Card, mobile credential, payment and security
Not all institutions are in the market for the latest technology when it comes to their campus cards. Many choose not to upgrade to an unknown entity citing that the magnetic stripe card has met their needs for 15 years, 20 years or longer.
Some campuses avoid upgrades for stability reasons, while others say it costs too much. They simply don’t want to dedicate the money needed to re-card their institution and install new readers and infrastructure.
Valdosta State University in Georgia has had the same card program since it started in the early nineties, says Craig Williams, key control and security systems supervisor at the school. “Nothing has changed since I came on board in 1998,” says Williams, who is in charge of door access and electronic security.
The card is used for everything, explains Williams. “Obviously it’s an ID but it’s also used in the library, door access, bookstores, ball game admission. You can purchase anything on campus from meals to books,” he says.
Re-carding for the school’s 13,500 students and 1,800 staff would be expensive. That’s why he asks: “Why do we need to upgrade? A lot people don’t take that into consideration. Re-carding a campus is a major undertaking, we’ve done that once in 14-years and it was one of our largest endeavors,” says Williams.
Replacing all the different gear that works with the mag stripe would be daunting and costly. “When you talk about getting away from the mag stripe, it’s getting away from each and every piece of equipment,” says Williams. “We have thousands of pieces of equipment that read the mag stripe.”
In addition to the cost, the transition period – when everything is in the process of moving from one tech to another – would be challenging, Williams says. He notes that if the card had a chip and mag stripe, it could ease this transition.
Williams admits Valdosta State is married to the mag, but he acknowledges that in the future the school might be forced to divorce from the technology and upgrade to a chip card or biometrics.
It could be said the school is already taking baby steps towards an upgrade. Some readers on campus – such as the recently installed vending and laundry units – are already capable of accepting both the magnetic stripe and smart cards.
Were the school to upgrade, partnering with a bank to help defray some of the costs could help, says Williams. “Most people I’ve talked to who went to smart card had a banking relationship or financial entity to absorb most of the cost for card replacement."
All that said it’s likely the school will still upgrade, but maybe not to a contactless card. “We’re more likely to do it now than a year ago,” says Williams.
But it may not be to a smart card. “We’ve had more requests for smart phone technology rather than smart cards,” he says. “But it’s not something we could implement without spending some bucks.”
Oklahoma City University actually reversed the typical upgrade process, switching its campus card system from contact chip cards to magnetic stripe about a year ago.
The chip card, says Rick Hall, vice president of student affairs for the university, was built over a period of 10-years. “We kept adding onto it until it became too cumbersome,” he says, adding that both software and hardware had become obsolete.
“We were having some security concerns, and were afraid that if we had a crash we couldn’t restore the services,” says Hall. "We wanted a more reliable card system. We also wanted it to be on a server maintained off site.”
The university chose CardSmith, a cloud-based campus card provider, to operate the school’s new card system, says Hall.
The new card was launched in the fall of 2011 for its 3,700 students, of which 3,000 live on campus. Cost was the main reason the university went to a mag stripe card versus another chip card, says Hall.
Additionally, the university’s existing chip card readers could also read mag stripe so full-scale replacement was not a requirement.
The new card is also speedier. “With the old system, when you inserted the card it would take two or three seconds to do its work. That created an issue at meal times. Kids come in herds.”
Even the two or three seconds it took for the old card caused long lines. “That doesn’t happen anymore. The reader takes the card as fast as you can swipe it,” says Hall.
The card is used for printing, access control and the bookstore. It provides access to buildings and residence halls, but not individual rooms, says Hall. The card has a declining balance purse called StarsCash that can be used for off campus purchases as well. Hall says he sees no reason to upgrade the card further.
Another school that appears to be married to its mag stripe card is Mount Holyoke College in South Hadley, Mass.
The school started its mag stripe card program in 1998 when it was being serviced by General Meters. When Heartland Payment Systems purchased General Meters, the college stayed with Heartland. “Most of our locations are cashless, such as vending and laundry,” says Doug Vanderpoel, the school’s director of Auxiliary Services.
