ACTion Newsletter

October 29, 2009

Welcome to the October edition of ACTion News. This complimentary service is provided by ACT Canada; "building an informed marketplace". It is also available in the Resource Centre of our web site. Please feel free to forward this to your colleagues.

If you would prefer to receive this newsletter in plain text please email your request to andrea(AT)actcda.com.

IN THIS ISSUE:
1. Editorial Comment
2. Tough Identity Theft Law Passed
3. Canadians Welcome Choice When Shopping at Home, Abroad or Online with Visa Debit Card
4. INTERAC and China Unionpay Collaborate to Provide Chinese Travellers Access to Canadian ABMs
5. Could U.S. Consumers Spur Adoption Of EMV In U.S.? - Members Only
6. Gemalto PIV Card for Enhanced U.S. Government Security Doubles Memory Capacity - Earns GSA Approval
7. INSIDE Contactless and Dynamic Card Solutions Team On Instant In-Branch Issuance
8. PCI Fines for PIN Pads Pushed Back Two Years - Members Only
9. Oberthur Technologies Achieves MasterCard(R) Certification for Flash Memory Based Payment Cards
10. ATM Card Capture Crime Soars In EU; Pressure Grown On US To Move To EMV - Members Only
11. Collis Card Simulator & Collis Brand Test Tool qualified as Validation Tools for TIP Testing by MasterCard
12. NXP Wins Supply Contract for Chinese ePassport Chips
13. Giesecke & Devrient and Phison Set Up Joint Venture
14. Gemalto and Opentrust Provide Joint Integrated Enterprise Security Solution
15. European Research Project "BioP@Ss" To Enhance Chip Card Security Paves The Way For Electronic ID Cards With EU-Wide Validity

ACT Canada Partners:

Collis is a leading provider of EMV, e-ID, and e-Passport test tools, consulting, and training in Canada. Contact us for EMV training and test tools for every step of the EMV Transaction life-cycle - Cards, Terminals, Acquiring host and Authorization host. Collis America at 1-651-925-5410.

Visa operates the world's largest retail electronic payments network and is one of the most recognized global financial services brands. Visa facilitates global commerce through the transfer of value and information among financial institutions, merchants, consumers, businesses and government entities.

ACT CANADA THANKS OUR NEW & RENEWING MEMBERS:

PRINCIPAL
Gemalto ~ member since 2005
Giesecke & Devrient ~ member since 1990
VanCity ~ member since 2008

GENERAL
Deloitte ~ member since 2007
MasterCard Canada ~ member since 1999
YesPay ~ member since 2008

ASSOCIATE
PJE Consulting ~ member since 2005

CALENDAR OF EVENTS:

CARTES & IDentification 2009
November 17-19, 2008
Paris, France
http://www.cartes.com

1. EDITORIAL COMMENT
Source: Catherine Johnston, President & CEO, ACT Canada (10/29)

Striking the Balance Scorecard
Whether you are balancing your own professional or personal priorities or are involved in balancing issues and opportunities for your organization, your ability to conquer this challenge dictates how happy and successful you'll be.

Here is our view of how well Canadian market sectors are meeting the challenge.

Financial Sector
Score - A. Overall the financial sector has its act together, if you'll pardon the pun. We've just conducted our second annual survey to determine what information the sector wants presented at Cardware 10: Financial Insights. We are impressed by the balance struck between information needed to deal with existing issues and information desired to pursue viable opportunities.

Score - A+. A number of FIs have worked with ACT Canada to issue an RFP for PIN Management. Vendors benefit because they can pursue several opportunities through a single response. Given that the cost to respond to an RFP can be significant in terms of resources, this is a major benefit. For the FIs, they too saved substantially by working together through the association. This innovative approach serves all well, balancing the interests of the buyers and the sellers.

Score - B. This score is a compromise. Most of the Canadian FIs deserve an A for participation in stakeholder groups such as ACT Canada strategic leadership teams. These balance both short and long term objectives across a broad range of stakeholders, enabling a healthy market for all. A small number of FIs score a 'C', choosing to stay isolated.

