- Email: [email protected]
Multi biometric visas to undergo European tests
www.compseconline.com
May 2005
ISSN 0965-2590
contents
Chase to issue ‘blink’ credit cards In a major boost to the North American smart card industry, Chase Bank USA is to begin rolling out credit cards with contactless smart card functionality later this year. The roll out will be a first for the US market and is expected to kick start the adoption of contactless smart card technology for financial transactions across the country. The bank, a division of JPMorgan Chase & Co., said that the new credit cards will be called blink. The blink cards will first appear in June, with the delivery of nearly one million cards to customers in Atlanta. The US bank says cardholders will initially be able to use the new cards at a base of more than 400 merchant locations. Chase says it has been working closely with Visa USA and MasterCard International to identify merchants where speed and convenience are important to consumers, and it has been actively building a roster of merchants. In the first instance, Chase cardholders will be able to use the cards at well-known cinemas, convenience and specialty retailers such as 7Eleven, quick service restaurants and drug stores. Convenience store chain Sheetz will be the first to launch a co-branded credit card with blink functionality. Cardholders are required to tap, rather than swipe, the card on a point-of-sale terminal at the checkout. The card communicates with the terminal via radio frequency technology and transmits to the reader approximately the same data that is stored on its magnetic stripe. If successful, the terminal will then emit a signal or tone to acknowledge payment confirmation.
Tests have shown that the payment mechanism is ideal in locations where consumers might normally use cash for smaller transactions, or where increased transaction speed and customer convenience are desirable. According to Chase, the most significant time savings can be realized in the drive-through environment, where transaction time was reduced by as much as 20 seconds compared to a cash transaction. Research also suggests that customers seem to spend more per transaction and are happier with their store experience. The cards will still be valid for regular transactions anywhere that Mastercard or Visa payments can currently be made, and they will be able to use the contactless functionality wherever contactless payments are accepted. By the end of 2005, Chase plans to have thousands of merchant locations across the country where contactless payments will be accepted and millions of cards will have been rolled out. 7-Eleven will be an early adopter of Chase’s blink cards and will test the card in 170 of its stores. According to Rick Updyke, vice president of business development for 7-Eleven: “Contactless payment fits well with 7-Eleven's strategy of providing consumers convenient, quick service. As such, we expect to roll out these cards to our 5,300 US stores.” In order to stimulate interest in the technology, Chase said it will launch a fully integrated marketing and advertising campaign, with cardholders being encouraged to “blink lunch”, “blink a drink” or “blink a movie”.
NEWS HIGHLIGHTS Controversial real ID Act approved ......3 Are the passport plans in disarray?......4 UK slow to adopt payment system ......5 Indian market powered by SMI ............6 Identifier based encryption for cards..16
BIOMETRIC BYTES Breaking news from the biometrics industry ..............................................8
CHIP TALK Kevin Gillick of GlobalPlatform takes us through the next stages of their growth and development ................................9
FEATURES What’s on the cards for the Middle East? A look at the potential for electronic payments in this changing are............10 Growing Europe through electronic payments How is the Euro-zone coping with different systems and its plans for the future ................................................12
SURVEY Mass market movement The first part of a two part look at smart cards and the mass transit sector ......14
VIEWPOINT David Jones considers the real implications of charging for ATM use ........................16
Multi biometric visas to undergo European tests A major technology trial designed to scrutinise the issuance and subsequent verification of chip-based multi-biometric visas has just got underway in Europe. The project, known as Biodev, has gone live in several foreign French consulates and at two of the main airports in
France – Charles de Gaulle and Orly. Belgium consulates are expected to be equipped with the appropriate issuing technology in the coming weeks and the trial will also be implemented at Marseille and Lyon airports in France, Brussels airport in Belgium, and the port in Marseille.
