CR80News Summer 2015 by AVISIAN

“I’m teaching a new course, traveling the world, writing a book and trying to stay in shape. Every morning when I swipe my ID card, I enter this building on a mission to help my students succeed.” — Neil G. Professor Risk Management

Every person in your program has multiple identities, and securing and protecting those identities is no small task. Datacard® ID solutions enhance learning environments by safeguarding students and staff — creating a strong sense of community with trusted, long-lasting, secure ID cards.

Visit Datacard.com/CR80 to learn more by downloading your free ID Solutions Guide.

DATACARD GROUP IS NOW ENTRUST DATACARD

Spend more time with students and less time with your card system.

Trusted professionals to manage your system

Fast and simple to deploy

Low start-up costs

Simplify the deployment and management of your campus credential solution. With a turn-key SaaS campus credential transaction solution from Blackboard Transact, rely on trusted professionals to manage your system, get up and running quickly, enjoy upfront and recurring cost savings, and spend more of your time doing what really countsâ&#x20AC;&#x201D;serving your students.

Find out how a SaaS deployment approach makes you more efficient and student-centric. Visit blackboard.com/transact/SaaSDeployment

CONTENTS

SPANISH UNIVERSITY EMBRACES SMART CARDS 34

CONTENTS 6 Editorial: Preferred names highlight true value of identification 8 ID Shorts News and posts from CR80News.com

28 Is library ID keeping up with times? Card security questionable as check-out extends to laptops, tablets

13 ISG dealer helps U. Wash add transit

30 From the Director’s chair: Campus card procurement must balance security and cost

14 What’s in a name? Campuses consider allowing students to choose preferred names on IDs

32 A case for contactless Northern Arizona upgrades campus card from prox

20 Getting a lift with the student ID Deciphering the challenges of transit on campus cards

34 A case study abroad: Spanish university embraces smart cards Cantabria uses contact and contactless tech to power host of ID apps

22 Bus’n it in Beantown 24 Campuses preparing for EMV acceptance Looming liability shift causes race to upgrade payment systems

INDEX OF ADVERTISERS

26 Defining EMV readiness

36 Helping schools prioritize security options Industry experts, vendors provide resource for K-12 implementations 38 Clemson secures cards with holograms

Blackboard

transact.blackboard.com/SaaSDeployment

IS LIBRARY ID KEEPING UP WITH TIMES?

39 CBORD www.cbord.com

11 ColorID www.ColorID.com

Entrust Datacard

www.datacard.com/CR80

7 Evolis www.evolis.com

25 Heartland www.1card.com

40 HID Global www.hidglobal.com/welcomed-cr80

Identification Systems Group

www.IdentificationSystemsGroup.com

19 MyPhoto www.studentidphoto.com

27 NACAS www.nacas.org/annualconference

23 NACCU www.naccu.org

SARGENT

www.personacampus.com

17 Wells Fargo www.wellsfargo.com

CR80News

Summer 2015

NAU UPGRADES CAMPUS CARD FROM PROX

Struggling with the transition to new credentials?

PERSONA Campus

Access Control Solutions

MAGRATION noun |mag•ration|

Easy, affordable migration from mag stripe cards to smart cards and mobile access With PERSONA Campus™ access control solutions, you can: – Support mag stripe and contactless credentials, as well as HID Mobile Access® powered by Seos® – Transition mixed credential populations to a single credential as budget allows – Build in the flexibility to support emerging technologies such as mobile access PERSONA Campus™ solutions combine advanced, flexible software with a variety of offline, Power over Ethernet (PoE) and WiFi locks for customized access control that integrates seamlessly with other campus systems. Learn how MAGRATION™ can help solve your campus security challenges: www.personacampus.com

Available from ASSA ABLOY Group brands: CORBIN RUSSWIN | SARGENT Scan this QR code using your mobile phone to learn more.

ABOUT

PERSPECTIVE

CR80News EXECUTIVE EDITOR & PUBLISHER Chris Corum, chris@AVISIAN.com EDITOR Zack Martin, zack@AVISIAN.com ASSOCIATE EDITOR Andrew Hudson, andrew@AVISIAN.com CONTRIBUTING EDITORS Liset Cruz, Autumn Cafiero Giusti, Gina Jordan ART DIRECTOR Ryan Kline ADVERTISING SALES Chris Corum, chris@AVISIAN.com Sales Department, advertise@AVISIAN.com

SUBSCRIPTIONS CR80News is free to qualified professionals in the U.S. For those who do not qualify for a free subscription, the annual rate is US$29 ($59 outside the U.S.). Visit http://store.avisian.com for subscription information. No subscription agency is authorized to solicit or take orders for subscriptions. Postmaster: Send address changes to AVISIAN Inc., 315 E. Georgia Street, Tallahassee, Florida 32301. ABOUT CR80News CR80News is published twice a year by AVISIAN Inc., 315 E. Georgia Street, Tallahassee, Florida 32301. Chris Corum, President and CEO. Circulation records are maintained at AVISIAN Inc., 315 E. Georgia Street, Tallahassee, Florida 32301. Copyright 2015 by AVISIAN Inc. All material contained herein is protected by copyright laws and owned by AVISIAN Inc. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopy, recording or any information storage and retrieval system, without written permission from the publisher. The inclusion or exclusion of any does not mean that the publisher advocates or rejects its use. While considerable care is taken in the production of this and all issues, no responsibility can be accepted for any errors or omissions, unsolicited manuscripts, photographs, artwork, etc. AVISIAN Inc. is not liable for the content or representations in submitted advertisements or for transcription or reproduction errors.

