Card, mobile credential, payment and security
Eugene McKenna, Waterford Institute of Technology, spoke with re:ID podcast host Chris Corum about the efforts underway to develop standards for campus card programs across Europe. The European Union is currently considering a proposal to provide funding for the project, which is being called the European Education Connectivity Solution. Other topics include the differences and similarities between campus identity programs in the U.S. and Europe as well as the vendor landscape for the European market.
But will its use expand beyond access control and into other card applications?
By Andy Williams, Contributing Editor
It wasn’t too long ago that contactless technology was considered the Cadillac of card technologies, but decreasing prices and increasing security concerns have placed contactless squarely in the sights of many college campuses.
HID Global’s Mark Doi welcomes the change. He represents the security provider as director of end user accounts for the Education Market, and in this role works with campuses across the country. “Contactless has become an essential technology for new and expanding campus card programs,” says Doi.
The number of campuses using the technology is growing rapidly around the world and in the U.S. In Europe and Asia, campuses have been using contactless technology for years. Products like LEGIC, Mifare from NXP and FeliCa from Sony are used to control access to facilities and conduct other campus-specific transactions.
In the U.S., HID Global’s iCLASS product is the dominant contactless technology on campus. According to Doi, “we have more than 100 schools using, or in the process of migrating to, iCLASS.”
Differences between contactless and prox
It is important to clarify the distinction between contactless technology and proximity technology. Though this nomenclature does not hold true for all parts of the world, in the U.S. there is a very significant difference between the two.
Prox cards are an older access control technology that is limited to basic communication of a single identification number to a reader.
Contactless cards, on the other hand, are smart cards with chips that can hold multiple ID numbers, manage applications and process transactions on the card. The technology also enables complex security techniques to encrypt communications, enforce card to reader authentication and more.
When Doi references 100-plus campuses using iCLASS, he is referring to HID Global’s contactless product, not its widely used proximity product. He estimates that at least 300 campuses use the company’s prox cards, which are so common in North America that many simply call them “HID cards.”
How are campuses using contactless?
Access, access, access … this has been the mantra for contactless technology on U.S. campuses to date. The vast majority of institutions using the technology have installed contactless door readers and tied those readers into their security system. Cards containing both the contactless and magnetic stripe technology are issued to the population or a subset of the population.
The contactless component drives the access control transactions and the magnetic stripe is used for the non-access functions. Every campus card vendor almost certainly has client institutions that are operating in this manner, and every campus is capable of doing so.
But the question remains, when will the multi-application capability of the contactless technology take hold? When will the traditional campus card functions–meal plans, library patron ID, payment for vending and laundry environments, etc.–migrate to the contactless world? In a select few instances, this has already occurred, but the migration is gradual.
Campus card vendor offerings differ
SmartCentric rolled out its contactless products last year. The Irish company launched SmartCity 6 in 2007 in response to customers requesting the technology, says SmartCentric CEO Kieran Timmins. The product includes support for contactless payment transactions and privilege control beyond the more common physical security uses.
“Our SmartCity System is a full campus card system providing many applications on a single contactless card,” adds Timmins. Five campuses in the U.S. serviced by SmartCentric are using contactless and “we are working with another two.”
Heartland Payment Systems, new owners of campus card provider General Meters, offers contactless acceptance for on and off campus payments. “Our college and university clients are requesting that we enable (contactless) technology in not only new installations, but retrofit existing installs as well,” says Bill Norwood, micropayments solutions architect for Heartland.
The CBORD Group, which supports HID Global’s iCLASS cards in its access control offering, has seen an uptick in contactless interest even though it has “historically been greater in the international market,” says Randy Eckels, senior vice president, sales and marketing. “Interest in contactless technology has steadily increased amongst our client base with new inquiries coming in frequently. A meaningful percentage of CBORD customers have already implemented the technology.”
He says the company is “constantly gathering feedback from our clients on new technologies they would like us to offer. Many of the contactless solutions we offer currently were the result of university requests,” Eckels adds.
