Smart Card
Technology
This section contains articles about smart card technology and applications. I wrote all the material on this page and will periodically update it.
(Note: This page contains a number of images; so, you may want to take a break while it is loading.)Contact me at: pjsmart@aol.com
Is There a Smart Health Card in Your Future?
Preparing for the Next Big Thing (Contract Professional Magazine)
Data Man: You Are the Sum of Your Numbers (Washington Post article)
Standards and Interoperability Application Programming Interface Production and Personalization
"Smart Cards Could Save Lives—and Dollars"
"Smart Cards: The Next Generation for Electronic Toll Collection"
Why Smart Cards? Migrating to Smart Cards Stage I: Smart Cards as Payment Media on Closed Toll Roads Stage II: Prototype and Pilot ETTM Installations Stage III: Establish Seamless ETTM Using Smart Cards
Smart Cards for Driver Licenses and Commercial Vehicles
"Are You Ready for Smart Cards"
Inside the Smart Card Smart Card Driver Licenses Smart Cards for Private Vehicles Smart Cards for Commercial Vehicles Sidebar: What Is a Smart Card? Sidebar: Programming Commonality into Smart Cards Sidebar: Smart Identity Cards as MVA Cash Cows
Smart Cards: The Ultimate Personal Computer
{This description, which I have updated, originally appeared in the Viewpoints section of The Miami Herald, October 2, 1988.}
Think of the smart card as a tiny personal computer—minus screen and
keyboard—and you have some idea of its potential power. No bigger than
a typical credit card, each smart card contains an integrated circuit on
a computer microchip capable of processing and storing thousands of bytes
of electronic data. Given their size and portability, smart cards represent
the ultimate today in personal
computers.
The trend in computing over recent years has been toward small machines and "distributed processing." Simply put, that means delegating tasks to many small computers rather than having everything done in large, centralized machines. Over time, smart cards will put personal computing power into the hands of every one of us.
Many people carry wallets thickened with cards from banks, stores, airlines, insurance companies and the like. On plastic or on paper, each card identifies the issuer and cardholder, but the real record is not the card but a file housed in a computer, perhaps hundreds or thousands of miles away. To draw cash using an automated teller machine, make a purchase or pay a medical bill, the bank, store or hospital needs to verify the accuracy of the card through a central computer. So, today's plastic and paper cards merely represent a record; they are not the record itself.
Created by a computer, but carried by an individual, the smart card is itself an electronic record. Information in the microchip can immediately verify the cardholder's identity and any privileges to which the card entitles that person. Withdrawals, sales, bills—all the information can be processed electronically on the spot; later on, if necessary, those records can be transmitted to a central computer to update its files.
At a hospital emergency room, for example, the card could identify the person's health-insurance carrier and transfer all necessary information from the microchip to an admittance sheet. Tests, treatment, billing and prescriptions could be processed more quickly using the card. Major clinical findings could be added to the medical information section within the microchip.
Smart cards typically hold 2,000 to 8,000 electronic bytes of data—roughly several pages of information. Because those bytes can be coded electronically, the effective storage capacity of each card is significantly greater than a few pages. Magnetic-stripe cards, such as those issued by banks and credit-card companies, lack the security of microchips but are cheaper to use as single-purpose cards. As a carrier of multiple records for multiple purposes, however, the smart card is superior and, ultimately, less expensive. The distributed processing possible with smart cards and small computers also reduces the need for ever-larger mainframe computers and the expense of local and long-distance circuits to maintain an on-line connection to a central computer.
Smart cards are secure, compact and intelligent data carriers.
Though they lack screens and keyboards, smart cards should be regarded as
specialized computers capable of processing, storing and safeguarding thousands
of bytes of data. Similar in size and shape to plastic credit cards, smart
cards with electrical contacts have a thin metallic plate just above center
line on one side of the card. Beneath this dime-sized plate is an integrated
circuit (IC) chip containing a central processing unit (CPU), random access
memory (RAM) and non-volatile data storage. Data stored in the smart card's
microchip can be accessed only through the chip operating system (COS), providing
a high level of data security. This security takes the form of passwords
that allow a user to access parts of the IC chip's memory or
encryption/decryption measures which translate the bytes stored in memory
into information.
