPCA award-winning EMV Instant Issuance solution has been deployed by Bank Asya in over 150 locations across Turkey. The system has been used to issue already over 50,000 MasterCard EMV cards, each uniquely personalized and embossed for the cardholder in a matter of minutes. This is by far the largest implementation of an EMV Instant Issuance system in Turkey, and further demonstrates the progressive nature of EMV deployment in that market.

Bank Asya, supported by the SmartSoft SmartCity technology platform, is one of a number of banks in Turkey leveraging their investment in EMV infrastructure. In 2008, the bank launched ASYAcardDIT, a multi-application card that combines MasterCard PayPass for public transport and "Dynamic Ticket Calculation" with value-added programs such as two factor authentication for internet banking logon, top-up of MasterCard Pre-Authorized Debit and PIN change. The cards also have an implementation of MiFare used to access toll roads and are one of the many card types that can be issued instantly to cardholders.

ASYAcardDIT can be issued as a prepaid card, or as a MasterCard Pre-Authorized Debit card from Bank Asya. The SmartSoft OCEAN Card Management System, which is part of the SmartCity platform, manages the prepaid cards, and supports the flexible loyalty and marketing programs.

MasterCard Canada is a member of ACT Canada; please visit http://www.mastercard.ca.

14. GEMALTO PROVIDES COMBINED INNOVATIVE IDENTITY & PAYMENT CARD TECHNOLOGY FOR SANTANDER UNIVERSITIES GLOBAL DIVISION IN BRAZIL
Source: Gemalto (12/11)

Gemalto announced it is providing Banco Santander with innovative technology for its university identity card program. It is Brazil's first multi-functional smart card combining EMV payment and contactless access control on a single ID card, to be used within the university buildings - for students, teachers and staff. Gemalto delivers the cards to the universities and personalizes each card with the cardholder's unique data at its personalization center in Barueri, São Paulo.

The Gemalto card can be used for a wide variety of services and applications. For instance, students have the option to use their card as a Banco Santander EMV debit card, benefiting from the ongoing EMV migration in Brazil.

Unicamp was first to join in the Santander University program with cards for the EMV payment functionality. Anhanguera will be first to use the new multi-functional card. Santander University Division has already started distributing the cards to Anhanguera Campus, in Valinhos (São Paulo).

With this program, the bank expects that more than 100,000 students will have Gemalto´s cards by the end of 2008. At Anhanguera University, the contactless card enables more secure access to buildings such as libraries and labs, where it will replace the barcode system and magnetic stripe. Students can use a single card to check out books from the library and to pay at their cafeteria, for photocopy and for other student expenses.

Other possible new applications include digital signature, integration with public transportation secure storage of data, and secure access to university computer networks. The contactless functionality can even be used to register class attendance, eliminating the need for professors to spend time calling out the attendance sheets.

Gemalto is a member of ACT Canada; please visit http://www.gemalto.com.

15. MARITZ LAUNCHES REAL-TIME POS LOYALTY PLATFORM - Members Only Access

ACT Canada is the stakeholder association, focused on secure payment, secure identity management and other advanced applications. Now in our 20th year, we are the authority on the Canadian market, supporting our members through working with key stakeholders. We help members understand the market, public and private sector applications and potential barriers. We facilitate knowledge transfer and thought leadership through a neutral forum, while expanding our members' networks. Founded in 1989, ACT Canada is a non-profit membership association. Please visit http://www.actcda.com or contact our office at 905 426-6360.

Please forward any comments, suggestions, questions or articles to andrea(AT)actcda.com. If you would like to be removed from our newsletter distribution list please reply to this email with the word "REMOVE" in the subject field. Please note that articles contained in this newsletter have been edited for length, and are for information purposes only.

Andrea McMullen
VP, Operations
ACT Canada
tel: 905 426-6360 ext. 24
fax: 905 619-3275
email: andrea(AT)actcda.com
web: www.actcda.com
mail: 85 Mullen Drive, Ajax, ON, L1T 2B3