Analysis: Smart card pack holds the ecommerce aces

ONCE upon a time there were two home video systems, Betamax and VHS.

Manufacturers and consumers were stymied: which format of tape or system should they buy or make? The former was the superior system in terms of quality, but wasn?t marketed well, and so VHS became the de facto standard we all use today.

Are we in danger of repeating this battle in the emerging technologies of smart card and web browsers? Maybe not. Take web browsers first.

Today there are basically two web browsers, Netscape?s Navigator and Microsoft?s Internet Explorer. The World Wide Web Consortium defines web protocols so that sites can be viewed properly no matter which browser you use ? even if it means you may not see some of the glitzy bells and whistles on your browser which other browsers display. Producing web pages for either of the big two virtually eliminates users of other browsers from viewing your site.

As bad as the situation is when there are two or three standards for commonly used objects, imagine how it would be if there were literally dozens. It is the existence of nearly 100 systems which has prevented one of the great technologies of the late 20th century, the smart card, from reaching its potential.

But that?s set to change. Two operating systems look to become the de facto standards in the industry. The multitude of smart card initiatives announced in the past month, especially at this week?s Cartes 98 Show in Paris, show that the devices have come of age.

According to research by IDC, smart card technology is one of the fastest-growing and dynamic branches of the IT industry in Western Europe today. IDC says the main vendors expect their revenues to grow by more than 56% in 1998, and that sales of microprocessor-based cards are expected to top 308 million this year.

Smart cards will trigger significant opportunity for IT vendors for the next few years, says IDC. They are regarded by many vendors as the fastest and most efficient way to secure electronic commerce, web, intranet, extranet and workgroup applications.

Some of the new initiatives include fingerprint ID capable smart cards, a ticketing and payment system for London Transport, and the Co-operative Bank?s plan to use the cards to deal with the complexity of selling individual savings accounts.

The smart card was effectively invented in 1974, when Roland Moreno, a former journalist and self-taught inventor, devised a payment system which was actually an early electronic stored-value application mounted on a ring. It allowed the bearer to ?load? currency onto the ring, thus making the electronic money available to be spent at merchants with the necessary ring-reading systems installed. Since then, dozens of incompatible types of card technology have proliferated.

Mark Stevenson, independent smart card and consultant and co-author of a smart card report by researcher Ovum, expects that by the year 2003 there will be around five billion smart cards in use ? as many cards as there are people on the earth.

The average swipe card based on magnetic strip technology costs only around 50p to produce, but the average smart card costs about #1.50.

?The way to make smart cards cheaper is to optimise them for particular applications,? says Stevenson.

?But when card fabricators provide cards and readers specific to particular applications, the direct result is a proliferation of operating systems and standards.?

Now, Stevenson says, two camps are vying to be the operating system of choice. One is Sun Microsystems (partnered with Visa and others) with a Java Virtual Machine (JVM) on a card. The other is Maosco (Multi Application Operating System Consortium), an industry-wide consortium which includes Mondex, Mastercard, Fujitsu, AmEx and others. As Stevenson says, ?two competing technologies results naturally in some issues about which is best.?

The Sun camp claims its Java initiative is best because it is designed to hide the proliferation of operating systems by using the cross-platform abilities of the JVM. Add to that the availability of Java programming skills.

The Maosco side says its Multos operating system replaces all others and is designed to be a universal OS similar to the way Dos was for desktop computers.

The problem with the Java option, Stevenson says, is the same problem faced with desktop or server use of Java ? slow performance.

?It?s an add-on and while the cards are smart they?re not that smart,? he says. ?Trying to get a 32-bit language (Java) onto an 8-bit operating system is a problem. The cards and their operating systems won?t be robust enough for two or three years.?

On the other hand, the problem with the Multos platform, according to Stevenson, is that it came out of the Mondex electronic cash initiative and is therefore perceived as a proprietary, niche operating system. It isn?t, because it?s owned by Maosco, but the problem Maosco faces in getting that message to the market is compounded by the fame and popularity of Java.

Stevenson believes Multos is really ?a very well-thought-out system?, and that there may be room for it to co-exist with the Java system.