The card is also used for door access all the way to the individual dorm rooms. Mount Holyoke has 20 dorms on campus and more than 1,000 readers. “Virtually everywhere on campus you can use the card system,” says Vanderpoel.
Thanks to Heartland, the college was able to increase its off campus presence through Heartland’s Give Something Back Network, where a percentage of purchases goes back to the school. “We went from eight to 30 off-campus merchants,” says Vanderpoel.
Concerning upgrading, part of Vanderpoel’s most recent five-year plan was to evaluate different ID technologies. “I’m just not sure what to go with,” he says. “All our readers are capable of multiple technologies, so we wouldn’t have to replace the entire reader, just part of it. But we aren’t anxious to switch.”
Like other schools, expense is a reason for not upgrading. In Mount Holyoke’s case, it involves 2,000 cards that the school keeps on hand for its various conferences, reunions and other events. Replacing them at $6 each would be a large expenditure, explains Vanderpoel.
The school wouldn’t have to replace their readers since most can already handle contactless, says Vanderpoel, citing this flexibility to handle both contactless and mag stripe as a key reason they selected the reader.
Some of the technologies he’s considering include MIFARE and iCLASS. “And now you have NFC thrown into the mix. Should I go with iCLASS, for example, if NFC is around the corner?” asks Vanderpoel.
One school had a different reason for upgrading. It had to if it wanted its students to continue to ride the bus.
The University of Pittsburgh was satisfied with the performance of its Panther mag stripe card, but decided to change technologies when the city’s Port Authority upgraded its fare card, says Jessica Larson, card program manager.
The Port Authority had a contract with the university providing pre-paid bus rides. When the Port Authority implemented a new MIFARE contactless system the school switched from a flash card system – where cardholders show the card to the driver for visual identification – to a more accurate electronic verification system, says Larson.
The university’s mag stripe card wouldn’t work with the new system. In preparation, the university issued 40,000 new cards in 2009, says Larson. “However we just started this year using the smart card on buses.”
The university continues to use its mag stripe card for everything else – meal plan, access control and payments on and off campus. But that’s likely to change as its card provider, Blackboard, upgrades its reader line to include MIFARE support. “We’re in the process of upgrading readers to accept the MIFARE cards,” says Larson.
But the university doesn’t intend to upgrade all readers at once. “We have more than 430 pieces of equipment and as it needs replacing we’ll replace it,” adds Larson.
She says the new card is working out well for bus trips. “By this time next year we should have some readers in place, but since our mag stripe card works very well there’s not a huge rush to spend money to upgrade readers,” says Larson.
To upgrade or not isn’t an easy decision for colleges and universities. It obviously involves more than just dollars. In Pittsburgh’s case, outside forces caused the school to change to a new system. Others are simply holding out to see what’s next.
Regardless, card system administrators know that whatever they choose, that choice will stay with them for many years to come.
Members of the Associated Students of Santa Monica College in California can get free bus rides, discounts on selected movie and theme park tickets and free admission to college athletic events for an advertised fee of $19.50. What isn’t mentioned though is an additional $13 “student ID card fee” that the students also have to pay.
The $19.50 fee is used by Associated Students to fund campus clubs through the Inter Club Council and other programs aimed at promoting student life activities. The extra $13 fee is needed to activate the mag-stripe on the card in order to gain access to campus resources.
According to Jesse Ramirez, Associated Students publicity director, information from the Auxiliary Services department provided a breakdown of the $13 fee: “$3 goes to the ID card, $5 goes into technology, and $5 goes into transportation,” he said.
While both fees are optional, students can’t pay for one without having to pay for the other. “A student cannot opt out of ID card fees if they want to keep Associated Students benefits,” said a college administrator.
Ramirez is concerned that signs that advertise the $19.50 membership fee are misleading students because they omit the additional $13 fee.
Read more here.
Campus among first to use U.S. Bank’s new nationwide service
When you’re pitching your banking partnership program to a college and you don’t have a brick and mortar facility any closer than one state away from the university, it helps to have other ammo in your arsenal. So it is with U.S. Bank, which can now service colleges without a physical presence near the school over even in the state.
