Category: Uncategorized

ID-Day

6th March 2008by Consult Hyperion4 Comments

[Dave Birch] In any discussion about identity in the U.K. recently, the big unknown has been the government’s proposed national identity card scheme. There was a lot of uncertainty about how exactly the scheme might work, what the timetable might, what the vision for the scheme was. I was therefore very excited to have been invited to come along in person to the think tank DEMOS this morning to hear the Home Secretary, Jacqui Smith, set out the government’s plan. I was thinking that I don’t often get the chance to talk to someone like Jacqui (ie, an incumbent in one of the great offices of state) and that she probably doesn’t often get the chance to talk to someone like me (ie, someone who knows about national ID card schemes), so it would be an interesting exchange. The government published both a plan to deliver the ID scheme (well, most of) by 2017 and the Crosby report.

When I took my seat, it turned out I was next to Meg Hillier, the Minister for ID Cards, who was kind enough to introduce herself. She turned out to be a good sport…

Meg Hillier: Pleased to meet you, I’m Meg Hillier.

Me: Hello, I’m Dave Birch from the Digital Identity Forum, pleased to meet you. Oh, was it you who said that ID cards were a bit like internal passports?

Meg Hillier: Yes, it was an unfortunate turn of phrase. They’re not, of course. There’ll be no legal requirement to produce them.

Me: What, not even if you’re buying a second home?

She was polite enough not have me thrown out so I was able to stay and listen to Jacqui. Anyway, the event was being recorded and broadcast so I thought I would add to the sum total of understanding by doing the same. I’ve taken Jacqui’s speech as well as the question and answer session and made them into a special edition of the Digital Identity podcast that will be posted on our feed shortly. Have a listen to what she says and make up your own mind about it (alternatively, you can read the speech online).

By the way, it wasn’t an idle boast inserted above (about knowing about national identity card schemes). Consult Hyperion is currently advising on its fourth national identity card scheme at the moment (or a European government) so I’d like to think that our opinions might count for something.

government, ID cards

Continue reading “ID-Day”

Setting the right example

29th February 2008by Consult Hyperion2 Comments

[Dave Birch] As you may recall, the US Treasury Department is introducing a pre-paid debit card that will be used to deliver benefit payments to social security recipients. According to the Wall Street Journal, the Treasury selected Comerica Bank as the card issuer for the programme, which will see social security recipients who don’t have a bank account given a “Direct Express” prepaid that will be loaded directly with welfare payments. The move is, in a way, obvious because the pre-paid card market is as a key place to bring financial services to the unbanked. Note that ss many as 40 million US households either have no bank account or make little use of banking services, according to research conducted by Chicago’s Center for Financial Services Innovation. The card is being introduced to provide benefit recipients with faster access to money and eliminate some security problems, like stolen cheques, but it will also save money because it must cost considerably less to make an electronic payment than to print and mail a cheque anyway.

Continue reading “Setting the right example”

Don’t panic!

26th February 2008by Consult Hyperion6 Comments

[Dave Birch] Just a note to assure everyone that the sky isn’t falling in, despite the rash of press reports about contactless payment card security over the last few days. A number of articles have pointed to Adam Laurie’s recent demonstration that American Express “ExpressPay” chips work exactly as per their specification and in line with the relevant international standards:

As part of his presentation Wednesday, Laurie asked for someone from the audience to volunteer a smart card. Without taking the card out of the volunteer’s wallet, Laurie both read and displayed its contents on the presentation screen–the person’s name, account number, and expiration clearly visible. As a disclaimer, Laurie said he spoke to American Express, the company that issued the volunteer’s card. Laurie said that American Express told him: “We are comfortable with the security of our product.” Laurie added that the company told him the number he displayed on the presentation screen was not the account number printed on the card, which Laurie proved by opening the wallet and comparing. However, Laurie noted that the captured account number could still be used for online transactions.
[From The hands-free way to steal a credit card | Defense in Depth – computer security, hacking, crime, viruses – CNET News.com]

Adam is a great guy and he does excellent work, but on this one he’s wrong. You cannot use the alias PAN (ie, the PAN given up via the contactless interface, not the one printed on the card) in anything except a contactless transaction and you cannot use it to make a bent contactless card because you need the Amex security keys in order to generate the right digital signature. If you attempt to use the alias PAN in an online transaction, the Amex host will decline it.

Continue reading “Don’t panic!”