Swiss company LEGIC Identsystems, a provider of contactless technology to campus card suppliers and others, sees the demand for its products from colleges and universities “constantly increasing,” says Otto Eggimann, vice president sales and business development.
Blackboard VP of Marketing Jeff Staples says that a number of the company’s clients have implemented contactless for security applications and many more are considering it. “Blackboard is committed to delivering solutions to fit the needs of our clients,” he says, “and we see a bright future for contactless technologies.”
The market got a view of Blackboard’s plan via an announcement last November. As outlined in a company press release Blackboard is building support for Sony’s FeliCa contactless technology and Near Field Communications (NFC) into the overall Blackboard card and transaction system. The announcement alludes to the deployment of contactless technologies beyond access control.
Migration to contactless: Pros and cons
Contactless enables “a simple and easy-to-handle application of the technology for the user,” says LEGIC client Andreas Pircher, with Bozen University in Bolzano, Italy. “The user doesn’t even have to take the smart card out of his wallet.”
Utilizing contactless technology is “driven by the advantages of convenience as well as performance,” says Steve Noret, associate registrar at the University of California-Merced, a CBORD client. “With less direct contact to a card, there is an inherent longevity that may be enjoyed for the card itself.”
Since the Merced school is relatively new–the first research university built in the 21st century–it didn’t have a legacy campus card structure in place, which meant there were no infrastructure upgrade costs, says Noret. “We made a conscious decision to use our current system after much research, and even visiting campuses across the U.S. to see their particular systems,” he says.
Contactless technology also provides an additional level of protection against fraudulent or counterfeit card creation. Though experts are quick to point out that no technology is completely impervious to fraud, contactless technology provides a major improvement over magnetic stripe or barcodes when it comes to counterfeit resistance.
The major drawback traditionally cited against contactless is the added cost when compared to magnetic stripe-only cards. But LEGIC’s Eggimann points out, “a new installation is, of course, a big investment, but customer’s ROI calculations prove that the investment is protected.”
Depending on the size of the implementation, universities may decide to re-card their campuses or convert a significant amount of existing equipment to new devices, says CBORD’s Eckels. “Activities of this scale require an investment of time and careful planning.”
SmartCentric’s Timmins agrees, noting that before making the contactless plunge, campuses should have the right business plan. He suggests a “phased approach which helps them from becoming overwhelmed by the tasks and enable them to support existing applications while upgrading one or two applications at a time.”
Will the mag stripe be a thing of the past?
Most agree that even when more of the campus card applications can be handled via the contactless card, there will still be a role for the magnetic stripe. Legacy systems, home grown applications, and instances where security is not crucial may continue to rely on magnetic stripe and barcode technology in perpetuity.
Merced’s Noret agrees. Even though the California school was not saddled with legacy equipment, he believes a dual technology card is perfect for most schools, as it has proven to be for his institution. “The mag stripes are used with some of the point of sale systems such as cash registers and the laboratory printers, laundry and library copiers. The contactless is used for access, library checkout system, and gym membership,” says Noret.
President Bush signed legislation establishing a federal grant program that provides a new source of financing for colleges and universities to acquire and install electronic physical solutions.
The campus security measure attempts to help colleges develop and implement state-of-the-art emergency systems and campus safety plans. It also requires the Department of Education to develop an emergency disaster plan; create a National Center for Campus Safety at the Department of Justice and establish a disaster relief loan program to help schools recover and rebuild in the event of a disaster.
It also aims to restore integrity and accountability to the student loan programs by requiring institutions and lenders to adopt strict codes of conduct, providing students with full information about their borrowing options when taking out and repaying student loans and protecting students from aggressive marketing practices by lenders.
Read more here.
University of Georgia faculty members need to keep a close track on their season football tickets this year. That’s the warning from one faculty member after he scanned the barcode on the back of the ticket only to discover his nine-digit Social Security number was part of the ID number embedded in the ticket.
