[NLnet Press] Dutch develop open source smart card for public transport

Thu Jun 19 14:53:25 CEST 2008

A Netherlands based university will be developing a next generation
privacy-enabled smart card for public transport on the basis of
open-source technology between now and early 2010. The cards will use
modern cryptographic techniques that will allow passengers to buy a
personalised card - with tailored discounts - without the need or risk
of having all ones travels unravelled. Radboud University in Nijmegen
has received a targeted research grant from the Dutch philanthropic
foundation NLnet.

Earlier this year a major smartcard system with similar goals in the
Netherlands was easily compromised by investigators, and earlier this
week these were able to repeat their findings with the Oyster card
scheme used in the UK. "With the failure of that first generation of
smart cards for public transport in the Netherlands and elsewhere a
huge disinvestment is looming," states Michiel Leenaars, strategy
director at NLnet foundation. "That cost or even the delay is just not
acceptable for societies that depends heavily on this critical
infrastructure".

Although this is in principle a commercial area with significant
revenue streams, the new initiative is funded by private charity money
in an effort to ensure that not only abuse is countered but also that
there are technical guarantees for maintaining the privacy of
passengers. "By putting the development in an open context and embed
privacy in the design phase - and not as an afterthought - we hope to
lay the foundations for a next-generation smart card for public
transport in the Netherlands and beyond that works and really is worth
the full confidence of consumers", says Leenaars. The public failure of
the previous initiative that took place in a closed environment meant
that the work needed to be redone in another way - and it proved the
point in case that the privacy side needed more attention as well.

The research at Radboud University Nijmegen will be carried out within
the Digital Security Group, headed by Prof. dr. Bart Jacobs and Dr.
Wouter Tepe. This academic group has made regular headlines across the
world in recent years when they revealed weaknesses in smart cards that
are at present widely used, allowing free travel and denial of service
attacks. In their research and experimental work the researchers aim to
see whether the proposed privacy techniques are actually suitable for
an efficient, robust and secure implementation of smart cards - usable
also in other classes of systems such as mobile phones or pocket
computers.

All developed software for the public transport smartcard v2.0 will be
"open source" and by principle will be accessible to everyone. This will
allow individuals, for example, to verify whether travel and personal
information are indeed adequately protected. Open source software is
not only increasingly becoming a development method of choice, not only
in government and the academic world but also elsewhere, having many
advantages over proprietary software (whose operation is secret).

- -----------

*** Note to editors

This press release is also available at:

http://nlnet.nl/press/20080619-ovcard.html
http://nlnet.nl/press/20080619-ovkaart.html (Nederlandse versie)

*** Media

Valer Mischenko
Director NLnet
+31 20 888 4252
v.mischenko @ nlnet.nl

Prof.. dr Bart Jacobs
Professor Radboud University
+31 24 3652236
bart at cs.ru.nl

*** Background information

The project of Radboud University and NLnet foundation works from the
view that full disclosure and an open process will significantly
contribute to the reliability, robustness and accountability of the
public infrastructure. Participation of additional parties in the
project is welcomed. The Radboud University of Nijmegen has submitted
the investigation into the newly established Scientific Forum OV-Smart
card, in which scientists from different universities are represented.

*** About NLnet Foundation

NLnet Foundation is a private charity fund supporting open standards
and open source worldwide, and has over the years actively contributed
to (internet) standards, open source projects and subsidiary or
enabling activities such as the development of GPLv3. NLnet foundation
is an independent organisation whose means came initially from interest
on a very substantial own capital formed in 1997 by the sale of the
first Dutch Internet Service Provider. Its private capital ensures an
absolute independent position. The articles of association for the
NLnet foundation state: "to promote the exchange of electronic
information and all that is related or beneficial to that purpose".
NLnet believes in open standards and open source. At the moment, dozens
of projects and organizations are supported financially. Amongst them:
research laboratory NLnet Labs, the Free Software Foundation,
OpenDoc Society, Intelligent Interactive Distributed Systems, and the
Internet Society.

More info: http://nlnet.nl

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (FreeBSD)

iEYEARECAAYFAkhaVrgACgkQPPKB2FVlk181OACeK9FQLfPnWio1UEQQ4AckP29z
sI8An3Y+JFboQ8NhsgaES6VboEMVqCBI
=46ZQ
-----END PGP SIGNATURE-----