Development Plans for the Deployment of Smartcards in the North East Region Conn Crawford (NERSC)

The Consortium Northumberland Durham Tees Valley Tyne & Wear All Local Authorities (26) in 4 Sub regions Major Transport Operators –Bus –Train –Metro Regional Development Agency Newcastle University Associates- other councils

NERSC Policy Deliver benefits to citizens and business through e- Services Develop the North East as a Community of Communities –Putting People first (citizen centric) –Intelligent/Secure Systems –Regional Infrastructure –Economic Prosperity –Social Inclusion Providing a Mechanism for Choice

Broad Ambition (in practical terms) A Regional Card Platform Roll out multifunctional cards throughout North East. –Transport –Local Government services –Electronic Purse –Incentive Schemes (links with retail) Within a framework –Promoting the Public Sector Brand –Offering 3 rd parties (commercial interests) an opportunity to add applications and share costs

NERSC activity to date.. Pathfinder and other pilots

Pilots across the region 30,000 cards Transport School Meals Leisure Reward/Incentives Authentication

Business Case Single applications rarely justify investment Token-based applications in the main justify low-end card types

Future strategy Objectives Regional card platform Next steps

Establish technical foundations to enable integration: –Government Cards e.g. Connexions –Other Transport Schemes –Tourism –Health and Other Public Services Deploying common standards for interoperability –Local –National –International Broad Ambitions - a platform for the future

Regional Stakeholder Forum NERSC Public Sector Interests Commercial Interests The Company App. owners Brand owner Responsible for a card with a target user population Control the plastic. Control the silicon. “Owns” a social or commercial business model. “Owns” a set of products, i.e.card transactions, data and revenues.

Regional Stakeholder Forum NERSC Public Sector Interests Commercial Interests The Company App. owners Brand owner Accepting Networks Issuing Network PE Card Manufacturers Transaction & settlement Bank Clearing & settlement User Support Services (hub) Master registers Trusted Services Provider Registration & Authentication Cards Equipment Software & Support Facilities & operation Commission a set of trusted core value chain support services Facilitate collective procurements on behalf the brand and application owners

An alternative to single procurement Quicker –develop projects rapidly –deployment of cards to more people in a shorter timescale More responsive –to changing requirements More cost-efficient –reducing the overhead that a full OJEC procurement would incur –aligning costs more closely with specific work packages. Lower risk –than agreeing contracts for a large regional scheme 6 months before deployment.

Master registers Trusted Services Provider Registration & Authentication Cards Clearing & settlement App. owners Brand owner Accepting Networks Issuing Network PE Card Manufacturers Transaction & settlement Bank User Support Services (hub) Standards – E-GIF / Lasseo GAF ITSO ISO PKcs#11 ITSO Liberty Allaince

Trust Service Components Authentication Framework Identity Services & The Citizen Account Public Key Infrastructure Permissioning & Access Control Messaging and Transport Layers Web Services

UK Government Authentication Framework The Office of the e-Envoy (UK Govt) defines four authentication levels for government transactions. These levels are: –Level 0:Informal transactions –Level 1: Personal transactions –Level 2: Transactions with financial or statutory consequences –Level 3: Transactions with substantial financial, statutory or safety consequences. Additionally, level three authentications require strong non-repudiation, since repudiation of the transaction might result in substantial financial loss to the relying party or a third party.

Card Specification

The individual will have an easy intuitive tool to: Manage personal information – Some of their information will be updateable direct, other information will be view only. Manage data consents - This allows the individual to control which agency is allowed to see and share what data about them. Explore - Full visibility of the audit trail of who has accessed their data, why and when. Help - Easy access to the support elements of the databank operator for queries and issues.

Contacts John Littleton – NERSC Chair Conn Crawford – this presentation