EDITORIAL ADVISORY BOARD Submissions for positions on our editorial advisory board will be accepted by email only. Please send your qualifications to info@ AVISIAN.com

CR80News

Summer 2015

Preferred names highlight true value of identification ANDREW HUDSON, ASSOCIATE EDITOR, AVISIAN PUBLICATIONS

We often talk about the value of the campus card, be it providing access to buildings, making payments or enabling admittance to the many on-campus services that make college life tick. The value that’s perhaps not talked about enough, however, is the social value that the credential holds and the subsequent affinity that students feel for the university that issues the card. I’m referring to a different kind of identification – not identification to, but identification with. I am the proud alum of two different universities, and despite my alumni status, I closely guard both IDs in my wallet. This holds true for millions – if not tens of millions – of college grads new and old alike. It exemplifies perhaps the greatest value that a campus card holds for students – a link to the institution they love. In this issue we explore the topic of preferred names on cards and in campus systems. It’s an emerging trend as students across the country are petitioning universities to acknowledge non-legal names, nicknames and other alternative designations on student IDs. While it poses new and unexpected challenges to campus card administrators, they’re challenges I believe should be embraced. Universities require students to present their IDs on and off campus and continually strive to increase the number and variety of events requiring ID presentation. Crucially, each time a student presents their campus card, they not only display a personal identity but an institutional affiliation as well. The LBGTQ community has, in part, led the preferred name charge, raising the question and starting a dialogue about the importance of identity. A university should not marginalize even one of its students, but the unfortunate truth is that members of our campus community have experienced, to varying degrees, relegation. Though it is certainly a small step, this subset of our campus population deserves to be as proud of their campus card as their majority peers. As I see it, these students have gone to the right place. Campus card administrators are answering the call and providing a great service. I’ve seen this to be true as a number of universities and card office managers are working to fix an issue that is perhaps peripheral to the masses but merits solving for the few. As more universities institute preferred name policies, the affinity that students hold for their cards – and the institution – is not just kept in tact, but strengthened. It’s a trend that is moving in a positive direction and reminds us of the true power of identification.

HOW DOES YOUR SCHOOL IDENTIFY ITS STUDENTS?

By providing student badges instantly with an Evolis card printer From basic identity data to the most advanced encoding features, student ID cards are an essential part to securing educational facilities today. Evolis printers together with cardPresso software offer an easy-to-use and powerful system.

www.evolis.com

ID SHORTS HIGHLIGHTS FROM THE WEB

UNIVERSITY OF ILLINOIS, TCF BANK TO PART WAYS For University of Illinois students, February marked the end of a banking partnership between their university and TCF Bank. According to a report by The Daily Illini, the decision to end the partnership means that there will no longer be a TCF Bank branch on Illinois’ campus or in the Champaign-Urbana area. TCF’s on-campus ATMs will remain operational until at least mid-May in an effort to ease the transition.

CR80News

Summer 2015

In addition to maintaining the ATMs and online access, students who hold accounts with TCF will otherwise not be affected. However, students who have their TCF Bank account attached to their i-card, the University of Illinois student ID, will no longer be able to use their student ID for debit functionality. Officials close to the i-card program insist that students will not be expected to close or switch bank accounts as a result of the contract ending. The only change is that students will be required to use a TCF-issued card rather than their university ID. The University of Illinois

i-card website says that the program is currently negotiating a contract with a new, unnamed provider.

STUDENT USES CAMPUS CARD TO EMBEZZLE FUNDS A 21-year old student at the University of Washington embezzled $32,000 from the university’s Office of Minority Affairs and Diversity over a three-year period. According to local CBS affiliate KIRO 7, University of Washington police investigators say the person in question was a work-study student who had been trained to make purchases and issue refunds on the department account. Part of the student’s job responsibilities included refunding other students for purchased course material that was no longer needed. According to the investigation the accused fraudster began refunding his own account rather than the department’s, placing small sums of money onto his Husky Card, the University of Washington’s student ID. Funds can be added to the student ID card online, and students routinely buy food and other items at campus facilities and some off-campus businesses near campus. The Husky Card can also be used at university bookstores, and according police, the suspect used these locations to purchase consumer electronics and resell the items online.

University officials say the system had only generated aggregate monthly reports, without identifying individual transactions. Now, however, the university has instituted an improved reporting system. According to police, the suspect made some 98 refund transactions over a threeyear period, with the largest amount coming in at $1,500.