Government Sector
Score - C+. The bright note this year is also an area of frustration. Treasury Board's Identity Management Directive was meant to be followed by more information. That information would allow federal government organizations to meet the interoperability challenge, while meeting the needs of their individual programs. While the intent is good, and planning and discussion continue at the high levels of government, there is not enough stakeholder discussion to move this forward. When that happens we will expect this initiative to attain a higher score. To rate a much higher score, government should reach out to the private sector for input. In the past two years, Treasury Board has done this, but as a formal request for information. What is needed now is an ongoing, less formal, dialogue between major stakeholders.

So to end with a little humour - just remember - balance keeps us from falling on our heads!

2. TOUGH IDENTITY THEFT LAW PASSED
Source: CBC News (10/27)

The Canadian federal government has passed tough new legislation to give police and courts added powers to fight identity theft.

"This legislation … will better address identity theft and provide police with the tools they need to help stop these crimes before they are committed," Justice Minister Rob Nicholson said in a statement released Tuesday in Ottawa.

Bill S-4 creates three new Criminal Code offences related to identity theft, including:

Obtaining and possessing identity information with the intent to use the information deceptively, dishonestly or fraudulently in the commission of a crime.
Trafficking in identity information, an offence that targets those who transfer or sell information to another person with knowledge of, or recklessness as to, the possible criminal use of the information.
Unlawfully possessing or trafficking in government-issued identity documents that contain the information of another person.

All three offences carry five-year maximum prison sentences. In addition, the legislation gives courts the power to order offenders to pay restitution to a victim of identity theft as part of their sentence. Identity theft costs Canadian consumers, banks and credit card firms, stores and other businesses an estimated $2 billion annually, according to the Canadian Council of Better Business Bureaus.

3. CANADIANS WELCOME CHOICE WHEN SHOPPING AT HOME, ABROAD OR ONLINE WITH VISA DEBIT CARD
Source: Visa Canada (10/13)

Debit cards are the most frequently used payment cards in Canada and Visa Debit cards will offer cardholders core features not currently available in the Canadian marketplace. Visa Debit cardholders will be able to use their Visa debit cards to shop in Canada, at retail locations worldwide, buy goods widely online, over the phone or by mail.

Survey results from Visa confirm that Canadian consumers welcome more choice in the country's debit marketplace. The survey, commissioned by Visa Canada between June 26 and July 5, 2009, found that three out of four (74 per cent) respondents said they would be interested in a debit card that offers enhanced features and two out of three (66 per cent) believe that consumers should have more choice when it comes to direct debit payments in Canada.

Retailers that choose to accept Visa Debit cards will be able to offer customers choice at the point-of-sale and may benefit from increased online, mail or telephone transactions as Visa Debit will offer businesses the opportunity to access an underserved customer base that prefers to use debit, as well as customer segments that may not have access to Visa credit, like young Canadians. Some consumers surveyed in 2008 who had never shopped online indicated they would do so using Visa Debit.

Visa Canada is a member of ACT Canada; please visit http://www.visa.ca.

4. INTERAC & CHINA UNIONPAY COLLABORATE TO PROVIDE CHINESE TRAVELLERS ACCESS TO CANADIAN ABMS
Source: Interac (09/28)

INTERAC, Canada's national debit network, and China Unionpay, China's national bank card payment network, have launched a new service that will give China Unionpay cardholders travelling in Canada the ability to withdraw cash from ABMs of participating acquirers in Canada.

The agreement with China Unionpay builds on international expansion of the INTERAC network, which already has agreements in place with two U.S. debit networks.

"China Unionpay is another milestone in our efforts to expand our payment services internationally," said Mark O'Connell, President and CEO, Acxsys Corporation and Interac Association. "With approximately 250 associate members, 1.9 billion China Unionpay cards, and acceptance in 67 other countries and regions, China Unionpay has extensive reach and opens up a wealth of opportunity for INTERAC."

The agreement with China Unionpay is expected to drive incremental ABM volumes for Canadian acquirers, by providing access to a growing cardholder base. In fact, according to the World Tourism Organization, China will become one of the top three outbound tourism markets in the world by 2010.