What is different about virtual banking?

22nd February 2008by Consult Hyperion4 Comments

[Dave Birch] I happened to be speaking to someone from a developing economy recently, and they said that (and I quote) “it would be a dream to be regulated by the FSA”. What they meant was that however much people might complain about regulation, having some regulation is better than having none, because with no regulation it’s actually more difficult to get a new payment system off of the ground. Customers and business want to see that their payment system is regulated properly (the person from the developing economy said) and that they are dealing with reputable people and not fraudsters. This applies to developing markets in cyberspace as well, which is why the regulation of the virtual payments and banking space is not only inevitable but also not in itself bad (provided, I would argue, that a thousand flowers are blooming, since it’s too early to know what the “best” regime is). This shift to regulation is already happening in Second Life:

In a blog Linden Labs says it will be prohibited to offer interest or any direct return on an investment from any object, such as an ATM, located in Second Life, “without proof of an applicable government registration statement or financial institution charter”.
[From Finextra: Second Life cracks down on unregulated banks]

Now, having regulation does not, in itself, stop bad things from happening, as we in the U.K. know only too well: people can still make bad decisions that jeopardise other people’s money…

Gordon Brown defended the temporary nationalisation of Northern Rock on Monday morning amid widespread questions over the government’s handling of the collapse of the mortgage lender.
[From FT.com / In depth – Brown defends Northern Rock nationalisation]

Continue reading “What is different about virtual banking?”

Biometrics forge ahead

21st February 2008by Consult HyperionLeave a comment

[Dave Birch] I’ve said before that the introduction of biometrics into the mass market is more about convenience than security, but it seems as if the current U.K. approach is more about inconvenience (not that that’s necessarily bad)…

Members of industry body UKinbound say they are continuing to report “severe” drops in demand from travel to Britain from China, India and Russia in particular due to the time and cost of travel to visa centres. Reporting a 2.5% decline in overseas arrivals in December, the organisation said long haul travel to the UK was worst affected, with the new method of visa data collection introduced from last October being of “particular concern”.
[From Biometric entry visas hitting tourism to UK-18 February, 2008]

Now, like any other stout English yeoman, I don’t really care about foreigners being inconvenienced, but I do care about U.K. plc, which is why the connection between the introduction of biometrics and the fall in visitors caught my eye. What’s worse, though, is that the government’s approach appears to be to inconvenience stout English yeoman as well. I’m not the only person that has noticed that the biometric iris-scanning system at U.K. airports doesn’t seem to work as well as might have been imagined when the plans were being forged in the white heat of new technology:

There were about 40 people waiting to show passports and three people in the iris queue. I was iris-enabled and my colleague was not, so we decided to see who got through faster. No contest – I had not even got into the iris machine before he was waiting on the other side. Iris recognition is a clever idea, but the execution is hopeless.
[From Heathrow iris-scan queues are slower – Times Online]

I lack commitment, so I gave up using the system after it refused to let me into the country (perhaps it can read blog feeds) and therefore I can’t say whether it’s got better or worse over the last few months, but my guess would be worse because the poor performance might well be related to the size of the database as well as poor implementation.

biometrics, mobile, security

Continue reading “Biometrics forge ahead”

Far-out east

13th February 2008by Consult HyperionLeave a comment

[Dave Birch] U.S. consumers are keen to use their mobile handsets for making in-store payments, but the majority only want to have one credit/debit account for making those purchases, according to an ABI Research survey of US consumer attitudes. Much of the work on developing a standard application platform across NFC handsets has been geared at providing a platform capable of supporting and managing multiple payment accounts from any number of credit and debit card issuers. However the ABI survey, carried out at the end of 2007, indicates that consumers would be happy with one. I’m not sure that this makes any difference to the architecture projects we’re involved in though, which is, frankly, a reflection of the success of the GSMA telco-centric model of the world where that platform is the combination of the Trusted Service Manager (TSM) and Secure Element (SE). Yet I must again ask why there is such interest in a technology that consumers cannot buy in shops? It cannot be the solely down to the technology push, there is very clearly a very strong market pull as well. The Guardian says that mobile contactless will be “a cracker”, the next key technology for the post-iPhone age, and points to Japan. Half of all the new mobile phones sold there already have the contactless interface built in, so phones are used as electronic cash for buying newspapers, electronic credit cards for larger-ticket items, as pre-paid tickets or season passes for travelling on trains and buses and as storage media for receiving discount coupons from restaurants and collecting a bewildering range of in-store cash-back-style points. The Guardian is not alone in looking east, rather than south (ie, to Barcelona, where the 3GSM jamboree is full on), for a window into the future of payments:

Check out this list of the five advanced technologies available only in Japan: True mobile digital TV (all the regular terrestrial channels at no cost), connected cars (with a navigation system connected to a cell phone), primary wave earthquake warning systems, and home-help robots. And my personal favorite is Osaifu keitai–mobile wallets. They put my so-called “smartphone” to shame
[From Reason Magazine – Hit & Run > Japanese Mobile Phones Smarter Than Average American]

Continue reading “Far-out east”

SEPA update

6th February 2008by Consult Hyperion8 Comments

[Dave Birch] Unlike many of you, I am very fortunate to have access to a) a euro bank account and b) someone that I can ask to waste their time on payment-related lunacy. Put these two things together and a SEPA experiment was born: I decided to celebrate the birth of the SEPA zone and send some euros to one of our Forum friends in the Netherlands, thus becoming (I hope) the first blogger to originate a SEPA Credit Transfer (SCT).

Continue reading “SEPA update”

Identity and incentives

5th February 2008by Consult HyperionLeave a comment

[Dave Birch] Now, I don’t want to blow my own trumpet (well, not strictly true I suppose) but it’s only taken me five minutes to come up with a better idea of an incentive for identity card use in the U.K. than any I’ve heard so far from the government’s management consultants. Does anyone remember the story of Geldkarte in Germany? It was a barely-used electronic purse added to German bank cards some years ago. It was moribund until the big bankers came up with an excellent (and I use the word deliberately) wheeze. They persuaded the German government to pass a law requiring the use of bank cards (that could verify age) to buy cigarettes. Naturally, Geldkarte complied with the relevant standards, and away they went. Now I notice that Japan is going down a similar route:

The Tobacco Institute of Japan has started accepting applications for taspo age-verification cards to be used at cigarette-vending machines starting in March… To obtain the card, an application form with a mugshot and a copy of a document that shows the applicant’s age, such as a driver’s license, must be mailed to the institute… From July, all 520,000 cigarette-vending machines in the nation will require the card, which also can be used as an electronic money card to buy cigarettes from vending machines.
[From Smart card for cigarette machines introduced : Business : DAILY YOMIURI ONLINE (The Daily Yomiuri)]

Now there’s an idea. You could bring in a quarter of the population at a stroke (bad choice of language, I know) and build from there.

ID cards, smart cards

Continue reading “Identity and incentives”

Population-scale PKI

1st February 2008by Consult Hyperion1 Comment

[Dave Birch] The Land Registry, the government agency that records who owns Britain’s land and buildings, has spent the past decade developing an e-conveyancing system to make buying and selling houses easier and more certain. It’s going to be using PKI to secure the system. Authorised parties will be able to exchange information quickly, securely and reliably with each other and the Land Registry. Documents will be encrypted and “signed” with a digital certificate, and people will require a secure token, username and password to produce and read the documents. Final testing is underway and when it goes live, expected in early summer, it will be able to process up to 300,000 documents a day and support up to half a million security “certificates” from property professionals such as conveyance attorneys.

identity, PKI

Continue reading “Population-scale PKI”

Euros centric

1st February 2008by Consult Hyperion1 Comment

[Dave Birch] I went along to a seminar, kindly hosted by Barclays, to take part in a discussion organised by the Centre for European Reform on the future of retail banking in Europe. David Shirreff, the Frankfurt business correspondent for The Economist, has written a pamphlet for the Centre called “European Retail Banking: Will there ever be a single market?” [PDF]. David’s key points are that in smaller countries markets have opened up, but in larger countries (eg, Germany) there has been resistance to change; that the Commission should use competition powers to take on vested interests but stick with a light touch; and, most controversially, that regulators should create a framework in which each business within a bank (and I guess this would include payments) should have its own capital and profit and loss account to increase the scope for cross-border mergers and acquisitions below the mega-merger level. I am absolutely not qualified to comment on whether this makes sense or not, but I thought that Digital Money Devotees might be interested in the discussions that followed (I’ve not attributed any of the comments, in case I misunderstood them in some way, and I’ve tried to focus down on relevant part of the discussion).

Continue reading “Euros centric”