REGULAR ITEMS News Extra and Comment ....................2 News in Brief ....................................3-7 Events Calendar ..................................7
Continued on page 3 ISSN 0965-2590/05 © 2005 Elsevier Ltd. All rights reserved This journal and the individual contributions contained in it are protected under copyright by Elsevier Ltd, and the following terms and conditions apply to their use: Photocopying Single photocopies of single articles may be made for personal use as allowed by national copyright laws. Permission of the publisher and payment of a fee is required for all other photocopying, including multiple or systematic copying, copying for advertising or promotional purposes, resale, and all forms of document delivery. Special rates are available for educational institutions that wish to make photocopies for non-profit educational classroom use.
news Continued from page 1... The French airports have designated areas for use by holders of Biodev visas. Here, there is the option to check the identity of the visa holder either using the information stored on the contactless chip or against a central database containing the visa holder’s enrolment data that was collected at the time of issuance in selected consulates around the world. Sources told CTT that biometric visas are currently being issued in several locations including Bamako in Mali, Colombo in Sri Lanka (incidentally the same location as recent UK visa trials) and Minsk in Belarus. According to French Interior Minister Dominique de Villepin other locations to be added could include San Francisco in the USA and Shanghai in China. It is expected that this diversity in locations will help ensure that different cultures and ethnic backgrounds can be monitored to identify any potential technical difficulties or societal sensitivities. The prime contractor was announced as French technology company Sagem. Meanwhile French smart card manufacturer Gemplus said it has delivered contactless smart cards for the trial based on its GemBorder2 technology. According to Gemplus, the card is carried in a cardholder pocket placed inside the passport books. The chip can also be delivered in the form-factor of an e-visa sticker placed inside the passport. Expected to last for approximately one year, the trial is potentially a precursor to the biometric visa information system (VIS), which is being proposed for installation throughout the EU’s Schengen area. In addition the pilot will help determine the impact of new control and work procedures that would be experienced by travellers, consular staff and border police when such a visa system is put into place. Another objective of the pilot test is to allow authorities and suppliers to verify whether or not documents issued and personalised with different equipment by clients and suppliers in five European countries are interoperable. CTT has learned that these countries are France, Belgium, Italy, Germany and the Netherlands. Sagem is supplying the enrolment stations and the multibiometric technology (facial and fingerprint recognition) that is necessary to create and personalise the travel documents. According to Sagem, the personalisation of the contactless chip will comply with International Civil Aviation Organisation (ICAO) standards, which are soon to be applied to future electronic passports. In addition, Sagem will install the temporary database for visa applicants and a search engine. Once the system is up and running, the pilot will look at the issue of interoperability by using equipment supplied by various of the other Member States involved in Biodev to enrol and subsequently match a limited number of applicants.
Card Technology Today May 2005
Contact: Hervé Philippe at Sagem, Tel: +33 1 40 70 62 57, email: [email protected] Carl Norell at Gemplus, Tel: +1 215 390 2899, email: [email protected]
driving licence/id card
Controversial Real ID act approved A controversial bill has been approved in the USA in a bid to help tighten up the security of the nation’s plethora of driving licences. The passing of the Real ID Act (H.R. 418), while not directly specifying smart card usage, is being touted as a golden opportunity for the smart card industry, which can fulfil the bill’s major requirements for a secure machine readable licence. The bill has passed through both the US House of Representatives and the Senate, despite being highly criticised by many factions who believe it to be the introduction of a national ID card via the backdoor. Spearheading the bill, James Sensenbrenner, chairman of the House Judiciary Committee, commented: “This sensible legislation is aimed at preventing another 9/11-type attack by disrupting terrorist travel and bolstering our border security. Now more than ever, drivers’ licences can be accepted as identification for federal purposes, such as boarding a commercial airplane, entering a federal building, or a nuclear power plant. Giving state drivers’ licences to anyone, regardless of whether they are here legally or illegally, is an open invitation for terrorists and criminals to exploit. States will now have to require proof of lawful presence in the US before issuing drivers’ licences.” The bill says that at a minimum States should implement physical security features designed to prevent tampering, counterfeiting, or duplication of the document for fraudulent purposes. Further the bill requires States to use a common machine-readable technology. According to the Smart Card Alliance in the USA, the smart card industry supports the inclusion of both of these provisions in the bill because it recognizes that adding physical security features alone does not do enough to ensure a driver’s licence is authentic and has not been tampered with. The Alliance said that adding a standard machine readable technology like smart chip technology will securely store the driver’s information that is printed on the licence so that it can be validated. According to Randy Vanderhoof, executive director of the Smart Card Alliance: “Based on the agreed upon language and previous
