|
Presentations
A SUBMISSION TO THE STANDING COMMITTEE ON
HUMAN RESOURCES DEVELOPMENT AND THE STATUS
OF PERSONS WITH DISABILITIES
February 3, 1999
by Catherine Johnston, President & CEO,
The Advanced Card Technology Association
of Canada
Ladies and gentlemen, I would like to thank
you for the opportunity to discuss this topic
with you. It is one that my association has
monitored over the past ten years. The Advanced
Card Technology Association of Canada is
a non-profit association that represents
new card technologies, such as smart, optical
and capacitive cards. We do not represent
the industry or the market place, but rather
provide a voice for these technologies. This
allows us to talk to you without prejudice
towards specific technologies or vendors.
Today, I would like to touch on the growth
of card fraud globally and in Canada, outline
how others have dealt with this problem,
offer a suggestion of how to secure our Social
Insurance Number card, identify some "elephant
traps" and put forward a suggestion
on how to fund a new card.
Before I start, I would like to state, on
behalf of the association, that we are strongly
in favour of Bill C54 and would hope for
a quick passage and enactment.
GLOBAL FRAUD
In the past fifty years we have seen technology
introduced at an increasingly rapid rate.
With these technologies, we have enjoyed
new products and services. In the world of
cards, magnetic stripe technology has made
it possible for us to enjoy credit (cards)
and more recently debit. When these cards
were first introduced, no one would have
predicted how rapidly they would become a
mechanism for fraud.
In the early stages, the limited number of
cards in use precluded wide spread fraud,
as it would have been too visible. As the
number of cards in use grew, they became
a target. In 1994, worldwide credit card
fraud losses were in excess of $3 billion
U.S. Three years later, in 1997, it had grown
to more than $5.3 billion U.S. Card fraud
is a growth industry. There are two significant
factors here. Approximately 45% of the fraud
is related to counterfeit cards and most
significantly, card fraud is primarily committed
by organized crime. It is not casual or random
fraud.
Many cards, including our Social Insurance
Number card, have value and organized crime
who defraud these cards use the proceeds
to fund their other businesses, including
drugs, gambling and prostitution. This type
of fraud offers a good return on investment
as the materials to create new cards are
readily available and very inexpensive. Risks
are minimal as judiciaries around the world
tend to view credit card fraud as a victimless
crime. How does Canada rank in terms of card
fraud?
CANADIAN FRAUD
In 1997, credit card fraud losses in Canada
were $126.5 million (Cdn). Based on the first
two quarter figures from 1998, it is estimated
that the year end losses will be approximately
$215 million (Cdn), an increase of 70% in
one year. This can be attributed to the state
of the global economy. As the Asian economy
suffered, fraud shifted to other areas.
In December, the RCMP conducted a raid in
Toronto and seized 5,000 gold Visa cards.
Each of those cards would generate approximately
$3,000 in revenue for the counterfeiters.
You must wonder what this has to do with
Social Insurance Number cards. Organized
crime does not restrict their activities
to credit cards. During this raid the RCMP
also seized Citizenship Card templates, Government
of Canada cheque plates, blank driver's licenses
and Social Insurance Number card templates.
They were also engaged in debit card skimming,
a process of reading information from valid
debit cards to allow the creation of counterfeit
cards.
Debit cards are also a growing target for
card fraud. No one can claim that it is victimless.
If you are the victim, your first indication
may be an empty bank account. For the record,
consumers are the primary underwriters of
credit card fraud, but the charges are not
obvious to card holders.
In the Toronto raid, two groups were working
together; one to supply the numbers and data
and the second to build the cards. Organized
crime has no problem sharing information
if it helps them make money, nor are they
hampered by any legislation that would prohibit
that sharing.
I offer all of this information to point
out that the Canadian government should not
be faulted for prior abuses of Social Insurance
Number Cards. The time has come, however,
to acknowledge that the existing cards are
no longer secure enough in light of today's
criminal attacks.
Why would anyone counterfeit a Canadian Social
Insurance Number card? I am sure that you
all have an answer for that. Ironically,
in addition to fraudulent cards, a part of
our problem is that our legitimate numbers
are used improperly as identification for
activities other than employment and revenue
related transactions. Twice in the past month
retailers have asked me for my number as
I bought products and services. Many Canadians
are unaware of who may legitimately request
their number and equally unaware of the consequences
of that number being misused.
A rapidly growing fraud is the theft of identity.
Social Insurance Number cards are used to
falsely obtain drivers licenses, health care
cards and credit cards. All this leads to
a very expensive ripple effect with many
Canadian social programs suffering the resultant
fraud.
As I said, I don't believe that anyone could
have foreseen the extent of today's card
fraud when the Social Insurance Number program
was put in place, however, today's government
must find a way to deal with the problems
I've mentioned. Thankfully there are solutions
that have been successfully implemented by
others. They employ a card technology called
smart cards.
SMART CARDS
These cards bear a similarity to the credit
cards and other pieces of ID that you each
likely carry in your wallets. International
standards are set to determine the physical
characteristics of the cards. Where they
differ, is that they use an embedded computer
chip rather than a magnetic stripe. This
chip allows the card to function much in
the same way as a personal computer (pc)
works. In other words, they are a pc on a
piece of plastic.