The International Standards Organization (ISO) has developed a standard (ISO 7816) for integrated-circuit cards with electrical contacts. This standard defines the physical dimensions of smart cards and their resistance to static electricity, electromagnetic radiation and bending forces. It incorporates other ISO standards that establish the location, as options, of the card's magnetic stripe and embossed data.
Most smart cards have eight electrical contacts, but only five have been defined by ISO 7816 and must be active. The standard sets voltage and current requirements and allows manufacturers to use one of two transmission protocols: T=1, asynchronous half-duplex block transmission, and T=0, asynchronous half-duplex character transmission. (Some manufacturers have developed smart cards that meet the physical and electrical requirements of ISO 7816 but use a proprietary transmission protocol designated T=14. There is no specific T=14 protocol; it simply indicates the protocol is non-standard.)
ISO 7816 establishes commands to read, write and update records, but not all manufacturers use them. There is also a means to identify applications and the organizations that create them.
A typical smart card contains a COS, file directory structure and "mask" of preprogrammed instructions. These vary from one manufacturer to another and, sometimes, from one card to another within the same vendor's line of products.
There is no standard COS for smart cards and read/write devices. To assure an application can operate with products from multiple vendors, a software program must translate application commands and functions into language specific to each card and its COS. This program, which is logically positioned between the application and the COS, is called an application programming interface, or API.
Interoperability does not happen by accident with smart cards;
it must be planned and programmed. Because an API can translate between smart
cards and read/write devices from multiple vendors, an API is critical to
the migration from paper-based methods to a system of interactive electronic
documents based on smart cards.
Smart cards operate with special read/write devices, some of which may be attached to computers and point-of-sale (POS) terminals using standard cables and interfaces. Others are built into hand-held computers or small transponders that can transmit and receive data via radio frequency (RF) waves.
Since major smart card applications are likely to involve multiple card issuers, interoperability must be designed into the system right from the start. From a technical perspective, the key is a smart card API. This is a layer of software that allows an application to communicate with smart cards and readers from more than one manufacturer.
Think of the API as a specialized device—software, in this instance—that acts as a translation layer between an application and the card. The API allows the agency running the application to select smart cards from multiple vendors. Opening an application to multiple smart cards encourages competition among card vendors and the benefits of that competition—greater quality and lower prices. That may not prove the case if an application were written for a specific card and chip operating system.
An API is not a universal interface that will work with all smart cards; rather, it provides a way for applications to send commands to the specific COS of more than one card. Programmers can begin by developing an API for two or three cards and, over time, expand the software to include a dozen or more smart cards. There is a practical limit on the size of the software program that can be stored in some portable terminals, but the API should be sufficiently versatile to accommodate smart cards from competing vendors.
The API can also be used to control data versions. If changes need to be made in the data elements on the card after it has been issued, the API can be utilized to update cards without having to recall the cards for reformatting.
Smart card issuance can be handled through individual or batch production. In terms of content, the result is the same.
On-site production of individual smart cards requires a digital camera connected to a computer, card printer and read/write device. The process is labor-intensive. A clerk typically enters the individual's data at the keyboard, captures his or her digital image with the camera and sends it to the printer. The clerk inserts the resulting card in the read/write device and transfers the cardholder's data from the computer to the card's microchip.
Batch processing begins with the capture of personal data and a digital photo; the information is then aggregated into a file with similar data for hundreds or even thousands of cardholders and transferred to a central site. Automated card personalization units take each individual record in the file, encode the card, print the data, photo and organizational artwork and deposit the finished product in a large output hopper. Though batch processing saves costs by eliminating the labor-intensive steps required to produce individual cards on site, it also results in a delay between data capture and card issuance.
"Smart Cards Could Save Lives—and Dollars"
{This is adapted from an op-ed article I wrote for the Los Angeles Times, April 12, 1993.}
Smart cards are similar to credit cards in size and thickness. What gives them their "smarts" is a tiny computer microchip. Put that card in a computerized reader and the cardholder now has access to his or her own records.
Writing data into a smart card takes just a few seconds; the process is as easy as transferring data from a PC to a diskette. Think of the smart card as a computer that can process and store your medical record, and you will grasp its potential power.