in brief • The UK’s national ID card scheme, which had been dropped in the run up to the country’s recent general elections, is now back on the agenda. Home secretary Charles Clarke was expected to unveil the latest Identity Cards bill with a raft of additional safeguards such as giving more powers to the watchdog set up to oversee the scheme, plus putting new limits on access to the National Identity Register. Both main opposition parties, the Conservatives and the Liberal Democrats, say they oppose the bill, although the Conservatives would back a bill, provided the cards had a clearly defined purpose. The Home Office estimates that ID theft costs the UK £1.3 billion a year. • E.ON Energie has chosen OMNIKEY and Giesecke & Devrient (G&D) to provide the technology and smart card readers for its smart employee credential solution. The smart card used in conjunction with the OMNIKEY CardMan 3121 and CardMan 4040 readers enables E.ON Energie’s employees to log onto their computers, gain secure access to personal data on the corporate intranet and encrypt emails. Every employee is also provided with three personal PKI certificates on a smart credential in addition to access control and cafeteria payment functions. The phased roll-out of the smart credentials to E.ON Energie employees began in November 2004. By the end of 2006, all 40,000 employees will be equipped with the G&D smart card and OMNIKEY smart card reader. • A new smart card association has been established to promote awareness of the industry in Egypt and the Arab region and to drive forward a regional standard for applications. The Egyptian Association for Smart Cards Industry & Applications (EASCIA) was created in response to a call from Egypt’s minister of Communication and Information Technology Tarek Kamel. The association will be working closely with banks to implement the worldwide payment card standard (EMV), in line with the Middle-East’s compliance mandate of January 2006. Five banks are represented on the board of the association and its chairman is Moustafa Samaha, managing director Giesecke & Devrient Egypt. The association believes that ultimately the use of smart cards will contribute to the economy of the region and raise living standards.
3
May 2005
ISSN 0965-2590
contents
Chase to issue ‘blink’ credit cards In a major boost to the North American smart card industry, Chase Bank USA is to begin rolling out credit cards with contactless smart card functionality later this year. The roll out will be a first for the US market and is expected to kick start the adoption of contactless smart card technology for financial transactions across the country. The bank, a division of JPMorgan Chase & Co., said that the new credit cards will be called blink. The blink cards will first appear in June, with the delivery of nearly one million cards to customers in Atlanta. The US bank says cardholders will initially be able to use the new cards at a base of more than 400 merchant locations. Chase says it has been working closely with Visa USA and MasterCard International to identify merchants where speed and convenience are important to consumers, and it has been actively building a roster of merchants. In the first instance, Chase cardholders will be able to use the cards at well-known cinemas, convenience and specialty retailers such as 7Eleven, quick service restaurants and drug stores. Convenience store chain Sheetz will be the first to launch a co-branded credit card with blink functionality. Cardholders are required to tap, rather than swipe, the card on a point-of-sale terminal at the checkout. The card communicates with the terminal via radio frequency technology and transmits to the reader approximately the same data that is stored on its magnetic stripe. If successful, the terminal will then emit a signal or tone to acknowledge payment confirmation.
Tests have shown that the payment mechanism is ideal in locations where consumers might normally use cash for smaller transactions, or where increased transaction speed and customer convenience are desirable. According to Chase, the most significant time savings can be realized in the drive-through environment, where transaction time was reduced by as much as 20 seconds compared to a cash transaction. Research also suggests that customers seem to spend more per transaction and are happier with their store experience. The cards will still be valid for regular transactions anywhere that Mastercard or Visa payments can currently be made, and they will be able to use the contactless functionality wherever contactless payments are accepted. By the end of 2005, Chase plans to have thousands of merchant locations across the country where contactless payments will be accepted and millions of cards will have been rolled out. 7-Eleven will be an early adopter of Chase’s blink cards and will test the card in 170 of its stores. According to Rick Updyke, vice president of business development for 7-Eleven: “Contactless payment fits well with 7-Eleven's strategy of providing consumers convenient, quick service. As such, we expect to roll out these cards to our 5,300 US stores.” In order to stimulate interest in the technology, Chase said it will launch a fully integrated marketing and advertising campaign, with cardholders being encouraged to “blink lunch”, “blink a drink” or “blink a movie”.