COMICAL MAIL ERROR LEADS TO FAKE ID BUST A lesson for all Dean’s out there. Following a rather embarrassing case of mistaken identity, a group of Pennsylvania college students are now in hot water after trying to purchase fake IDs from a Chinese website. The fake IDs were discovered when a package delivery mistakenly arrived on the desk of a high-level college administrator, rather than the student who placed the order. The Delaware County Daily Times reports that a dean at a local college received a package that had been mistakenly delivered to him. The package was intended for a student with the first name Dean, but not realizing the mix-up, the university dean opened the package and found an empty picture frame.

CR80News

Summer 2015

When the dean turned the frame over, he found eight fake IDs hidden inside. One of the fake ID cards was printed with a student’s real name. Police spoke with the students involved and learned that they had used a Chinese website to purchase the phony state-issued driver licenses, which were shipped from the city of Guangzhou. Upon further investigation, it was discovered that website sells ID cards for any US state along with a host of other countries. The site enables users to input their birth dates, height, weight, eye and hair color. According to police, $250 will get a customer two fake IDs, while a group rate is applied to three people paying $450 for a total of six cards.

NEW FEATURES ON THE WAY FOR MYPHOTO MyPhoto enables students to upload and crop their own ID card photos from their desktop or mobile device, cutting time and cost from the card issuance process. A host of new features are helping to make the next version of the solution more robust. Last year, MyPhoto launched version 2.0 of its photo upload system, and as

company CEO Alan Jacubenta explains, it was a total recoding of the application. “We recognized that responsive design was the way to go to better address all of the mobile devices,” he says. 2015 will mark version 3.0 of the MyPhoto application. For starters, MyPhoto will enhance security. Jacubenta says he has added high level encryption to the data, its storage and transmission. “We have also added multiple levels of security within the application so the administrator can setup and manage sub admins with limited access,” he adds. Also new is integration with the federated identity solution, Shibboleth, which comes as a response to the growth of single sign-on. “With more universities using single sign-on, Shibboleth was a great addition to our initial integration with LDAP/ Active Directory that performs the authentication and provides the student information MyPhoto needs,” explains Jacubenta. Jacubenta and the MyPhoto team have also enhanced one of the solution’s most crucial existing features, the cropping tool. Feedback from a college in Ontario has led to a new French version of the application. Another key update to the offering is an entirely cloud-based version of MyPhoto. Up until this point, the solution has resided on campus. “We’re working on making the cloud version a fully featured offering, only we’ll host the application and push the necessary files out to the university according to the schedule they set,” he adds. MyPhoto already has one university that has agreed to adopt the cloud version and act as a beta test site for the new solution. “We hope to be rolling that out by June,” adds Jacubenta.

ID SHORTS

CBORD UNVEILS LATEST CS GOLD VERSION CBORD announced the release of CS Gold version 7, a solution used by colleges and universities around the world to power a range of student services including dining, payments, privileges and security. Version 7 marks a number of technology upgrades, in addition to new features designed to achieve operational efficiencies, improve student services and address the growing need to tie those services to student success. Some of these updates include: Residence hall visitor management: Improve security with a web-based

feature makes it easy for students to register guests in advance as well as for desk attendants to stay informed about guest statuses. Room reservations: Make campus special-use rooms – music practice rooms and meeting rooms – easier to reserve and accurately report on their usage. Students and other patrons can reserve rooms online and check in and out using online access readers. Business intelligence dashboard: Reduce complexity and get the information necessary to make informed decisions about student services and business operations. Automate access privileges: CS Gold

version 7 supports active directory (LDAP) integration for automated access assignments. This is designed to make it easy to assign access privileges based on information such as housing assignment and other tasks with no human intervention. Wireless Thermostat Control: Enable patrons to control and monitor their thermostats using a web app from a desktop or from any mobile device. CS Gold version 7 now supports Windows 2012 R2, Oracle 12c (now with Linux option), Microsoft clustering and Crystal 2013.

Summer 2015

CR80News

ID SHORTS

MONTCLAIR STATE REVIVES OFF-CAMPUS PROGRAM The closing of Sodexo subsidiary, OffCampus Solutions, in early 2014 wasn’t without its casualties. At one point, the company was servicing more than 60 universities and colleges, but following the closure most of Off-Campus Solutions’ campuses turned to their card vendors to take over operations. Montclair State is one of those universities. As of March 1 this year, Montclair State has reinstated its Red Hawk Dollars program to be accepted off-campus, enabling students to make purchases using their ID cards at local vendors and restaurants. As reported by the university’s student newspaper, The Montclarion, the revival was in fact the result of Off-Campus So-

lutions’ closing up shop – a move that ended Montclair’s off-campus program in June of 2014. University officials stress that the intention was never to shut the off-campus program down, but the sudden closing of Off-Campus Solutions left the university with little choice. The end of the old program was met with confusion and disappointment by students and local merchants alike. The answer to the problem came in the form of Blackboard’s BbOne off-campus offering. The new program has signed on 13 new vendors with ten more in the works. University officials say that the current roster of off-campus merchants already surpasses the 22 partners with the old program. Montclair’s goal is to have 30 active merchants by the end of the spring semester. The list currently includes Sandwich

MONTCLAIR’S GOAL IS TO HAVE 30 ACTIVE MERCHANTS BY THE END OF THE SPRING SEMESTER

CR80News

Summer 2015

Theory, CVS/Pharmacy, two local Applebee’s restaurants, a local steakhouse, and more. The university is also accepting student input for additional merchant locations.