Automated patient information would obviously speed up the processing of claims. Its greater value lies in preventing the sort of errors that routinely occur when physicians prescribe a drug or procedure based on a patient's symptoms but without access to key elements of the individual's medical and medication histories. The result in some instances is a drug or treatment that harms rather than heals. Adverse drug reactions take their heaviest toll among the very young and very old.
Many adverse drug reactions could be prevented if the physician who prescribed the drug and the pharmacist who dispensed it had better information about the patient. But all too often there is no patient "record." There are only fragments of information—some on paper, others in computers—scattered among clinics, hospitals and pharmacies.
That fragmentation inevitably leads to higher costs when examinations, laboratory tests and prescriptions are duplicated because one clinician has no access to the information others have gathered. It also leads to doctors prescribing drugs and therapy they would not have ordered had they been able to see a more complete patient record.
While many pharmacies routinely use computerized drug-screening software, physicians seldom do. The problem is not the software itself, which is available from multiple sources and reasonably priced. The problem is the fragmented nature of medical record-keeping. The best drug-screening software is of little value without a reliable patient record.
Suppose, instead, every patient came through the door with a relatively complete medical profile and insurance information. The physician would immediately be able to see what diseases, allergies and drug sensitivities had been diagnosed and what drugs the patient had been taking. For children, the card would document the immunizations that are so critical to the first few years of life.
For roughly $200 per computer, clinicians could have the hardware and software they need to read and update smart cards. The cards would communicate to existing automated systems through a standard data format. A similar form of interchange would occur when the computers used by physicians and pharmacists transmit new information to the patient's card. Ordered in millions. the price per smart card should run $3 to $4.
Compare those costs against the high toil in lives and dollars we now pay for duplicate prescriptions, redundant tests and adverse drug reactions, and smart cards look to be a bargain.
"Smart Cards: The Next Generation for Electronic Toll Collection"
{This article was published in the April and May 1996 issues of Tollways, the newsletter of the International Bridge, Tunnel and Turnpike Association.}
Smart cards have the power to revolutionize electronic toll collection (ETC). This revolution will not come about because smart cards are faster than current Electronic Toll and Traffic Management (ETTM) transponders. It will occur because smart cards offer toll agencies something no other technology can provide—an opportunity to get out of the banking business.
Cash is notoriously costly to handle. Current ETTM transponders eliminate cash at the toll booth but generate considerable costs of their own. The toll agency (or its vendor) must open one or more "tag stores," where motorists can purchase or lease transponders. Customers must establish accounts and pre-pay them by check or through automatic deduction from a bank account. The toll agency must provide customer service in person and by phone to handle problems involving transponders and accounts. In short, turning that split-second blip of transponder data into money in the bank requires a sizable back-office operation.
With smart cards, the back office disappears. Every vehicle that presents a smart card for payment on Monday has its toll deposited in the bank by Tuesday. No counting of bills and coins, no "shrinkage," no armored vehicles, no prepaid accounts, no back-office operation—the money flows from the customer's smart card to the toll agency's bank account as if by magic.
Magic, of course, has nothing to do with it. Smart cards are simply the latest—and, one could argue, most convenient—means of electronic payment.
These smart cards are not prototypes or pilots; they are the real thing—plastic, credit-card-sized devices with a computer microchip and on-board microprocessor that carry real money. Unlike current magnetic-stripe bank cards, which are passive devices, smart cards are "intelligent." That means that when a smart card enters a point-of-sale (POS) terminal, the card and terminal interrogate each other. If the card does not receive a proper response, it recognizes the terminal is not authorized to use the card and permits no further processing. Similarly, if the terminal determines the card is an "alien device," it will refuse to interact with the card. Because smart cards have secret keys and encryption algorithms built into the microchip, they can securely transfer money from the card to the POS terminal to pay for goods and services.
Because stored-value smart cards are payment media, they could pave the way for toll agencies to get out of the "banking business." To accomplish such a change will require not only an infusion of new technology; toll agency officials and staff will need to adopt a new self-image. Simply put, when they look in the mirror, they will need to see themselves as merchants.
Smart
cards will be used this year in thousands of locations in Atlanta: Hotels,
restaurants, stores, shops and vending machines. At least three manufacturers
will be offering smart cards that meet stringent Europay-MasterCard-Visa
(EMV) specifications. More than a dozen manufacturers of POS terminals are
in the process of subjecting their devices to the exhaustive tests required
for certification by MasterCard or Visa.