NEWS HIGHLIGHTS Controversial real ID Act approved ......3 Are the passport plans in disarray?......4 UK slow to adopt payment system ......5 Indian market powered by SMI ............6 Identifier based encryption for cards..16
BIOMETRIC BYTES Breaking news from the biometrics industry ..............................................8
CHIP TALK Kevin Gillick of GlobalPlatform takes us through the next stages of their growth and development ................................9
FEATURES What’s on the cards for the Middle East? A look at the potential for electronic payments in this changing are............10 Growing Europe through electronic payments How is the Euro-zone coping with different systems and its plans for the future ................................................12
SURVEY Mass market movement The first part of a two part look at smart cards and the mass transit sector ......14
VIEWPOINT David Jones considers the real implications of charging for ATM use ........................16
Multi biometric visas to undergo European tests A major technology trial designed to scrutinise the issuance and subsequent verification of chip-based multi-biometric visas has just got underway in Europe. The project, known as Biodev, has gone live in several foreign French consulates and at two of the main airports in
France – Charles de Gaulle and Orly. Belgium consulates are expected to be equipped with the appropriate issuing technology in the coming weeks and the trial will also be implemented at Marseille and Lyon airports in France, Brussels airport in Belgium, and the port in Marseille.
REGULAR ITEMS News Extra and Comment ....................2 News in Brief ....................................3-7 Events Calendar ..................................7
Continued on page 3 ISSN 0965-2590/05 © 2005 Elsevier Ltd. All rights reserved This journal and the individual contributions contained in it are protected under copyright by Elsevier Ltd, and the following terms and conditions apply to their use: Photocopying Single photocopies of single articles may be made for personal use as allowed by national copyright laws. Permission of the publisher and payment of a fee is required for all other photocopying, including multiple or systematic copying, copying for advertising or promotional purposes, resale, and all forms of document delivery. Special rates are available for educational institutions that wish to make photocopies for non-profit educational classroom use.
news Continued from page 1... The French airports have designated areas for use by holders of Biodev visas. Here, there is the option to check the identity of the visa holder either using the information stored on the contactless chip or against a central database containing the visa holder’s enrolment data that was collected at the time of issuance in selected consulates around the world. Sources told CTT that biometric visas are currently being issued in several locations including Bamako in Mali, Colombo in Sri Lanka (incidentally the same location as recent UK visa trials) and Minsk in Belarus. According to French Interior Minister Dominique de Villepin other locations to be added could include San Francisco in the USA and Shanghai in China. It is expected that this diversity in locations will help ensure that different cultures and ethnic backgrounds can be monitored to identify any potential technical difficulties or societal sensitivities. The prime contractor was announced as French technology company Sagem. Meanwhile French smart card manufacturer Gemplus said it has delivered contactless smart cards for the trial based on its GemBorder2 technology. According to Gemplus, the card is carried in a cardholder pocket placed inside the passport books. The chip can also be delivered in the form-factor of an e-visa sticker placed inside the passport. Expected to last for approximately one year, the trial is potentially a precursor to the biometric visa information system (VIS), which is being proposed for installation throughout the EU’s Schengen area. In addition the pilot will help determine the impact of new control and work procedures that would be experienced by travellers, consular staff and border police when such a visa system is put into place. Another objective of the pilot test is to allow authorities and suppliers to verify whether or not documents issued and personalised with different equipment by clients and suppliers in five European countries are interoperable. CTT has learned that these countries are France, Belgium, Italy, Germany and the Netherlands. Sagem is supplying the enrolment stations and the multibiometric technology (facial and fingerprint recognition) that is necessary to create and personalise the travel documents. According to Sagem, the personalisation of the contactless chip will comply with International Civil Aviation Organisation (ICAO) standards, which are soon to be applied to future electronic passports. In addition, Sagem will install the temporary database for visa applicants and a search engine. Once the system is up and running, the pilot will look at the issue of interoperability by using equipment supplied by various of the other Member States involved in Biodev to enrol and subsequently match a limited number of applicants.