MIAMI OPTS FOR BIRTH DATES ON STUDENT ID Future Miami University student IDs will be printed with student birth dates on the face of the card. University officials say the decision to include birth dates came, in part, from the work of the university’s alcohol task force and conversations with alcohol permit holders in the immediate campus area, according to a report from The Miami Student. In talking with these local merchants, the university decided that print-

ID SHORTS

ing birth dates on the Miami ID could be beneficial in identifying students’ true ages. Miami had printed birth dates on student IDs but removed them in the fall of 2011. Those close to the university’s card operations say that there wasn’t a specific reason to do away with birth dates in the first place, and the university sees merit in their inclusion on the campus card. The report also reveals that one Miami student – an employee at a local bar – says that Miami student IDs are sometimes accepted for access. In these situations, students can only use their student ID if they already have an “X” on their hand. At one local bar, the student ID will get students in the door. It can’t, however, be used by itself to gain entry to the exclusively 21 and over section of the bar. For that, students have to show both a valid state ID and a second form of identification. Per the report, students routinely use their university IDs as a second form for entry. As a result of the newly printed birth dates, local bars could see more students resorting to credit cards or other secondary forms of ID, as the campus card would clearly display legal age. Students who currently hold IDs without birth dates are not required to swap over to the new card, but any lost, stolen or damaged IDs will be replaced with the new version.

Explore online for up-to-the-minute news and insight on identity and security technologies for the campus and university market. Articles, podcasts and videos are added daily at CR80News.com

ISG dealer helps U. Wash add transit TOM STILES, EXECUTIVE DIRECTOR, IDENTIFICATION SYSTEMS GROUP

Identification Systems Group (ISG) is a professional association of independent identification and security solution dealers. The purpose is to partner dealers that cover every state in the US and most of Canada together with the top certified manufactures in key product categories. Manufacturers must meet a stringent list of criteria to be ISG Certified, ensuring that member dealers can provide essential support services in an ever-changing marketplace. Member expertise in the higher education market comes from continuing education and rigid certification programs. Unlike other suppliers we offer on-site consultation and service nationwide, thanks to ISG’s 200 plus sales representatives and 200 service technicians.

ISG MEMBER HELPS CAMPUS INTEGRATE TRANSIT The University of Washington wanted to integrate mass transit into the student ID card so that only one card was needed. The university also wanted to automate the process of tethering the transit authority’s unique smartcard number into each cardholder’s database record. Most universities would struggle to make this happen without assistance, and thus separate cards, stickers or other less than ideal methods are common. ISG, however, is uniquely placed to help campuses perform such integration projects. ISG dealer, Legend ID, provides secure identification, contactless smart card and security technologies in the Pacific Northwest. The University of Washington turned to Legend ID to provide a custom ID badging solution with smartcard integration to enable the transit card project.

The result was a single, multi-purpose ID card that can be used on campus in applications such as dining, housing, library and the mass transit system.

GETTING THE MOST FROM YOUR DEALER The typical ISG dealer is a local company in your community with an office building, employees and inventory. Rather than a simple transact model, an advantage to working with the ISG dealer is the ability to have in-person, on-site meetings. A face-to-face meeting to review your campus’ challenges and needs yields great results allowing a dealer to assure that all products work together to meet campus requirements. It is often important for the ISG representative to see current systems or problems in order to make good recommendations. Likewise, it is valuable for the customer to see live product demonstrations. A typical relationship with an ISG dealer allows you to call for information, ask them to look for something, or even request a general meeting to discuss market or technology trends. This type of relationship brings added benefits from quick delivery of cards or supplies if you are in a bind to rapid response to a pressing service call. ISG dealers offer products including cards, badging equipment, student tracking solutions, visitor management systems, physical and logical access control, integration and re-carding services, and of course local, on-site support. If you do not know your local ISG dealer, visit www.IdentificationSystemsGroup.com and enter your zip code in our ‘Find A Dealer’ tool.

Summer 2015

CR80News

What’s in a name?

Campuses consider allowing students to choose preferred names on IDs ANDREW HUDSON, ASSOCIATE EDITOR, AVISIAN PUBLICATIONS

The name on a campus ID card is vital. It’s a means to link a person to an identity and ensure that the credential is being used by the correct person and for the correct reasons. But an individual’s name has a deeper meaning that goes beyond simple identification. Our names represent us as individuals. Sometimes, however, our name doesn’t quite fit the identity we claim, be it marital changes, legal changes or as is often the case, for reasons that adhere to gender-related interests. Now, students on campuses across the country are petitioning their universities to consider enabling preferred names to be printed on campus cards. It’s a practice that has already been set in motion at a series of institutions – dating as far back as a 2009 project at the University of Vermont – and seems likely to expand.

HI, MY NAME IS… Before we dive in, let’s start by defining what a preferred name is, bearing in mind that this is still a working definition. Preferred names are monikers chosen by the student that more accurately represents the identity that they claim. This can be as simple as changing a first name to a commonly used nickname – Bill short for William or Joey instead of Joseph – or it can be something more elaborate that reflects marital status or incorporates gender.