Last year, North Carolina State University in Raleigh went looking for a new banking partner to service its 34,000 students. The school had a banking relationship with another institution, but the university wanted “a stronger program, one with more universal acceptance,” says Randy Lait, senior director of Hospitality Services Campus Enterprises for NC State. “We wanted to take our card to the next level. It was time to test the waters.”
A key ingredient missing from the school’s previous campus card was that it served only as an ATM card. It didn’t feature a MasterCard or Visa logo and could only be used at ATMs and select merchants that accepted PIN-based transactions, says Lait. In the request for proposal, Lait says the school also wanted to find out what a state of the art program might look like. “We had about six responses initially,” he adds.
One of those responses was from U.S. Bank and Lait liked what he saw.
Whitney Bright, vice president and general manager for Campus Banking at U.S. Bank, says NC State wanted a card that could be accepted around the world.
Essentially, the new program piggybacks onto the school’s existing Wolfpack One Card giving students, faculty and staff what the school wanted–a MasterCard-branded card that serves as a debit card. Students can have leftover financial aid placed on the card and they can add money to it via the Web. Parents can fund the card and employees can have a portion of their paycheck direct deposited to it. Funds can also be loaded through MasterCard’s rePower Network that enables MasterCard-branded prepaid cardholders to reload at participating retail locations, explains Bright.
“The account tied to that card is a prepaid one as opposed to a checking account. Because it’s prepaid the account can be opened and serviced completely online,” she adds. “That gives us the ability to launch programs outside our banking footprint.”
What’s important to both the university and bank is that students can only spend the funds that are in the account. They are not allowed to overdraw and cannot incur overdraft fees, says Bright. NC State is the third school to partner with U.S. Bank under this new prepaid program. The product is also in use at Harris Stowe Sate University in St. Louis and Oakland Community College in Michigan.
U.S. Bank will place two ATMs on campus, and because U.S. Bank owns the MoneyPass ATM Network, students have access to more than 23,000 ATMs in that network without incurring a fee, says Bright. She says there are about 650 MoneyPass ATMs in North Carolina, and there is a mobile app to help a student find the nearest location.
“We launched the new program at the end of June,” Bright adds. “The incoming freshmen class is starting on the program with the fall term.” Of course, students aren’t required to use the new prepaid offering.
Additionally, no mass re-carding was planned. Existing cards will continue to work and re-carding is necessary only if a student wishes to take advantage of the new program. Cardholders that had linked their ID to the school’s previous banking partner can even continue using that service. “We’re not doing anything to break that link,” says Lait.
The university’s concern about card stock costs helped elevate U.S. Bank’s proposal, Lait says. The school uses HID Global’s iCLASS technology for physical access control and wanted to make sure that same card could be used regardless of whether or not the student elected to use the prepaid card functionality. With some programs a new card must be issued if the student later opts into the program, and these additional pieces of contactless card stock can become costly.
With the U.S. Bank program, everyone gets the same card stock with both the contactless technology and the MasterCard logo. It’s up to the individual cardholder to activate it, says Lait. The card stock is produced at a secure facility and arrives on campus already set for MasterCard … complete with a printed logo, explains Lait.
Lait admits that he initially had concerns about partnering with a bank that had no locations in North Carolina. But, he says these worries evaporated, when he saw a demonstration of U.S. Bank’s new video teller machine.
The video teller enables a person to interface with U.S. Bank to do anything that a customer can do with a flesh and blood teller, says Lait. “You see the teller on the TV screen. If you want to cash a check for $10, you can do that. You can put your ID on the screen and feed checks to the system,” he says.
Eventually the bank will be putting the video tellers into the university’s new student center, which is under construction and scheduled for completion in 2013.
Of the banks serving the campus card market, U.S. Bank leads the pack in terms of number of relationships, serving 51 schools in 25 states, according to CR80News’s 2011 banking survey. The bank’s new prepaid offering can now enable expansion into states outside its physical branch-banking footprint, giving it nationwide opportunities.