A toll agency that decided to take advantage of these POS terminals could begin using smart cards for toll payments in a matter of months.
Migrating to smart cards will impact toll agency operations in at least four ways:
1. It will separate payment from management functions.
The toll agency will be able to concentrate its resources on operating and maintaining its facilities. A bank or transaction processor under contract to the agency would handle the sale of smart cards and transponders, provide customer service and use the electronic banking network to make overnight deposits of each day's tolls into the agency's bank account.
2. Toll agencies will benefit from technological innovations and cost savings arising from marketplace competition among smart card and POS terminal vendors.
By becoming merchants, toll agencies will enter a marketplace with many vendors and fierce price competition—just the opposite of today's specialized marketplace for ETTM products and services.
3. It will push the vendor community toward standardized ETC based on smart cards.
The ETTM market today is dominated by proprietary products. Once the agency chooses a vendor, it becomes locked in. By announcing to suppliers that smart cards will become the medium of payment for the next generation of ETTM, toll agencies will stimulate vendors toward sets of standard—perhaps, interchangeable and interoperable—products that are the hallmark of a mature and competitive marketplace.
4. It will reduce or eliminate theft and fraud.
Toll roads and other businesses that handle large volumes of bills and coins invariably suffer from "shrinkage." By removing cash from toll transactions and moving the money electronically from the motorist's smart card to the agency's bank account, agency revenues will remain untouched by human hands.
The ultimate goal of smart-card-based ETC is a seamless system that will operate for either closed or barrier toll roads. Such systems, using proprietary products, have been seen on a limited basis elsewhere in the world. To take advantage of the competitive marketplace, toll agencies will need to adopt a migration strategy that will ultimately make that seamless system an affordable reality. This will entail a three-stage approach.
Closed toll roads and other single-payment facilities, such as bridges and tunnels, would be the logical place to start because the impact would be limited. It would entail the acceptance of new payment media—smart cards, in this instance—at POS terminals in exit toll booths. The driver would present a smart card to pay the toll at an attended booth. Although the speed of smart card transactions—about half a second—might have a modest, positive impact on exit-lane throughput, the vehicles would initially use only attended lanes. The tolls would, however, move into the electronic payments stream for overnight deposit.
Promotion and distribution costs would be modest. Turnpikes
enjoy a "captive audience." On closed toll roads, the motorist gets an entry
ticket and pays the toll on exiting. Information on the back of the entry
ticket and on roadside signs could promote the use of smart cards as payment
media for tolls as well as for food and fuel at concessions along the road.
Motorists who did not have a smart card on entry would be able to purchase
one when they stop at a gas station or restaurant. The toll agency could
create incentives to purchase smart cards by offering modest discounts or
other incentives. (In those regions where financial institutions are issuing
smart cards on a broad basis, many commuters will get them from their banks.)
Toll agencies could generate additional revenue by selling advertising space on the cards they distribute through roadside concessions. They could also target the growing collectibles' market by issuing smart cards with commemorative artwork celebrating regional anniversaries and events. In Europe, for example, special-edition smart cards quickly become collectors' items and their value often remains inside the card. (Similar to uncirculated coins or stamps, smart cards unblemished by the tracks of a POS terminal are more valuable to collectors.)
Through competition, the toll agency would select a bank or transaction processor to supply the cards and POS terminals, provide customer service and deposit tolls through Electronic Funds Transfer (EFT). If the financial institution were already distributing smart cards to its customers and the general public, the agency might be able to get the institution to bear the POS infrastructure costs in exchange for a modest transaction fee, thus greatly reducing the need for capital expenditures by the agency.
The introduction of smart cards would not undercut current transponder-based ETTM systems; it would simply provide motorists and agencies with a new means of payment. Toll agencies would also gain some early experience with smart cards and an opportunity to have the electronic banking system lift some of the burden of agency back-office operations.
During the second stage, toll agencies would begin the transition from smart cards solely as payment media to smart cards as elements of a true ETTM system. Closed toll roads could, conceivably, decide to forgo the considerable expense of full-scale ETTM and continue to use smart cards for payment only. For barrier roads to take full advantage of smart cards, however, this would be the time to prototype ETTM with a new generation of transponders and in-vehicle computers that accept stored-value smart cards for toll transactions. The agency would establish pilot installations of antennas and vehicle-to-roadside communications (VRC) and put the new technology to the test.