CR80News

Summer 2015

Whatever the case may be, a name change presents a unique challenge when it comes to the campus card. It’s a challenge that Indiana University knows all too well, having recently instituted its preferred name program.

THE PROJECT AT INDIANA Central to the initiative at Indiana was a dialogue with the university’s LBGTQ campus organization. “Public conversation about the needs of the transgender community was the starting point,” says Jeff Vonderschmidt, manager of systems and development at Indiana University. “The initial project created the ability for faculty to see their students by preferred names within the university’s course management software. The scope widened from that initiative to include other departments.” Today, Indiana is not only allowing preferred names to appear on the campus card but also in the backend systems. “Only preferred names are in the actual card database, unless no preferred name has been designated, in which case systems reflect the legal name,” he explains. The preferred name program at Indiana isn’t a complete overhaul of the old system as it previously accounted for legal name changes and marital status changes. “Changes in the legal name aren’t processed any differently than before,”

says Vonderschmidt. “For example, if a cardholder gets married or divorced and wants their ID card to reflect their new surname, the procedure remains to change the name with the appropriate owner of name data – either the Registrar or Human Resources – then the change filters to the card system.” Now however employees and students can use a self-service web portal to change first and middle names. “Such changes are screened by the appropriate authority in each case before they are populated into university systems,” Vonderschmidt adds. Despite the acknowledgement of preferred names, there will still be scenarios in which a legal name is required. “Legal names are used in university databases where such use is required, for example health records, tax records and so forth,” says Vonderschmidt. Still, if a preferred name is designated, then most university systems at Indiana will only contain that name. Using a preferred name is entirely up to the individual. The caveat, however, is that if a preferred name is designated, then that’s how the student will be known, except in instances where legal names are mandatory, Vonderschmidt explains. “We’ve already seen instances where a preferred name was provided, but the individual did not intend for all the different systems to only recognize that choice. These individuals have subse-

T N E D U T S

9 8 7 6 5 123-4

N A H T JONA quently changed the preferred back to their legal name,” he says.

THE NUANCE OF IDENTITY When students are issued their first campus card or return to the card office to receive a replacement card, they provide their name as part of the card issuance process. It’s a routine practice, yet the need to properly vet a cardholder’s identity at issuance remains crucial. In certain preferred name cases, however, the identity vetting process can be a far more delicate matter. “In those instances where it is more difficult to determine if the individual at

our counter is the cardholder reflected in the database, we have been given access to a screen in PeopleSoft where both legal and preferred names are listed side-by-side,” explains Vonderschmidt. “The card office has not vacated responsibility for validating the identity of the individual obtaining an ID card,” he stresses. “Proper vetting of identity is maintained by comparing the legal name in the system against the supporting photo ID presented.” Still, there is a level of understanding, sensitivity and anonymity that must be observed – particularly in cases of gender-related name changes.

At Indiana, card office employees accomplish this using the dedicated screen with both legal and preferred names. “If an individual presents at our counter and there is a question regarding their identity, our staff have been trained to view both names, vet the identity, then address the cardholder by the preferred name,” he says. For other universities moving toward preferred names, this level of understanding and customer service on the part of card office staff will be crucial. As Vonderschmidt explains, the vetting process at Indiana was the result of a joint effort between the university and the campus LBGTQ group.

Summer 2015

CR80News

“LGBTQ services on campus were insure that data was made available to extremely accommodating, providthe units requiring it.” ing training to card office staff,” says University counsel, public safety, Vonderschmidt. Provost senior “We held a sesstaff, commusion where LGnications staff, Acceptable uses BTQ advocates Dean of Stuof preferred helped our staff dents, health names at Indiana understand services, and some of the the LGBTQ sup• A middle name instead of first name issues facing port offices also • An abbreviated name (Rob instead of the populaparticipated. Robert) • An Anglicized name (Wendy instead of tion. They proAs VonderHaiyan) vided invaluschmidt sees • A name to which you are in the process able insight into it, the program of legally changing how we might would have • A name that better represents your best achieve been nearly gender identity • A stage or performance name positive outimpossible to comes during implement, esinteractions pecially within at our service the timeline, counters.” without the collaboration demonstrated by these stakeholders. “I don’t believe MAKING IT WORK I’ve ever seen as swift an implementaFOR EVERYONE tion,” he adds. For universities in process or conThe worry for many administrators will sidering a preferred name program, likely be the difficulty in organizing and Vonderschmidt stresses the importance implementing a preferred name proof giving all stakeholders a seat at the gram that works for all stakeholders. table. “It would seem that inclusion of The good news, however, is that this as many stakeholders as possible, along isn’t an impossible feat. with active engagement from senior adAt Indiana, there was a comprehenministration, is crucial to a well thought sive planning process that took place out strategy and successful implementaprior to implementing the preferred tion,” he says. name program. This planning was made even more crucial given an aggressive NEW MEXICO JOINS timeline. THE TREND “From the highest levels of the university it was made clear that whatever Another institution that’s on the path to would be needed for this initiative to preferred names is the University New move forward, it was to be provided,” Mexico. An initiative at the institution says Vonderschmidt. “Initiating the prohopes to raise awareness of the preferred cess were the Registrars from the Indiana name topic and establish best practices University system of campuses who then for other projects. brought in the CIO of the university to