ITC Systems, Toronto, has developed a cashless system for staff and students at Bishop Guertin High School in Nashua, N.H. The company modified the school’s existing systems to enable parents to add value to student accounts online. At the same time, staff in the food services financial management area have access to more sophisticated tracking information.
Bishop Guertin, a private Catholic high school serving 855 students in grades 9-12, had offered cashless food service and vending for many years before switching to ITC’s one card program in 2009. Students’ cards have a contact chip rather than a magnetic stripe and the school has now invested in ITC’s Multi-Plan and Web Purchase programs.
“One of the big advantages of our original work with Bishop Guertin was that the school was able to eliminate automatic debit machines,” said ITC CEO Campbell. Richardson. “They were expensive and often unreliable.”
The school currently operates four registers and five vending machines. ITC’s MultiPlan program can also be used to track sales by grade. This data can then be used to plan special offers to students that can increase participation.
Bryn Mawr College in Pennsylvania is issuing new ID cards, called the OneCard, to the entire campus. The undergraduate student body was re-carded at the start of the fall semester, faculty and staff members are scheduled to get new cards following the fall break.
Cards will be distributed to staff in two phases, with distribution date based on office location.
The card can be used at both Haverford College and Bryn Mawr. Haverford, Bryn Mawr and Swarthmore College are members of the Tri-College Consortium, which enables students to register for courses at the three schools.
The new card is part of the Seamless Administrative Services initiative calling for better integration of administrative services between the colleges.
Read more here.
The University of Texas discovered an apparent flaw in its emergency text alert system.
An alert was sent out recently regarding a man carrying a rifle and wearing a gas mask. A few weeks prior, the university was evacuated after a caller claimed to have placed bombs throughout the campus. Both incidents turned out to be hoaxes but the university police department said some students didn’t receive either text message.
The problem was caused by some parents also signing up for the alerts. The system essentially knocked the students’ cell phone numbers out of the system.
The university pointed out that the text alert is only for students and staff and that there are other ways for parents to receive this kind of information.
Read more here.
New report enables programs to compare against similar institutions
It all started when one university wanted to compare the performance of its campus card office to others. An apples and oranges problem emerged. Just because another school is nearby or of similar size doesn’t mean it will have the same type of campus card program.
Thus was born the benchmarking survey sponsored by the National Association of Campus Card Users (NACCU). The main purpose is to help a card office see how it’s performing against card offices in other parts of the state or country and to explain what tasks each of the offices perform at the schools, explains Frank Adams, assistant professor in the Department of Marketing at Mississippi State University.
To help card offices better utilize the results of the ongoing survey, NACCU held a webinar, “How to Analyze and Leverage the NACCU Benchmarking Survey for Your Office’s Advantage,” led by Adams.
He says the idea for the benchmarking survey first surfaced in 2008 while he was working at the University of Alabama. The card office director wanted a better way to convey the value of the campus card program to administrators, explains Adams. “As I learned about how a card office worked, I knew it wouldn’t be possible to benchmark against other schools without more data,” he says.
Adams started talking to a variety of card offices to see what they do, what they offer and what’s important to measure. The first results were released in 2010 and the second survey covering 2011 results is underway. NACCU plans to conduct a benchmarking survey every two years, says Jorrun Liston, the organization’s education director.
The survey found that a campus card office can support as few as 174 card users or more than 100,000. “The average card office serves nearly 23,000 card holders and processes nearly 4 million transactions per year,” according the document, “yet serves these needs with only three full-time staff members.”
A key purpose of the research is to let people outside of the card program know what tasks these offices perform. “Like a public utility, it fills a very specific niche in the institution’s ecosystem. You’re not aware it’s there until it quits working,” says Adams. “In reality, it’s the nerve center of the institution.”
Adams says he wanted to compare where different schools were with their programs. “If you’re going to benchmark any industry or activity you have to look at the players in that environment, whom they’re similar to and whom they’re different from,” he adds .
Maybe the program isn’t similar to an institution down the road but rather one on the other side of the country. There were specific items Adams looked for to determine similarities and differences including:
He says NACCU will be comparing these surveys over time to gather better performance measures. The survey looks at what affects performance and what happens in the card office to influence that performance.