In preparation for this stage, toll agencies will need to make public their transition plans. Using requests for information and draft requests for proposal, they can announce their intent to purchase "standardized" products for the next generation of ETTM. These signals will give vendors the time they need to gain Visa and MasterCard approval of their transponders to conduct smart-card transactions. Suppliers are currently developing and testing in-vehicle computers—mostly for trucks and buses—and smart-card transponders for cars. In other words, the vendor community already has the technology to perform smart-card ETTM for barrier roads at mainline speeds. What they need is a signal from toll agencies that their next-generation ETTM systems must incorporate EMV smart cards.
Having proved that smart-card transponders and in-vehicle computers can conduct wireless toll transactions on a pilot basis, the final stage would concentrate on substituting smart-card ETTM infrastructure for the concrete of additional toll lanes. Because ETTM-only lanes will be unattended, agencies will enjoy substantial, long-term savings from reduced labor costs.
Toll agencies would continue the push toward standardized VRC and transponders. They would also seek improved Automated Vehicle Classification (AVC) systems to reduce or eliminate the potential for fare evasion. During this stage, agencies would be able to procure smart-card-based ETTM devices and systems in a highly-competitive marketplace.
In some ways, toll agencies are like other businesses: They charge customers for their services and accept payment in a variety of forms. The principal difference is the nature of the transaction: It's done from a vehicle—often one that is moving.
By remaining alert to trends in technology and business, toll agencies can begin to enjoy the fruits of the technological revolution in electronic payment systems. By initiating the transition to smart cards—at first as a new form of payment—they can take advantage of merchant methods and systems, such as POS terminals and EFT, that generate revenue without the messy logistics and attendant risks of huge volumes of cash. In sum, smart cards will allow toll agencies to leave their banking to financial institutions, cut labor and support costs and concentrate their resources on what they do best—making road travel safer and more efficient.
Smart Cards for Driver Licenses and Commercial Vehicles
"Are You Ready for Smart Cards?"
{I wrote this article for the Winter 1996-97 issue of MOVE, the magazine of the American Association of Motor Vehicle Administrators (AAMVA). It contains a main text section and three sidebars.}
Smart cards are coming. As driver licenses. As vehicle credentials. As payment media. These high-tech devices offer greater speed, economy and effectiveness—for those who understand how to put them to work.
Inside the Smart Card
At first glance, a smart card looks just like a bank or credit card—same size, same plastic. A closer inspection reveals a metallic plate about the size of a dime. Beneath this plate lies a microchip, about half a centimeter square, capable of capturing, storing and processing thousands of bytes of data. Here, then, lies the principal distinction: Smart cards are not just records; they are tiny computers. (See Sidebar: What Is a Smart Card?)
Suppose your driver license were carried on a smart card. The front and back would look as they do now—photo and demographic information on one side, notations and codes in excruciatingly tiny print on the other. Outwardly, no difference. Inside? Another matter entirely.
The microchip inside your smart card would carry not only name, address and physical description; it could hold your photographic likeness—compressed and digitized—and, perhaps, a fingerprint or other biometric measurement that is uniquely yours. Moreover, all that data would be protected by an encryption algorithm and secret key built into the microchip.
But don't stop there. Think of the paper-laden process of selling the family car or the complex documentation commercial vehicles require. Now, imagine all that paper transformed into electronic bytes stored in a vehicle smart card.
These are a few of the many possibilities smart cards offer motor vehicle administrators.
This past summer, the State of Utah took the first step toward issuing driver licenses on smart cards. In its Request for Proposal, Utah sought vendors willing to bear all card costs in exchange for access to three-fourths of the storage and processing capacity of an 8000-byte smart card that would ultimately be carried by the state's 1.2 million drivers.
"From our perspective," said G. Barton Blackstock, the Bureau Chief of Utah's Driver Control Bureau and Chair of its RFP Committee, "a smart card project would not be possible in Utah without a public private partnership primarily because of the costs involved.... The private sector provides their ability to market products and generate revenue; the public side of the equation provides the regulatory functions dictated by the legislature as public policy."