CR80News

Summer 2015

“UNM is looking at where names are used on campus and where we can offer members of the university community the option to use preferred name,” says Carolyn Hartley, manager of The University of New Mexico’s LoboCard Office. “We are in the process of working out the logistics now, with the goal of allowing maximum flexibility to students, staff and faculty, while maintaining the university’s integrity by providing oversight.” Hartley has been an active advocate for preferred names on campus cards, organizing a lively roundtable discussion at NACCU 2015 in New Orleans, championing an on-campus working group and more recently compiling an email listserv for universities to collaborate and engage on the topic. According to Hartley, there are a number of topics under discussion at New Mexico surrounding preferred names. In addition to discussing whether to allow both preferred first and last names, Hartley has also considered whether to require legal names to be printed on cards along with preferred names. “We’re also looking at how much oversight is required when allowing users to submit a preferred name to prevent inappropriate or offensive language, or for inappropriate purposes such as misrepresentation,” she adds. Hartley says the key will be to both maximize personal options and minimize administrative overhead, while providing enough oversight to preserve the university’s legal and academic integrity. At the University of New Mexico, parameters will be established to define appropriateness, reasons for name change and character length. “As long as the use of the preferred name is not for the purpose of misrepresentation, the university

Make the most of your Campus Card program

Count on choice and convenience when you add our banking services to your program With our program, you can:

Why choose Wells Fargo?

¡ Provide optional banking access with on and off campus convenience for your campus community ¡ Choose from card program options that work for your campus community’s needs ¡ Enhance financial education with access to online and mobile tools, plus onsite seminars on many topics

¡ Experience — 20 years of campus card experience ¡ Access — more than 12,500 ATMs and approximately 6,200 retail banking stores nationwide ¡ Customized marketing — highlighting your program’s benefits ¡ Dedicated support — local and national relationship management working with your team

To learn more about the Wells Fargo Campus Card℠ Program, please contact: Vernon Sloan — 704-427-6209 vernon.sloan@wellsfargo.com

Leti Turnbull-Mason — 415-547-3104 leticia.turnbull-mason@wellsfargo.com

acknowledges that a preferred name can and should be used where possible in the course of university business and education,” Hartley adds.

of other campus systems, including our carding software,” Hartley explains.

A SOFTWARE SOLUTION

As for Hartley’s championing of the preferred name issue, her efforts are certainly drawing attention to a growing issue in the campus card community. It’s an issue that, unfortunately, is partially the result of negative student experiences. “The working group was inspired by several truly negative situations experienced by transgender students within the classroom setting,” explains Hartley. “It went so far as one student being threatened with a charge of academic dishonesty.” As the manager for New Mexico’s LoboCard Office, Hartley was contacted regarding the issue and readily volunteered to be part of an on-campus working group. “The director of the LGBTQ Resource Center approached our Provost with the student narratives and he immediately supported the effort,” says Hartley. “The goal of the working group is to support the University’s ideals of inclusion and a respectful campus environment.” The working group is tasked with researching the issues and developing a plan. In addition to Hartley, it is made up of the University Registrar, the LGBTQ Resource Center Director, the LGBTQ Resource Center’s Trans-Inclusion Specialist, and the manager of the IT team that feeds Banner data to the university’s carding software.

Hartley is also looking into how much modification would be necessary within the institution’s Banner student information system to support preferred names. “We’re looking into whether we can encourage Ellucian (Banner developer) to make these changes part of a baseline offering delivered in the next Banner version,” says Hartley. She explains that the university’s card production system does enable employees to add a field for preferred name, and there are plans to create a badge layout for preferred names. “I’d like to see a process that sends records to the badging software, looks at the ‘preferred name’ field in Banner and if it’s null, assign the standard layout to the student’s record,” she says. “If it contains data, the preferred name layout will be assigned.” The solution that Hartley is alluding to would cut down on in-person conversation at the time of card issuance. “The whole point is not outing a student unnecessarily,” explains Hartley. “From the card office perspective, I’d like to see automation drive the process so that we don’t have a huge question and answer exchange at the service desk.” Though the University of New Mexico is still in the early stages, a vision for the process has already emerged. “Our intent is to collect the information centrally, probably via self-service Banner, review it for appropriateness, push the information into Banner, and have that information flow to a number

CR80News

Summer 2015

WHAT’S IN A NAME?

THE WAY FORWARD The preferred name issue runs far deeper than a simple moniker or namesake.