How are NACCU and its members expected to utilize these results?
First, card offices need to be given a better sense of where they deliver value, says Adams. Just saying you deliver value is often not enough.
Next, if one school finds another that’s similar, directors can compare debit transaction volumes and other indicators to gauge performance.
The survey can also enable campuses to chart progress. For instance, they may be best in class for like institutions or they may need more resources to grow the program. The report will potentially list such resources and help program directors make a case for obtaining them.
When it comes to allocating resources and asking higher-ups for more, it helps to have data to make the case. “Resource commitment is a big deal and communicating with your supervisor is critical,” Adams adds. This, says Adams, is where benchmarking shines.
Results are available to NACCU members at the organization’s website. Four separate documents–Executive Summary, Cluster Analysis Results, Summary of the Card Office Characteristics and Services Provided by Cluster–are available via password-protected download.
ScholarChip, a provider of smart ID solutions for schools, has updated its classroom attendance solution to meet new state mandates requiring schools to actually track the time a student is present in class.
Its automated student time and attendance reporting, also known as ASTAR, is ScholarChip’s latest version of its classroom attendance service .and provides accurate to-the-minute reporting of a student’s attendance.
The time a student spends in class is now part of a teacher’s performance review. Without automation these mandates are difficult and expensive to implement. ScholarChip automates the collection of this classroom data and supports integration with student information systems.
Students tap their contactless ID cards on a reader as they enter a classroom which registers the student’s attendance. With the new mandates, students also need to tap when leaving class (for example to attend a meeting with a guidance counselor) and tap again when re-entering the classroom. The time a student is absent from class is recorded.
ASTAR is supported on three platforms: a browser based service; a mobile Android App available for use with NFC-enabled tablets and smart phones and a platform that is designed to operate with a wall-mounted smart card reader inside a classroom.
A smart phone can substitute for a personal escort for students walking alone at the University of San Francisco. The virtual safety escort system is called Pathlight and was just launched at the California institution by CBORD, a provider of campus card and security solutions.
Pathlight, which gives students quick access to extra security resources via their smart phones, is an application for Apple and Android devices allowing students to opt in to GPS tracking services for their phones. The phone interface requires three steps by the user:
If more time is needed, students can update their expected arrival times. If a student feels in immediate danger at any time, a help button will notify dispatchers of the student’s location and need for assistance.
Once transmission begins, dispatchers see icons for each student on a map with live tracking. The map shows the traveler and route taken. If a student requests help, does not meet his/her arrival time or if one of several other criteria are met (sudden high travel speed, wrong direction, etc.), an alarm brings the student’s location and information to a dispatchers’ attention.
Because it’s integrated with CBORD’s CS Gold campus card system, Pathlight provides greater situational awareness than a standalone GPS tracking solution. Location information for card usage and devices in CS Gold is correlated with the location information from Pathlight. In addition to a student’s location, dispatchers have access to the student’s ID card photo and contact information, and even nearby cameras where available.
Students without a smart phone, or even a cell phone, can still use the university’s physical escort services. Pathlight does not replace those services, but rather serves as another option when a student wants some extra monitoring but doesn’t feel the need for an in-person escort, said a CBORD spokesperson.
Students arriving at Princeton University this fall are finding more security in their residence halls. For the first time, their contactless campus ID card will be used to gain access to individual rooms.
The contactless readers on the front of the dorms remain the same, but instead of being issued keys for access to specific rooms students will now tap their card and enter a PIN for access, says Keith Tuccillo, system administrator for life safety and security systems at Princeton.
Using technology from SALTO Systems, the massive deployment includes 53 residence halls and 3,700 individual locks. It impacts about 9,000 undergraduate and graduate students living in Princeton’s housing facilities. Previously students would tap their HID iCLASS 32K card at the main entrance and then use a key for access to their rooms, Tuccillo explains. Starting in the fall, after students are through the main entrance they tap the card on a reader and enter a PIN to access their room.