This computing capability provides much more
security than any existing card technology
and also allows you to offer more functionality
on one card. This is valuable, as Canadians
have expressed a great desire to trim the
bulk from their wallets. Today's one card
for each program has resulted in Canadians
carrying many more cards than they want.
Smart cards are not a new technology, but
have been in existence since 1969. Over that
thirty-year period they have become "smarter",
can carry more information and have become
much less expensive. As a result, countries
around the world have implemented them for
financial, telecommunications, transit, retail,
government and other applications. Smart
cards in North America totaled 13 million
in 1996. Schlumberger Electronic Transactions
expect this to grow to 273 million by 2001
and a staggering 543 million in North America
by 2005. By that time, 3.75 billion chip
cards will be employed worldwide.
This technology also allows you to secure
the data on the card; so only authorized
persons have access to the information the
card holds. Today, most information is printed
on the face of cards, where anyone can see
it. In the case of multiple application smart
cards, you might have information related
to more than one program; for example a social
insurance number, voter registration and
electronic passport. In this scenario, access
to data in one application would not allow
you access to others. Your employer, who
is authorized to access your Social Insurance
number, would not be able to view voter status
or passport information. In this way, multiple
application smart cards work like mainframe
computers where your access is restricted
to the specific data you are authorized to
use.
Let's look at a smart card implementation
where security was a primary component.
CARTES BANCAIRE
A 1989 study of credit card fraud in France
showed that fraud was growing by 10% annually.
It was projected that by 1992 it would be
$155 million (US). To counter the fraud,
they implemented over an eighteen-month time
frame, 21 million new bank cards, 14 million
of which were smart cards. In the first year
they saw a 46% reduction in fraud. Correspondingly,
fraud increased in every neighboring country
that was still using mag stripe cards. This
is a typical result as each time a country
or organization enhances its security, fraud
moves to the next weakest area. For Canada,
it means that we always need to keep ahead
of the United States, as we cannot afford
to have their fraud shift to us.
There would have been an even greater reduction
in card fraud, were it not for the fact that
French bank cards still carry a mag stripe,
which is used to turn the card into a credit
card when citizens travel outside of France.
In fact, this foreign use accounted for 35%
of the total remaining fraud.
PROPOSED SOLUTION
In Canada we have an opportunity to readdress
who should have access to Social Insurance
numbers and whether there is merit for citizens
to have another number that could be used
for general identification. I would strongly
recommend that you investigate the use of
smart card technology to protect Social Insurance
numbers and furthermore, take advantage of
the card's capabilities to add additional
protected information. This card might also
carry an application to facilitate or authorize
citizen's access to the government's new
Community Access internet program.
Let's look at what that would entail. It
would start with a feasibility study and
determination of what a new card would carry.
A Privacy Impact Assessment would be conducted
in conjunction with the design of the application(s).
A risk analysis would be done.
Global standards are already in place that
deal with cards, applications, operating
systems and reader/writers. Globally, Visa,
MasterCard and Europay, have announced their
intentions to move all their credit cards
from mag stripe to smart (sometimes referred
to as chip) technology. To do this, they
have developed the EMV standards for the
card applications, transaction processing
and the reader/writers. In Canada, financial
institutions have taken those and developed
the IMV specifications. Interac, MasterCard
and Visa have done this to facilitate a national
infrastructure. Using these IMV specifications,
others may benefit from that national infrastructure.
There are many benefits that will be identified
during a feasibility study. One I would like
to emphasize today is that the emergence
of smart card technology in North America
will be very similar to the introduction
of pc's in the eighties. This is an area
of tremendous employment potential. Canada
is currently ahead of the United States in
the introduction of the technology and Canadians
can develop expertise in this technology,
as we have with others in the past.
PAYING FOR THE SYSTEM
There are many elements to paying for any
new system. In my presentation today, I referred
to sharing the "real estate" on
the card between applications and ministries.
For example, a voter's status would allow
us to finally eliminate very costly enumeration.
Instead of paying to assess every citizen's
status, every election, we could save significant
costs by dealing only with voter status exceptions.
Whenever applications that formerly required
separate cards are combined on a secure multi-application
smart card we would enjoy production and
distribution savings. Additional significant
savings are to be realized through reducing
fraud in many social programs. By using card
reader/writers that conform to standards
you need not build and pay for the complete
infrastructure, but can leverage your investment.
All these contribute to a positive business
case and also allow you to provide more secure
and privacy enabling cards.
We've covered a lot of information in a short
time and I will be very happy to address
questions later in this meeting.
I would like to thank everyone who worked
to organize today's meeting and each of you
for your interest and attention. I wish you
well in your future endeavours and will provide
any future information you request. Thank
you.
Catherine Johnston
President & CEO
Advanced Card Technology Association of Canada
905 426-6360
ACT Canada is an international non-profit
association for the advancement of card technologies.
We work on behalf of our members to promote
the awareness, understanding and use of all
advanced card technologies; including optical,
smart, capacitive and emerging technologies.
If you would like to learn more about ACT
Canada membership please visit the membership section of our web site or contact our office at
(905) 426-6360.
Please forward any comments, suggestions,
or questions to info(AT)actcda.com
|
 |