Card Technology Today May 2005
Contact: Hervé Philippe at Sagem, Tel: +33 1 40 70 62 57, email: [email protected] Carl Norell at Gemplus, Tel: +1 215 390 2899, email: [email protected]
driving licence/id card
Controversial Real ID act approved A controversial bill has been approved in the USA in a bid to help tighten up the security of the nation’s plethora of driving licences. The passing of the Real ID Act (H.R. 418), while not directly specifying smart card usage, is being touted as a golden opportunity for the smart card industry, which can fulfil the bill’s major requirements for a secure machine readable licence. The bill has passed through both the US House of Representatives and the Senate, despite being highly criticised by many factions who believe it to be the introduction of a national ID card via the backdoor. Spearheading the bill, James Sensenbrenner, chairman of the House Judiciary Committee, commented: “This sensible legislation is aimed at preventing another 9/11-type attack by disrupting terrorist travel and bolstering our border security. Now more than ever, drivers’ licences can be accepted as identification for federal purposes, such as boarding a commercial airplane, entering a federal building, or a nuclear power plant. Giving state drivers’ licences to anyone, regardless of whether they are here legally or illegally, is an open invitation for terrorists and criminals to exploit. States will now have to require proof of lawful presence in the US before issuing drivers’ licences.” The bill says that at a minimum States should implement physical security features designed to prevent tampering, counterfeiting, or duplication of the document for fraudulent purposes. Further the bill requires States to use a common machine-readable technology. According to the Smart Card Alliance in the USA, the smart card industry supports the inclusion of both of these provisions in the bill because it recognizes that adding physical security features alone does not do enough to ensure a driver’s licence is authentic and has not been tampered with. The Alliance said that adding a standard machine readable technology like smart chip technology will securely store the driver’s information that is printed on the licence so that it can be validated. According to Randy Vanderhoof, executive director of the Smart Card Alliance: “Based on the agreed upon language and previous
in brief • The UK’s national ID card scheme, which had been dropped in the run up to the country’s recent general elections, is now back on the agenda. Home secretary Charles Clarke was expected to unveil the latest Identity Cards bill with a raft of additional safeguards such as giving more powers to the watchdog set up to oversee the scheme, plus putting new limits on access to the National Identity Register. Both main opposition parties, the Conservatives and the Liberal Democrats, say they oppose the bill, although the Conservatives would back a bill, provided the cards had a clearly defined purpose. The Home Office estimates that ID theft costs the UK £1.3 billion a year. • E.ON Energie has chosen OMNIKEY and Giesecke & Devrient (G&D) to provide the technology and smart card readers for its smart employee credential solution. The smart card used in conjunction with the OMNIKEY CardMan 3121 and CardMan 4040 readers enables E.ON Energie’s employees to log onto their computers, gain secure access to personal data on the corporate intranet and encrypt emails. Every employee is also provided with three personal PKI certificates on a smart credential in addition to access control and cafeteria payment functions. The phased roll-out of the smart credentials to E.ON Energie employees began in November 2004. By the end of 2006, all 40,000 employees will be equipped with the G&D smart card and OMNIKEY smart card reader. • A new smart card association has been established to promote awareness of the industry in Egypt and the Arab region and to drive forward a regional standard for applications. The Egyptian Association for Smart Cards Industry & Applications (EASCIA) was created in response to a call from Egypt’s minister of Communication and Information Technology Tarek Kamel. The association will be working closely with banks to implement the worldwide payment card standard (EMV), in line with the Middle-East’s compliance mandate of January 2006. Five banks are represented on the board of the association and its chairman is Moustafa Samaha, managing director Giesecke & Devrient Egypt. The association believes that ultimately the use of smart cards will contribute to the economy of the region and raise living standards.
3