Executive Director's Letter

Dear members and friends of the Alliance:

You may have noticed a significant increase recently in the number of press announcements and media stories where my name or the Smart Card Alliance has been mentioned.  This is no accident or coincidence.  This is the result of hard work and careful messaging efforts being applied to topics like ePassports, the Western Hemisphere Traveler Initiative, HSPD-12, contactless payments, and public transit though our media outreach.  It seems to be working.  As smart card adoption across multiple markets continues to forge ahead and begins to impact the lives of millions of ordinary U.S. citizens, chip technology has come out of the shadows of trade journals and technical blogs and is suddenly hitting the media mainstream in newspapers, radio talk shows, and even television news programs.  
 
This month's headline-grabbing story in Wired magazine about the German researcher who claimed to have cloned his German ePassport chip is a good example of this.  It set off a chain reaction of national and international interest that resulted in great coverage for the Alliance and the smart card industry.  Reacting quickly to debunk the reported claims that this cloning example constituted a major vulnerability in chip-enabled ePassports that criminals could use to enter countries illegally the Alliance gathered its industry experts together and issued a press release that refuted those claims.  In the release and subsequent press briefing conference call, we restated how the multiple layers of security work in the new passports, with the chip's ability to protect the integrity of the picture and personal data, the locking of that data using basic access control, and the protective shielding used to thwart skimming attacks.  The heightened fears raised by the cloning report coupled with the announced start of the government rollout of U.S. ePassports this week made this a national news story.  The subsequent counterclaims from the Alliance led to good balanced articles by the Associated Press and the Wall Street Journal.  These print stories influenced several requests for radio interviews, plus a call from NBC News and the FOX Network asking me to do on-camera interviews for their stories about ePassport security which ran nationally on August 15th and 16th. (Members can check our web site to view my 10 seconds of fame.)
 

Member Profile

Since the late 1990s, transit agencies worldwide have been deploying contactless smart card-based automatic fare collection (AFC) systems.  These systems use a contactless smart card as the fare medium, with financial credit, debit, and prepaid cards used to purchase the fare media or reload or add value to the contactless fare card at a ticket vending machine, kiosk, Web site, or other location.  The card is then used to pay the fare when boarding a bus or entering a gate.  Two pilots are now underway in New York City and Utah that are evaluating a new approach -- accepting standard financial payments industry-issued contactless credit and debit cards for fare payment directly at the point of entry.

This month, Smart Card Talk spoke with Paul Korczak, Assistant Chief Officer for MetroCard Sales Operations for New York City Transit.  Mr. Korczak has over twenty years experience in several facets of public transportation, most notably in finance, operations, and business planning.  For the past decade, he has focused on all aspects of transit automated fare collection, having had a key role in introducing automated vending of fare media at New York City Transit and in establishing business operations to support acceptance of bank payments for purchase of transit tickets.  Currently, he is also the Project Manager for the pilot that demonstrates using a MasterCard PayPass smart card device for direct payment of fare at select turnstiles on New York City Transit’s Lexington Avenue subway line.

Feature of the Month

Contactless Smart Cards vs. EPC Gen 2 RFID Tags

There is significant confusion in discussions of RF-enabled applications, with contactless smart card technology often incorrectly categorized as "RFID."  There are a wide range of RF technologies used for a variety of applications – each with different operational parameters, frequencies, read ranges and capabilities to support security and privacy features.  For example, the RFID technologies that are used to add value in manufacturing, shipping and object-related tracking operate over long ranges (e.g., 25 feet), were designed for that purpose alone and have minimal built-in support for security and privacy.  Contactless smart cards, on the other hand, use RF technology, but, by design, operate at a short range (less than 4 inches) and can support the equivalent security capabilities of a contact smart card chip. 

To help to clarify the capabilities of different RF technologies built around different standards, the Identity Council developed answers to frequently asked questions about EPC Gen 2 RFID tags and contactless smart cards.

What is an RFID tag?

Radio frequency identification (RFID) tags are used in a wide range of applications such as: identifying animals, tracking goods through the supply chain, tracking assets such as gas bottles and beer kegs, and controlling access into buildings.  RFID tags include a chip that typically stores a static number (an ID) and an antenna that enables the chip to transmit the stored number to a reader.  Some RFID tags contain read/write memory to store dynamic data.  When the tag comes within range of the appropriate RF reader, the tag is powered by the reader’s RF field and transmits its ID to the reader. 

RFID tags are simple, low-cost and commonly disposable, although this is not always the case such as reusable laundry tags.  There is little to no security on the RFID tag or during communication with the reader.  Any reader using the appropriate RF frequency (low frequency:  125/134 KHz; high frequency:  13.56 MHz; and ultra-high frequency:  900MHz) and protocol can get the RFID tag to communicate its contents. (Note that this is not true of car keys which contain a secure RFID tag.)  Passive RFID tags (i.e., those not containing a battery) can be read from distances of several inches (centimeters) to many yards (meters), depending on the frequency and strength of the RF field used with the particular tag.  RFID tags have common characteristics, including:

• Low cost designs and high volume manufacturing to minimize investment required in implementation.
• Minimal security in many applications, with tags able to be read by any compatible reader.  Some applications like car keys do have security features, most notably provisions to authenticate the RFID tag before enabling the ignition to start the car
• Minimal data storage comparable to bar code, usually a fixed format written once when the tag is manufactured, although read/write tags do exist.
• Read range optimized to increase speed and utility.

Smart Card Talk is the monthly electronic newsletter of the world's largest smart card industry organization, providing members with the latest news and information about what's happening within the Smart Card Alliance. If you have news you would like to share, please send it to info@smartcardalliance.org. If you know someone who does not receive this newsletter and would like to be added to the list, please send an email here.

Copyright 2006-2007· Smart Card Alliance · 191 Clarksville Rd. · Princeton Junction, NJ 08550
Phone: (800) 556-6828 info@smartcardalliance.org · www.smartcardalliance.org