Blackstock foresees a collateral role for the new driver license: "Smart cards can provide citizens access to government services in an environment absent human intervention. Everything from public assistance transfers to library cards can be included on a smart chip, providing space is available. The possibilities are restricted only by our inability to think 'outside the box.'"
Connecticut is also considering smart card driver licenses involving public and private partners. Michael W. Krochmalny, the Chief of the Bureau of Business Services for the state's Department of Motor Vehicles, said, "We will be looking for an initial set of partners to launch the card with the same vision. While the Utah process is an expedient, it places more control in the hands of a vendor than we want to."
Control is also an issue for Cheryal A. Roe, Data Processing Administrator for Delaware's Motor Vehicle Division and Chair of AAMVA's Motor Vehicle Information Systems Committee: "A new [governor's] administration may bring changes, and we may not be able to respond [if a bank controls the card].... As a state, Delaware has sovereign immunity. If the license is stolen and it contains health and medical records that lose their confidentiality, who is responsible?"
John Esser, who works for card manufacturer Giesecke & Devrient, has 11 years of smart-card industry experience. The approach taken by Utah led him to raise these questions: "Who is the 'owner' of the card? the financial institution? Who controls the applications on the card? How does the card get personalized? What happens when your bank card does not get renewed?"
Regine Wojciechowski, the Business Development Director for Gemplus North America, a smart card manufacturer, raises additional questions: Will the driver license "be compatible with bank marketing policy? Constraints on card life might be different for a driver's license [typically four to five years] versus a banking card [perhaps two years]. What happens to the driver's license if I break my credit card contract with the bank?"
These are unfamiliar questions for licensing agencies, but they need to be addressed if a driver license is going to piggyback on a smart bank card.
The
Europay-MasterCard-Visa (EMV) specifications describe how smart bank cards
perform debit and credit payments. Because banks must process financial
transactions worldwide, state agencies would have no control over the file
structure, chip operating system and encryption methods of an EMV-compliant
smart card. If a digitized photo and biometric were incompatible with banking
functions, the jurisdiction would be compelled to forgo such features.
Fortunately, there are alternatives. (See Sidebar: Smart Identity Cards as MVA Cash Cows.)
A vehicle in the future could leave the factory with a smart card containing the vehicle identification number (VIN) and other production-related data. Over time, owners could use the card to capture maintenance records and other vehicle-related history. Should a manufacturer's defect lead to a recall, dealers could document the repair in the smart card and create an electronic transaction for their own and the manufacturer's records.
Michael W. Kozlowski, the Commissioner of the Connecticut Department of Motor Vehicles, suggests smart cards "would eliminate the dreaded forms that confuse our customers, bog down the transaction process and create material for the late-night comedians. In an ideal world, the vehicle data would be captured from a 'vehicle smart card' and the owner data would be captured from a 'smart operator's license.'" (MOVE, Fall 1996, p. 34.)
Before a truck can operate in interstate commerce, the motor carrier must pay the special federal tax on heavy vehicles. The company must also obtain a license for its fleet under the International Fuel Tax Agreement (IFTA) and register each truck under the International Registration Plan (IRP), paying an apportioned registration fee to each North American jurisdiction in which its trucks will operate.
These and the many other requirements for interstate operations have one thing in common—paper, and lots of it. Several states are experimenting with electronic one-stop shopping to automate carriers' requests for commercial vehicle credentials. (MOVE, Fall 1996, pp. 4-5, 16-17.) Though the input is electronic, the output in those projects continues to be paper-certificates, cab cards and permits.
If, instead of printing credentials, the state wrote the data on smart cards, it could reduce administrative costs and speed the credentialing process. Agencies might even provide established carriers with blank smart cards and let them issue and update the cards. Because the state would logically control both the credential files and the smart cards which carry them, agencies could leave the physical issuance process to the carriers—to the benefit of both.
Connecticut's DMV sought and received legislative authority to move toward smart cards because Commissioner Kozlowski "felt that we could process our vehicle-related transactions more efficiently if the information came to us on a smart card," said Krochmalny. "We envision a paperless office if all vehicles are represented by cards. Transactions could take place outside of our offices—at kiosks or personal computers—if the security of the transaction were provided by a secure card."