The name we use to identify ourselves includes the identity that we claim. The use of preferred names on campus cards is not a distant issue, but rather has already arrived. Hartley points out that preferred names have been a topic at a number of national conferences this year including NACCU, Ellucian, Illinois State Board of Education Special Ed Conference, American Association of Collegiate Registrars and Admissions Officers and more. With so many universities facing the issue, a viable, proven solution will be required to tackle the issue on a larger scale. The good news is that some pioneers are already paving the way for others to follow. “A number of universities have developed policy statements asserting their intention to honor preferred name as much as possible, and many of them have created manual processes to enable the use of preferred name in key systems such as email and the campus directory,” she explains. “Some have been able to integrate preferred names into their student information systems, and a few have even managed to automate it all the way through to their card systems.”

Want more info? Indiana and the University of New Mexico aren’t the only universities working with preferred names. For links to a series of documents, procedures and info from other universities, enter ”preferred name” in the search bar at CR80News.com.

show_ad_FP_051915-1:Layout 1

5/19/15

10:46 AM

Page 1

MyPhoto Web-Based Photo Upload Application Students and faculty can easily upload their ID photo. This streamlines the entire process which saves time and money. • MyPhoto completely automates ID card photo submission • Upload directly from a smartphone, tablet or PC • Easy to use, web-based administration – works with any card system • Decreases human intervention, increasing productivity • Saves time and money

MyPhoto A Subsidiary of Mango Bay Internet

Getting a lift with the student ID Deciphering the challenges of transit on campus cards Students at virtually every college campus need to access public transit to navigate the campus, its surrounding community or simply get to class on time. Knowing this, it seems logical that the campus ID that a student already carries also double as a transit ticket. The unfortunate reality, however, is that the integration of transit functionality on campus cards has been anything but straightforward. Despite the hits, industry representatives suggest there have been as many or more misses when it comes to finding a solution to the campus card transit integration.

SCOPING THE ISSUE There is no denying that the campus card has a long history in transportation. Almost from their inception, IDs have been flashed at bus drivers as students climbed aboard in cities across the country. At the onset of these programs, simple possession of the card was sufficient to get a ride. As costs and accountability concerns surfaced over time, stickers and other visual validation tools were incorporated. From there, the need for automated reporting and stronger validation drove the migration from visual inspection to card reading and database verification. Then, with the advent of cellular and wireless connectivity, transit authorities were able to take fare collection processes from end-of-day compilation to real-time authorization. For campus-operated transit systems or public transit systems offering unlimited ridership options for students, these solutions continue to function well. In many locations, however, it does not suffice. Metropolitan areas with large public transit systems rely on automated ticketing and fare collection systems to serve

CR80News

Summer 2015

millions of riders each day. These systems frequently use a fare card with a specific ID technology that powers the system and facilitates the payment. Over the past decade, contactless has emerged as the technology of choice in cities like Chicago, New York, Boston, Atlanta, San Francisco, Seattle, Las Vegas, Los Angeles…and the list goes on and on. Herein lie the opportunity and the challenge. Imagine a campus in a city with a contactless transit system that has recently implemented a contactless student ID card. Lets call it City U. City U’s president uses her transit card and is impressed with its ease and speed. She calls the campus card manager excited about the new contactless CityUCard. She has heard the prevailing mantra of ‘one card,’ and instructs the manager to ‘merge these cards.’ So begins an odyssey that could devour the next year of the manager’s life.

TICKET TO RIDE The ideal vision for student transit fare collection is to have it be an integrated part of the campus card that the students already carry. If done well, the inclusion of transit could be one of the most valuable services provided to students. “This integration benefits students in direct ways, and can benefit the transit authority by increasing ridership,” says Read Winkelman, vice president of sales at CBORD. “The university can benefit from a potential decrease in car traffic on or around their campus, as well.” Beyond the tangible benefits, Winkelman suggests that transit programs can also help to foster the university’s relationship with the local community. “In some communities, the increase in traffic associ-

ated with university students can be a sore spot with local residents,” he explains. Also at the heart of transit functionality is the added value it can provide for students both in terms of cost and convenience. “Transit on the campus card is a convenience to students, and it helps promote use of public transit over personal vehicles, which can reduce parking issues and carbon emissions,” says Fred Emery, director of OneCard sales at Heartland. Partnering with a local transit agency can also help defer the cost of cards for the university. “Costs can be shared for the cards which can help reduce campus supply costs,” he adds. The other notable benefit of transit on the campus card is that it eliminates the need for students to carry a second, transit-specific credential. “Can a student carry two cards? Yes, of course, but a combined credential allows them to more easily realize student transit discounts and the campus to better verify who receives those discounts based on current student status,” says Emery. Dan Gretz, senior director of product marketing at Blackboard, agrees that a single card benefits all parties. “Students enjoy the convenience; universities relieve the administrative burden of separately issuing transit passes; and transit agencies have third-party issued cards work in their system,” he explains.