University students are assigned their own 16-digit number that doesn’t include the SSN, but that system hasn’t extended to the faculty yet. The faculty member who blew the whistle says a $20 bar code scanner is all that’s needed to read the ticket.
Students and staff at Oakland University, Rochester, Mich., will now receive a text message and a voice mail under a new alert system that has gone into effect. The alerts are part of the school’s comprehensive emergency communications plan to notify students, faculty and staff as quickly as possible if an emergency situation occurs on campus.
“The text message system is designed to quickly alert community members who are not sitting in front of a computer or desk phone,” said Oakland University Police Chief Samuela Lucido.
To take advantage of the service, students and employees must provide contact information, including their ID information and e-mail address, via the school’s Emergency Preparedness Web site. Voice alerts are available for those without text messaging capability.
Read more here.
But is it a cost efficient, greener alternative or a fad with serious security risks?
by Andy Williams, Contributing Editor
For some members of the card printing market, it’s hard to justify costs involved in printing rewritable cards, while for others, like HID Global, it’s an untapped, perhaps under-served market.
Rewritable cards are plastic ID badges that when issued with specialized printers enable the same cards to be erased and rewritten hundreds of times. The rewritable printers use heat to change the information printed on the card. In Fargo’s rewritable printing process, the ribbon is actually removed from the printer and the printhead comes in contact with the card. The heat from the printhead reacts with the card’s special finish to produce the printed image. The type of finish used by the card manufacturer determines the image’s color, generally blue or black, explains Apryl Erickson, senior channel marketing manager for Fargo products at HID Global.
Persona C30e Quick Facts
MSRP: $2,295
Print Method: Dye-Sublimation / Resin Thermal Transfer
Print Speed: 35 seconds per card (YMCKOK)
Add-ons:
Fargo DTC400e Quick Facts
MSRP: $2,895
Print Method: Dye-Sublimation / Resin Thermal Transfer
Print Speed: 35 seconds per card (YMCKOK)
Add-ons:
Datacard SP25 Quick Facts
MSRP: $1,645
Print Method: Direct-to-card / Rewritable
Print Speed: 12.4 seconds per card (full card erase and rewrite)
Add-ons:
Evolis Tattoo Rewrite Quick Facts
MSRP: $1,740
Print Method:
Erase/print cycle: 8 seconds
Add-ons:
CLEARjet CX-one Quick Facts
MSRP: $3,495
Print Method: Monochrome, greyscale full graphic thermal print head system
Encoding modules:
Add-ons:
“Rewritable printing is an excellent option for several specific applications,” says Erickson. She admits that, as a technology, rewritable printing doesn’t provide “the high level of security, nor a full-color glossy image like with our HDP-branded printers, but the ability to print and erase cards 200 times can stretch ID budgets in ways that satisfy end users with other priorities.”
Fargo’s rewritable printers are geared toward the entry-level or mid-level markets, she adds. That means lower costs – less than $3,000 for Fargo’s two rewritable models – the entry level Persona C30e at $2,295 and the mid-level DTC400e for $2,895.
Geraldo Talavera, Evolis’ managing director, describes how his company’s line of rewritable printers works. “The card itself includes a thermo-sensitive material which becomes visible when heated at a temperature of 180°C, followed by rapid cooling. When a lower temperature is applied, typically between 110°C and 160°C, the color disappears. The thermo-sensitive material is laminated on a plastic substrate to make cards.”
HID suggests using rewritable printers with other technologies. “We manufacture an iClass contactless card with a rewritable surface, say for visitor or temporary badges for contractors or employees who need access to facilities for temporary periods,” says Erickson. “Issuing iCLASS cards can become quite expensive to such parties but it makes sense when you can leverage that expense over a number of uses with the rewritable card.”
The opposite side of most rewriteable cards feature a standard PVC finish that can be personalized like any other card. The cards cost more than $2 but with 200 uses, that’s about a penny per each visitor.