China Unionpay and INTERAC networks will connect through a Gateway, eliminating network setup and significantly reducing development costs for Canadian acquirers.

In other news, INTERAC announced the Canada Revenue Agency (CRA) as the first major federal government agency to begin accepting INTERAC Online, allowing Canadians to make income tax payments directly from their bank accounts. INTERAC Online is an online payment option that allows Canadians to make secure payments for products or services directly from their bank account, without sharing personal financial information or card numbers. Source: Interac (10/02)

Interac Association is a member of ACT Canada; please visit http://www.interac.ca.

5. COULD U.S. CONSUMERS SPUR ADOPTION OF EMV IN U.S.? - Members Only Access

Available in the ACT Canada Members Only section of our web site. Click on the link below to access this section
http://www.actcda.com/members-only/news.htm

If you are a member of ACT Canada but do not have your login details please contact me - andrea(AT)actcda.com

6. GEMALTO PIV CARD FOR ENHANCED U.S. GOVERNMENT SECURITY DOUBLES MEMORY CAPACITY - EARNS GSA APPROVAL
Source: Gemalto (10/27)

Gemalto announced that its large memory Personal Identity Verification (PIV) card is now listed on the General Services Administration (GSA) Approved Product List (APL). Gemalto has already begun volume deliveries of the card for the U.S. federal government's PIV program. The card has already received FIPS 201 and FIPS 140-2 certifications.

The Gemalto PIV Card is dual contact/contactless technology built on the JavaCard platform. It doubles the storage capacity of today's PIV cards, a highly demanded feature in the government sector.

The Gemalto PIV card allows the identities of government employees and contractors to be verified electronically quickly, while resisting any fraud, tampering or counterfeiting. Already capable of secure storage of cardholder fingerprints, the card also supports, through its open platform, adding new applications, such as biometric match-on-card, if desired.

Gemalto is a member of ACT Canada; please visit http://www.gemalto.com.

7. INSIDE CONTACTLESS AND DYNAMIC CARD SOLUTIONS TEAM ON INSTANT IN-BRANCH ISSUANCE
Source: Source: INSIDE Contactless (10/27)

INSIDE Contactless and Dynamic Card Solutions (DCS), announced a partnership to facilitate and speed the deployment of a new wave of innovative contactless cards, mobile payment stickers and mobile payment peripheral devices. The partnership ensures that banks will be able to instantly personalize and activate a variety of innovative mobile payment solutions based on INSIDE's MicroPass contactless (MicroPass 4000) and dual interface (MicroPass 6000) payment chip sets, and will make it faster and easier for them to deploy cards, stickers and mobile payment peripheral devices for contactless payments.

INSIDE's MicroPass powers more than 80 percent of the North American contactless payments market, including products from all major bank card issuers.

Using the DCS CardWizard® software, bank branch personnel will be able to instantly and securely personalize any of INSIDE's current and future MicroPass-enabled contactless or dual interface products in any form factor, including MicroSD cards, contactless mobile payment stickers and other accessories. These new mobile payment peripheral solutions will be able to be used with existing mobile phones and other consumer electronics devices, and instant activation means the personalized device can be used immediately for contactless point-of-sale purchases.

INSIDE Contactless & Dynamic Card Solutions are members of ACT Canada; please visit http://www.insidecontactless.com & http://www.instantissuance.com.

8. PCI FINES FOR PIN PADS PUSHED BACK TWO YEARS- Members Only Access

9. OBERTHUR TECHNOLOGIES ACHIEVES MASTERCARD(R) CERTIFICATION FOR FLASH MEMORY BASED PAYMENT CARDS
Source: PR Newswire (10/07)

Oberthur Technologies announces the successful completion of MasterCard(R) CAST certification (Compliance Assessment & Security Testing program) for its Flash memory based payment card.