?They?ll probably both win,? he says. Multos will win in the electronic cash market because of association with Mondex. Java will win because it has a big market in the US and because of its suitability to other applications beyond just ecash.

But the Java system isn?t about to surrender to Multos. Visa announced last week that its year-old Visa Cash programme is now the largest electronic purse programme in the UK.

Trialed in Leeds during the past year, it has about 60,000 electronic purse cards in circulation and 1,400 businesses accepting the cards.

Visa claims the new Java standard has now replaced ?90% of the world?s electronic purse schemes? and its Visa Cash programme is being expanded. Ken Bignall, managing director of Visa UK, says: ?The Leeds programme has shown that an electronic purse adds real convenience for cardholders.

?For example, Visa Cash transactions have already replaced cash by up to 10% in car parks and have also proved popular in fast food restaurants, sandwich shops and newsagents. We plan to extend our coverage in these areas as well as other everyday applications such as public transport.?

And, of course, virtually everyone in London who uses London Transport?s services will soon own at least one smart card.

LT recently awarded the TranSys consortium a #1 billion, 17-year contract to develop an integrated revenue collection service. The service will use smart cards in a large number of projects aimed at updating and operating LT?s ticketing services. The cards will be used to pay for services as well as be used as ?tickets? on the tube.

Perhaps Multos and Java can co-exist. Tim Jones, managing director of retail banking at NatWest and one of the inventors of Mondex, argues in a Killen & Associates study, Smart Card Opportunities for Phone Card Providers: ?Multos is the first high-security operating system for chips. Mondex is involved directly in the Java Card?s development.?

He argues that the Multos card has the advantage of also ?accepting a Java virtual machine and a Mondex Executable Language (Mel) virtual machine side by side in the OS to allow different applications to be ported onto that platform, some running Mel, some running Java?.

Banks are already pinning big hopes on smart cards. Co-operative Bank and Co-op Supermarkets are working on a plan to make the Independent Savings Accounts (ISA) scheme workable.

The government wants supermarkets to make ISAs accessible to the public, but many are complaining that ISA payments would increase the length of customer queues, already said to be too long in many shops.

They also say implementing the programme would be too expensive to process, but Mervyn Pedelty, chief executive of Co-op Bank, feels smart cards will eliminate those problems.

Then there?s the security aspect. Increasingly, smart cards are replacing paper-based security applications. This is due to their flexibility, functionality and alleged security. Fingerprint biometrics, pass phrases, user names, and other personal ID information can now all be contained on smart card ID cards.

Former paper-based applications like national ID cards, passports and health care records can all be transformed into smart cards.

Even proponents of smart cards, however, warn that regardless of how tamper-resistant smart cards are, ?there is no reason to be careless about fraudulent misuse?.

Smart cards are not tamper-proof. Ross Anderson and Marcus Kuhn, researchers at the computer laboratory at Cambridge University, warn that there are ?a number of attacks on such systems ? some old, some new, and some that are simply little-known outside the chip-testing community?.

They add: ?Even a device that was described by a government signals agency as ?the most secure processor generally available? turns out to be vulnerable. Designers of secure systems should consider the consequences with care.?

Newer smart card technologies, they conclude, ?are slightly harder to attack, but not much?.

Ross and Kuhn add: ?The marketing director of a smart card vendor claimed that there was simply no demand from their users for anything really sophisticated.?

Despite that, smart cards are the obvious storage medium for digital certificates and signatures, and could be the saviour of Visa and Mastercard?s jointly-developed secure electronic transactions (Set) technology. Set was developed to protect credit-card transactions on the web, but has met with little enthusiasm from banks or retailers because of its complexity.

Some banks who have trialled the system say one of the most taxing issues with Set is the installation of digital certificates on the home PC of every credit card holder. Visa and Mastercard hope that a smart card-compliant version of Set will overcome that problem, and rescue the technology from a total rejection by the market.

As Computing went to press, US reports claimed that Microsoft will launch a smart card operating system at Cartes 98. If it does, Sun and Maosco could be forgiven for delivering the standard public response to the arrival of new competition: ?We welcome it: It can only expand the market.?