“The housing department wanted something more robust,” says Trucillo, explaining the choice to require both contactless read and PIN entry. They wanted two-factor authentication so that if a student lost an ID card someone could not gain access to their room, he explains. To meet this need, Princeton chose SALTO’s XS4 lock with keypad.
For added security, the campus is assigning PINs rather than allowing students to self-select their own. “This is to avoid students choosing 1-2-3-4 as their PIN,” Tuccillo says. Students have been notified of their PIN and the changes to the physical access control system through email, physical mail and other print materials.
“In a SALTO system, all data required to make an access decision is held on the card,” explains Mike Mahon, Senior VP Commercial Sales, SALTO Systems. The lock and card communicate with each other to determine if access should be approved or declined. This eliminates the need for online connectivity to a central database during access transactions.
In addition, Mahon explains that the cards themselves can act as transport, carrying system data throughout the network of readers. Cards pickup data from readers in the normal course of entries and exits and spread this data to other readers in a viral manner during subsequent transactions.
This Data on Card concept is a key part of what SALTO calls the SALTO Virtual Network. Another key component is the series of online readers known as hotspots. At a hotspot, cards can be revalidated, PINs changed and access rights adjusted. Additionally, important system data can be loaded for viral dissemination. Hotspots can be normal online exterior door readers or they can be dedicated stations, conveniently located within a building.
Revalidation of card privileges at hotspots is crucial to the SALTO Virtual Network architecture.
In traditional online access control systems, cards and privileges are revoked. Access rights for a terminated employee or student are turned off in the central system and all subsequent access requests are declined during the online transaction. But this presents a challenge in offline environments, as the removal of rights for a terminated cardholder cannot be communicated immediately to the deployed readers.
SALTO solved this challenge by reversing the traditional access control model. “Rather than granting privileges with no expiration or extremely long life spans, we grant short term privileges and use the power of our hotspots to facilitate rapid, seamless revalidation,” explains Mahon.
Imagine a building with two exterior doors and two hundred interior doors controlled with SALTO locks. Cardholder privileges are set to expire every 24 hours and all interior locks operate completely offline. Each time a cardholders enters the building, the students’ privileges are revalidated and rewritten to the card granting access for the next 24-hour period. This enables the student to pass through any approved interior door readers. If the individual is fired or expelled, the card will no longer be revalidated at an exterior door and the current privileges on the card will expire at the end of the 24-hour window.
Furthermore, as other cardholders enter through the exterior doors and are revalidated, the terminated cardholder data is written to the card for viral distribution. As these valid cards are presented to offline door locks through the normal course of operations, the terminated card is added to the lock’s blacklist. If the terminated card is presented to that lock during the few hours it still has remaining on from its prior validation, access is denied and the card rendered inactive.
Because SALTO makes all access decisions offline between the card and the reader, the system is not impacted by network or power disruptions. But while the system can function in a fully offline mode, online operation via wireless enables additional functionality.
“Princeton opted to connect the interior XSR locks via Wi-Fi to enable real-time audit tracking for access transactions, instantaneous lock down and remote door scheduling,” says Mahon.
This also reduces the reliance on revalidation of credentials as terminated cardholders can be removed from the deployed readers via online notification. The university chose to revalidate at different intervals based on group, for example staff once per week, students and faculty once per semester and certain staff every 48 hours, explains Mahon.
The new system offers Princeton more flexibility and potentially saves money. In the past, if a key was lost the lock had to be re-keyed. With the new system, however, changes can be made to the physical access control system removing the lost card and issuing a new credential for the student.
It also streamlines the process for granting contractors access to residence hall rooms. Physical master keys were assigned or temporarily issued to contractors. The problem with master key-based systems is that lost keys create extreme vulnerabilities and costs. In traditional environments, a lost master key would entail mass rekeying at significant expense.
In the new environment, the contractor is issued a card with only the appropriate privileges. If lost, the card is simply cancelled and the risk mitigated. The new system also keeps an audit trail of who accessed what locations and when.
The new system was two-years in the making, Tuccillo explains. With the start of the Fall semester, students and campus administrators should start reaping the benefits of these efforts to better secure Princeton’s residential facilities.
