 |
 |
 |
 |
July 2007 • Volume 12 Number 7
|
 |
|
Executive Director's Letter
Another month has passed and we still do not have much closure around the Department of Homeland Security (DHS) Western Hemisphere Travel Initiative (WHTI) PASS card project. As one Alliance member appropriately observed: the government seems to have a different set of security principles for its own Federal employees (secure HSPD-12 compliant ID cards) than it has for its citizens. Despite the volumes of published materials and the thousands of negative responses to the Notice of Proposed Rulemaking (NPRM) that all cited the dangers of using insecure, long range RFID technology for the proposed PASS card, DHS has remained resolute in its position that the PASS card program will move forward without addressing the security and privacy concerns raised by the Alliance, the Secure ID Coalition, the Center for Democracy and Technology (CDT), the ACLU and other concerned public policy organizations. The Alliance recently took our message directly to the government’s Congressional branch by hosting a briefing at The Capitol on July 18. We were joined by the Secure ID Coalition, a digital security organization, Janice Kephart, former counsel to the 9-11 Commission and Leslie Harris, Executive Director at CDT. Each speaker on the panel presented perspectives on security and identity best practices to educate Senate and House of Representative staff members about the requirements for security and privacy in any government identity program and the differences between RFID technology and secure contactless smart card technology. Tres Wiley, from Texas Instruments, even brought an RFID tag and reader to the briefing. He demonstrated to the audience how easy it was to read an unprotected, long-range, RFID-based card from about 20 feet and write its embedded RFID tag number to a duplicate tag in a matter of minutes. Video of the RFID cloning demonstration and panel presentations are available on the Alliance web site. Perhaps if enough questions are raised from within government by those responsible for funding this legislative mandate, we can still save the government from making this terrible mistake. Not all government institutions have turned a deaf ear to industry groups. This month the Federal Reserve Board agreed to waive the requirement for transaction receipts for debit card purchases under $15 in value. This is welcome news for the vending industry, which has long lobbied the Fed to allow unattended purchases with a payment card without burdening the operator with the added cost and maintenance required for printing a receipt. In light of the rapid increase in debit card use for small value purchases, it was time to revisit this issue, and the Feb acted appropriately to waive the receipt requirement. Industry leaders were hoping the rule would set the limit at $25, since that would be consistent with the payment brands' no signature requirement for using contactless payment cards at attended POS locations; however, the $15 limit was seen as a welcome compromise. Not changing the rule might have led to a dampening of vending sales and other small value transactions since people are using plastic more and cash less, so that those machines that only accept cash may find customers unprepared to make a purchase other than with plastic. With more than 10,000 vending machines currently accepting contactless payment in the U.S., this removes a significant roadblock for reaching projections of more than 100,000 machines in the future. Adding many more points of sale in an already growing merchant base accepting contactless payment will surely convince issuers to begin issuing more cards – a welcome action for merchants eager to see their transaction volumes increase and their lines get shorter. You may have begun to notice an increase in announcements and ad placements for the 2007 Annual Conference coming up on October 9–11 in Boston. We have nearly completed the agenda and will be posting the speaker names on the Event Registration site shortly. The early registration discount for non-members looking to save money ends on August 13, so register today and don’t wait until the price goes up. As you should be aware by now, this is the final Smart Card Alliance Annual Conference as a separate Alliance event. Beginning in 2008, the Annual Conference will be combined with the CardTech SecurTech conference, which is being held next year in Orlando from May 13–15. Although we are very excited about partnering with CTST, we also want to make our final independent Annual Conference a huge success and carry that success forward with our new partnership with SourceMedia. Sponsorships for the 2007 Annual Conference are still available so make sure you reserve your preferred sponsorship opportunity before they are sold out. My final comment has to do with embracing change. Change is inevitable, even when times are good. Our hard-working Board of Directors and Alliance staff spent two grueling days this week evaluating the current Smart Card Alliance organization, when we are at our peak membership and satisfaction rating, to plan for what we might look like 5 years from now. While critical to the future success of the organization, it was still an difficult process that we put our board leadership through to identify where weaknesses and vulnerabilities exist so that we can be prepared for the future – with all of its uncertainties and unknowns. The process will help us to be prepared for the inevitable changes we face as an industry and as an organization. I want to personally thank them for their dedication and their effort to ensure that Smart Card Alliance good times will continue and we will be ready for change when it happens. Thank you.
Randy Vanderhoof
|
|