The first jurisdictions that issue smart cards for commercial vehicles may need to include inexpensive portable viewers so police and vehicle inspectors anywhere in North America can read the credentials. However, if states and provinces are willing to work together to develop a common set of tools, devices in any jurisdiction will be able to read the smart cards of every jurisdiction. (See Sidebar: Programming Commonality into Smart Cards.)
Smart cards do not represent a revolution so much as an evolution. Just as offices that once exchanged printed documents now share electronic files instead, motor vehicle administrators can improve the way they do business by automating driver and vehicle credentials with smart cards. The data has already been captured and resides in each jurisdiction's computers. The issue now is how to move a useful portion of that data into the hands of the people who need it. Smart cards give administrators the power to do just that.
—end of article text, sidebars follow—
Though it may look like an ordinary plastic card, a smart card is a computer. Built into its tiny microchip is a central processing unit, random access memory and data storage (typically 8,000 bytes). It also contains a chip operating system and a "mask" of programmed instructions. These characteristics make smart cards "intelligent" and "interactive" devices.
The most advanced smart cards contain their own file structure along with an encryption algorithm and secret key. This allows the card to store data in separate files which do not interact; the card can also transfer data in an encrypted format to protect the information from electronic eavesdropping.
When a card encounters a read/write terminal, each identifies itself to the other. If the response does not match what the card or terminal has been programmed to receive, no further processing takes place. So, unlike ordinary bank cards, smart cards can defend themselves against unauthorized users or uses.
How do smart cards issued in Maine communicate with read/write terminals in Arizona? They don't—unless, that is, the states have planned in advance to share driver and vehicle data.
"The ideal situation would be for every type of card and card acceptance device to be able to read, process and update information from a driver license regardless of who manufactured the smart card or who personalized it," said Kevin Gillick, DataCard Corporation's Director of Business Development, Americas Sales. "If the 'rules' by which interoperability for driver licenses are clearly articulated, vendors will be able to comply."
Wojciechowski of Gemplus makes a similar point: "To ensure interoperability, different states must agree on the way to code, access and store the information inside the card and, moreover, agree on a security scheme which would ensure overall security from one state to another. In other words it would allow the police in one state to verify that a driver's license issued in another state is genuine."
Technological commonality must be built into smart card applications right from the start. The most critical element is an application programming interface, or API. This is a layer of software between an application, such as the computer program that issues a driver or vehicle record, and the smart card that will carry a portion of that record.
With an international sponsor—AAMVA, perhaps—North American jurisdictions could commission the development of an API that would make it possible for states and provinces to develop driver and vehicle records with smart cards from multiple manufacturers. Using a dictionary of common data elements, each jurisdiction could select service providers and smart card vendors on a competitive basis, administer driver and vehicle records much as they do now, but transfer key data to smart cards.
Smart cards could generate revenue for MVAs—not as bank cards but as electronic identity documents.
Fraud costs North American businesses billions of dollars a year. Banks and merchants could conceivably reduce their losses if they could quickly and accurately capture information on customers before they walk away with large sums of cash or expensive merchandise.
Open a bank account or board an airliner with an "electronic ticket," and the first thing you must do is establish your identity with a photo ID. Most individuals reach for their driver license. Revenue to MVAs: zero.
Consider the same transactions—only this time with a smart card driver license. Instead of copying information by hand or, as is sometimes the case, photocopying the license itself, the clerk inserts your smart card in a read-only device and makes an electronic copy of your name and address, license number and digitized photo in a matter of seconds. Revenue to MVAs: potentially millions of dollars a year in software licensing fees.
MVAs devote significant staff and resources examining birth certificates and other documents to establish the identity of license applicants. With today's driver documents, banks, merchants and airlines enjoy a "free ride." With smart card driver licenses, they would pay a modest fee to read and copy—but not write or alter—the card's electronic ID data.
As smart cards become more popular, the application programming interface (API) could also generate revenue. If, for instance, the initial API encompassed two types of cards and two types of terminals, a subsequent version might expand to include five of each device. The cost of reprogramming the API and distributing the new software version would be borne by fees paid by the card and terminal vendors whose products were incorporated into the API.
With electronic ID data in a smart card, employers and others in the private sector could let employees use their driver licenses to gain access to parking lots, restricted areas or computers. Before driver licenses could perform such tasks, the companies would need to pay a licensing fee or royalty to use the API.