Rewritable cards find a niche in education, visitor and loyalty applications
One use for this type of card is in K-12 education. “We have a large pilot project outside the U.S. where the government has mandated that all students carry a photo ID, with one side containing the rewritable information, such as a class schedule, bus schedule, emergency contact information, etc. The reverse side has the full color identification information, including the student’s photo,” says Erickson. With this school application, the school batch-prints the front of the card in full color with ribbon and prints the variable data and class schedule on the reverse, rewritable part of the card, during school registration.
The loyalty card market is another niche. “Businesses encourage customers to carry their cards and keep track of their purchases. Accumulated value imaged onto the card is more secure than with paper punch cards. And, updating and erasing points is easy since it’s simple to remove the cartridge-based ribbons from the Fargo printers,” says Erickson.
Fargo is seeing a lot of demand for these printers, “especially from price sensitive markets,” she adds. “Obviously if you’re able to buy a card and use it 200 times, you’re saving quite a bit of money.”
Talavera says the major uses for rewritables are in loyalty applications. “Bonus points or special offers are printed directly at the point of sale after each transaction,” he says. “They are also a good choice for visitor badges. The same card can be used to erase the info of a visitor and print it for a new one. In sophisticated applications, the card will include contactless chips allowing identification of the holder and giving access to specific areas of the building. The printer is then part of the visitor management system, including software, visitor database and card readers.”
Many printer manufacturers offer rewritable models
Evolis Card Printer has its Tattoo Rewrite card printer that can print and erase the same card up to 500 times, says Talavera. “Because no ribbon is necessary, Tattoo Rewrite is a cost-effective and environment-friendly solution.” The Tattoo basic version with no encoding option runs $1,740.
Grambach, Austria printer manufacturer, CLEARjet, has been focusing on reprint technology for smart cards, says Kerstin Grabner, marketing and sales. “Projects worldwide show the success of rewritable smart cards, such as student ID cards, electronic tickets in public transport and for events, ski passes, visitor and employee id cards, club and loyalty cards and many more.”
The company’s line of CX-one rewrite printers include some which can produce photos and all which can be delivered with integrated read/write devices for contact and/or contactless chip cards as well as mag stripe modules, she says. Pricing starts at around $3,495 for a standard printer without any options.
The CLEARjet printer relies on thermal technology to heat the card and change the information. “When equipped with a read/write module for chip, RF chip or magnetic cards, the information also can be changed electronically in your card,” she adds.
Grabner says there has been a demand for such printers. “The focus is to find an application for reusing the card and update information on the card as well as electronically in the card. You don’t have to throw the card away after use. This level of reusability and update possibility ensures that the costs of electronic systems are drastically reduced.”
Datacard Group’s entry-level rewritable printer is the Datacard SP25 which “offers both full-color/monochrome card printing and rewritable card technology,” says Mark Andersen, head of desktop product and industry marketing. Suggested retail, he adds, is $1,645, “which, to our understanding, is the lowest cost card printer offering both rewritable and full-color card printing capability in one printer.”
As for demand, this is still a somewhat new market, he says. “The markets/applications we are targeting are retail, visitor management, transportation, education and entertainment. The possibilities for creative uses of this technology in various applications are unlimited.”
A dissenting view questions the viability of rewriting cards
Digital Identification Solutions doesn’t feel the same way. The company doesn’t offer a rewritable card printer, says Shane Cunningham, the company’s marketing manager for the U.S. and Canada. “The most important reason is the major reduction in the security of the card,” he explains. “If you have a card that can be rewritten, all I need is a printer to rewrite it, and I can fake your cards whenever I want. It’s about as secure as putting stickers on a card to validate it. It was designed as a convenience to the end user, but with the extremely low cost of standard PVC cards and inexpensive direct card printing, it doesn’t make much sense to us.”
“Reissuing a rewritable temporary ID may sound like a good idea, but the real question is whether an ID is really needed at all for visitors,” adds Cunningham. “If it needs to be personalized, is it because your facility honestly needs to be secure? If so, a rewritable card is an unnecessary risk. If your facility doesn’t need to be secure, then what is the need to re-personalize the visitor card? Why not just issue generic visitor IDs that can still be tracked in the system and reused for the next visitor?”