With the completion of MasterCard's most stringent security testing, Oberthur Technologies has demonstrated that Flash-memory based payment cards can be fully compliant with global payment standards. Flash-memory based products bring more flexibility to financial institutions in issuing with a reduced time to market by eliminating the "masking" phase, which is usually required to load software onto the payment card's chip during the manufacturing process. With Flash memory, cards can be securely loaded with customized applications such as debit, credit or other payment applications without having to go through the masking process.

Flash technology has become the universal memory standard in the semiconductor world, and is commonly used in SIM cards for mobile phones or for mass storage devices. It provides greater flexibility for managing applications and no power is needed to maintain the information stored.

Oberthur Technologies is a member of ACT Canada; please visit http://www.oberthur.com.

10. ATM CARD CAPTURE CRIME SOARS IN EU; PRESSURE GROWN ON US TO MOVE TO EMV - Members Only Access

11. COLLIS CARD SIMULATOR & COLLIS BRAND TEST TOOL QUALIFIED AS VALIDATION TOOLS FOR TIP TESTING BY MASTERCARD
Source: Collis (10/20)

Collis is pleased to announce that the Collis Card Simulator has been qualified by MasterCard as Validation Tool for the formal TIP (Terminal Integration Testing) certification process for contact mode. As the Collis Card Simulator is one of the core components of our Collis Brand Test Tool means that the log files generated by the Collis Brand Test Tool (in the MasterCard format) are also accepted by MasterCard during formal TIP. Thus both tools Card Simulator & Brand Test Tool are capable of producing the MasterCard log files.
The Collis Card Simulator includes all card images needed for TIP Testing:

Subset 1
Field Interoperability
Maestro UK Subset

Additionally, besides that of the certification and the correct test case implementation, we recently added a new feature capable of importing the ICC report in excel format with results and the verdict. This saves a lot of time to the tester, as well as improving the consistency in the results sent to MasterCard for their evaluation.

Collis and MasterCard Canada are members of ACT Canada; please visit http://www.collis.nl & http://www.mastercard.ca.

12. NXP WINS SUPPLY CONTRACT FOR CHINESE EPASSPORT CHIPS
Source: American Chronicle (10/19)

NXP announced that its SmartMX security chip has been chosen by the Chinese government to power the country's first ePassport scheme. Utilizing the latest developments in cryptography and security to protect the chip at both hardware and software level, NXP's portfolio of SmartMX products enables data to be securely stored on the passport, creating an even stronger link between the document and its owner. The Chinese government will start issuance of ePassports in 2010, and is planning to replace all paper-based passports. At present over 30 million passports are in circulation within China, therefore substantial roll-out volumes of ePassports is expected in the coming years.

NXP is currently involved in more than 80 percent of all ePassport schemes, having shipped about 150 million ICs to date. In total, 68 out of 79 countries which have deployed ePassports are using NXP SmartMX chip technology including the US, United Kingdom and Singapore.

NXP's SmartMX chips comprise a number of unique security features to guard against attack scenarios with light and lasers as well as a dedicated hardware firewall to protect specific sections on the chip. In addition, the ICs provide faster read and write capabilities due to optimized hardware and software. NXP's SmartMX chips can be delivered in the industry's thinnest 250Âµm chip-package, making it suitable for a wide variety of contact and contactless eGovernment applications.

NXP is a member of ACT Canada; please visit http://www.nxp.com.

13. GIESECKE & DEVRIENT AND PHISON SET UP JOINT VENTURE
Source: ICMA Industry News (10/07)

Giesecke & Devrient (G&D) and Phison, the Taiwanese global market leader in flash and USB controller technology, are joining forces to develop and market secure flash products. Their joint venture-Giesecke & Devrient Secure Flash Solutions GmbH-will be headquartered in Munich (Germany) and will have a second office in Taipei (Taiwan). It will develop and market hardware-based security solutions for mobile end devices, for example in the form of microSD cards and USB tokens. G&D will hold a 70 percent majority stake in the joint venture.