With loyalty cards, “I have yet to see an instance where re-printing a card can handle what re-encoding it already can do better. The purpose of a loyalty card is to advertise the issuing company and linking the user to the benefits offered. I imagine that a discount card could be used up by one end user, and then returned and re-issued to another, but not without a significant amount of loss or damage of the card beyond re-use. The savings for the number returned and re-issued would have to be significant to validate the switch in technology. If the turnover is that quick, then paper or Teslin cards might be more cost-effective.”
He states that his customers are “looking for secure credential solutions with layered methods for making the card tamper resistant, not just a means for cheap card personalization. We know of a few venues that thought the idea of rewritable cards sounded interesting, but we haven’t seen any demand for it at all. We see this as a buzzword technology that may create enough public interest to make some initial sales, but does not have lasting market value.”
While some don’t see the need for rewritable cards there are, schools and retailers that have seen the benefit. It seems to be a complicated equation in which cost, turnover, security and a host of other variables must be considered. And it’s clearly an equation that changes with each specific issuers environment. Whether or not the market for the cards will increase or decrease, only time will tell.
Students from 48 Chicago, Ill. high schools will be receiving a combined school ID and Chicago transit reduced-fare card this year. The agreement is aimed at increasing transit use among students and cutting CTA’s administrative costs in the existing reduced-fare program and is expected to be expanded to all Chicago public high schools within 18 months.
The student’s smart card is similar to the CTA’s contactless ChicagoCard, which means faster boarding times. Users can add value to the card at CTA vending machines. The CTA expects to save $500,000 annually in administrative costs.
Off-Campus Advantage, a subsidiary of The CBORD Group, Ithaca, N.Y. and a provider of off-campus payment services for universities and colleges, has signed up three more schools in Mississippi, New York and Alabama to handle their off-campus payment programs.
The CBORD Group’s off-campus payment services are a program that offers back-end management of transactions or even merchant management, marketing platforms and incentive-based usage plans.
The company’s three new schools are: Jackson State University, Jackson, Miss.; the University of North Alabama, Florence, Ala.; and St. Lawrence University, Canton, NY.
Jackson State’s off-campus program is called the JSU SuperCard. Participating merchants were interested in more efficient transaction times and daily ACH reconciliation, while the students wanted to use their accounts at even more locations.
“With more than 80 merchants accepting the JSU SuperCard, taking care of the day-to-day merchant issues, as well as the monthly reconciliation and check cutting, were very time-consuming processes,” said Alcinia Pugh, director, office of contractual services at Jackson State. “By outsourcing the settlement process and merchant management with OCA, the JSU SuperCard staff is now able to focus on promoting the program on campus and on servicing our core constituency—students.”
The University of North Alabama (UNA) wanted to expand its decade-long self-administered off-campus program, the Mane Card. The university’s partnership with OCA will enable the company to rebuild the once-robust sales volume and participating merchant numbers.
St. Lawrence’s partnership with OCA will help the university grow its off-campus program by adding more merchants. OCA’s 24-hour service hotline, online reporting tool, and terminal upgrades were also motivators in outsourcing the program.
All three universities also utilize CBORD campus card solutions and can now take advantage of the integrations that exist between their card systems and OCA.
Dates: November 2 - 5, 2008
Venue: Hyatt Regency Chicago
Location: Chicago, Illinois
URL: 2008 NACAS Annual Conference
Contact: [email protected]
Description: Take advantage of funds you may have remaining in this year’s budget - registration is now open for the NACAS 40th Annual Conference in Chicago. Register on-line now! Additional conference details will be available in February 2008.
Extensive planning by the Conference Program and Host Committees has resulted in a powerful line-up of speakers, educational sessions, exhibitors and networking opportunities that will make this conference notable from the day you register through the final general session. Put this lineup of conference events in amid the bright lights, dazzle, sparkle and pizzazz, and you have a conference you can’t afford to miss!