Mobile end devices for communications and multi-media applications such as notebooks, cell phones, mobile TV equipment and games consoles have become an integral part of everyday life. These applications make it necessary to protect the digital identity of the user. At the same time, mobile transactions made using the equipment and data stored on it also need to be protected against unauthorized access. Giesecke & Devrient Secure Flash Solutions will offer security solutions that cover these market demands and are designed for special applications such as the encryption of e-mails or cell phone conversations, or mobile pay-TV.

Giesecke & Devrient is a member of ACT Canada; please visit http://www.gi-de.com.

14. GEMALTO AND OPENTRUST PROVIDE JOINT INTEGRATED ENTERPRISE SECURITY SOLUTION
Source: ICMA Industry News (10/07)

Gemalto announced it is working alongside OpenTrust to provide an integrated turnkey enterprise security solution.

As part of the collaboration, OpenTrust has incorporated Gemalto's entire range of secure identity management solutions into its Smart Card Manager offering, including the Gemalto Protiva .NET & Strong Authentication Solutions in particular.

The combined solution, which is already being deployed at joint customers of the two companies, enables users in the public and private sector to authenticate themselves and access their sensitive data through fixed or wireless networks, in a secure and convenient way.

OpenTrust's Smart Card Manager ensures flexible management of smart cards and certificates. Combined with Gemalto's strong authentication solutions, it enables organizations to implement one-time password and certificate-based programs in a smooth manner.

Since it is integrated prior to deployment, the new solution simplifies IT management and reduces total cost of ownership.

Gemalto is a member of ACT Canada; please visit http://www.gemalto.com.

15. EUROPEAN RESEARCH PROJECT "BIOP@SS" TO ENHANCE CHIP CARD SECURITY PAVES THE WAY FOR ELECTRONIC ID CARDS WITH EU-WIDE VALIDITY
Source: Giesecke & Devrient (10/21)

Chip manufacturers Infineon Technologies AG and NXP Semiconductors Germany GmbH (NXP) and chip card maker Giesecke & Devrient GmbH (G&D) are among the eleven companies from six European Union (EU) countries participating in the European research project BioP@ss to develop a high-security chip card platform.

BioP@ss is the biggest chip card research project in the EU. Its goal is to do the technical spadework for the introduction of an electronic ID card in chip card format valid throughout the entire EU. In addition to its function as an ID card, it will be capable of providing a secure means of authentication for services offered by governments and public authorities, with BioP@ss-holders able to identify themselves electronically and carry out biometric authentication on the Internet. The 27 EU member states have about 500 million inhabitants, and an estimated 380 million ID cards are currently in circulation.

The objective of the BioP@ss project is to make chip card technology even more secure and easier to use so that, for instance, EU citizens can draw on the services of governments and public authorities by using their ID card on the Internet. Potential services include registering a change of address, registering a vehicle, filing a tax return (eGovernment), casting a vote in elections (eVoting) and other services provided by the retail, banking and insurance sectors (eBusiness). The BioP@ss research project entails the further development of the security chips, the card operating system and the security software for the Internet PCs used by the citizens and public authorities alike. The aim is to ensure that the chips, operating systems and software conform to the various national ID document standards already developed by EU member states.

Further information on the BioP@ss research project and the project partners is available at www.biopass.eu.

ACT Canada is the stakeholder association, focused on secure payment, secure identity management and other advanced applications. Now in our 20th year, we are the authority on the Canadian market, supporting our members through working with key stakeholders. We help members understand the market, public and private sector applications and potential barriers. We facilitate knowledge transfer and thought leadership through a neutral forum, while expanding our members' networks. Founded in 1989, ACT Canada is a non-profit membership association. Please visit http://www.actcda.com or contact our office at 905 426-6360.

Please forward any comments, suggestions, questions or articles to andrea(AT)actcda.com. If you would like to be removed from our newsletter distribution list please reply to this email with the word "REMOVE" in the subject field. Please note that articles contained in this newsletter have been edited for length, and are for information purposes only.

Andrea McMullen
VP, Operations
ACT Canada
tel: 905 426-6360 ext. 24
fax: 905 619-3275
email: andrea(AT)actcda.com
web: www.actcda.com
mail: 85 Mullen Drive, Ajax, ON, L1T 2B3