MISSING THE BUS Though most agree it can be a great fit, the transit and campus card combination has proven a challenge. Technical, financial, logistical and political issues have all served to confound well-intentioned efforts. One of the larger issues universities may face when trying to implement transit is that the campus might be using a differ-

ent card technology than the local transit agency. “We have seen various transit companies use MIFARE or DESFire whereas a university may have iCLASS, prox or mag stripe,” says Emery. Another challenge universities face when integrating transit functionality is navigating relationships with outside stakeholders. “Partnerships with offcampus entities can be a challenge, particularly when you talk about large-scale projects that rely on public funding and the introduction of new technologies and processes,” explains Jeff Staples, vice president of market development at Blackboard Transact. “This is certainly the case with public transit, where the fare collection infrastructure refresh process can take years and cost many millions of dollars.” Not surprisingly, the fragmented nature of many transit systems makes it difficult to navigate. “Compounding the challenge even further is that transit projects often require multi-modal support – train, bus, etc. – and involve multiple jurisdictions in the decision making,” adds Staples. Returning to our City U example, lets say the campus implemented an iCLASS contactless card, but the public transit agency is using MIFARE. City U’s president has no way to know the difference. She only knows that the transit and campus cards are both contactless and expects progress. Moreover, our City U president will expect the card office manager to sway a single decision maker at a single transit agency. The reality may be, however, that dozens of decision makers across multiple transit entities – perhaps bus, train and light rail – would have to buy in.

RIGHT OF WAY Successful partnerships between a university and transit authority are often the result of careful, long-term planning. The caveat, however, is that there are often integration challenges and differences in card technologies that make transit partnerships a tall order.

“These partnerships aren’t relegated to just rail-oriented, mass transit agencies in major metropolitan areas,” explains Staples. “Smaller city bus system providers also have fare collection systems that may lend themselves to a greater partnership with the institution, beyond the reselling of passes on campus.” The primary challenge is the advanced planning necessary to have multiple applications on the same card. “In this case we’re really talking about a contactless card, where management of encryption

dards and close dialogue with a potential transit agency partner are key to making integration possible.” Coordinating the priorities, technologies, budgets and timelines of both the university and a potential transit body is somewhat like 3D chess, says Staples. “There are so many variables to solve for, not to mention the need for a level of dialogue that often transcends the norm.” Card technology aside, the look of the cards might present an issue as well. “If the transit pass uses visual authentication, the

IF THE CAMPUS HAS CHOSEN A NON-STANDARD CONTACTLESS TECHNOLOGY OR STILL RELIES ON MAGNETIC STRIPE, THEN THE GAP MAY SIMPLY BE TOO WIDE TO MAKE INTEGRATION POSSIBLE keys and allocation of space on the chip needs to be considered and planned for,” says Blackboard’s Gretz. Just like universities, transit bodies make technology choices, often invest heavily in that infrastructure, and ultimately live with those choices for some period of time. “If the campus has chosen a non-standard contactless technology or still relies on magnetic stripe, then the gap may simply be too wide to make integration possible,” explains Staples. “Adherence to ISO stan-

transit company may have specific requirements for the layout, which would require approval by the university,” CBORD’s Winkelman explains. “In geographies where multiple universities are capable of utilizing the same transit system, coordination of the technology or visual layout presents an even greater challenge.” But using a visual feature, such as a sticker or other secure identifier, can make this integration simpler. “When a simple visual identifier is used there seems to be

Summer 2015

CR80News

less of an issue launching a joint transit program since there is less project management involved,” says Heartland’s Emery. “And this can always be a first step to a more technical solution.”

LIGHT AT THE END OF THE TUNNEL Despite there being a number of universities that have experienced friction in their attempts to implement transit, it must be noted that there have been successes. The University of Victoria in British Columbia has fully integrated with the local transit agency, enabling students to use campus cards for fare collection. The solution was recognized by NACCU in 2013, receiving the organization’s Innovative Technology Award. Victoria’s partnership with its local transit authority dates back to the early 2000s when students enrolled in on-campus, forcredit courses could obtain a bus pass at a discounted rate as part of a system known as the U-PASS. At that point in time, the process relied on stickers applied to the student card to denote validation.

With the current solution, however, Victoria uses MIFARE contactless technology for the One Card system and a magnetic stripe for U-PASS integration. The information reflects students’ U-PASS eligibility status – active or inactive – as well as UPASS start and end dates. A self-service kiosk from Phoenix Kiosk enables students to insert their card, have the system check eligibility and encode the ID card with updated U-PASS information. Elsewhere, Western Washington University partnered with the Whatcom Transit Authority to provide students enrolled in six or more credit hours with a yearly bus pass. This program reflects the more traditional agreement where the university subsidizes transit access through a onetime fee included in the student’s tuition payments. Dubbed the Alternative Transportation Fee, the program at Western Washington was voted on and passed by students in 2007. Students taking six or more oncampus qualifying credits are assessed a mandatory Alternative Transportation Fee of $26.25 per quarter that is applied with other university fees and tuition. In paying the fee, students have access to the

Bus’n it in Beantown Despite the challenges that can befall a university trying to implement transit on its campus card, there have been success stories. The latest to make the integration work could be the University of Massachusetts Boston, where a combo MIFARE/iCLASS credential will be issued to students later this year. While the project remains in the pilot stages, the university is optimistic that it will be a hit, says Peter Bonitatibus, UMass Boston’s director of information systems and technology. “We’re in the testing phase now, but loading the card with funds has not been an issue,” says Bonitatibus, who has experience with the credentials first hand. “I have one of the cards and it works fine with the mass transit here in Boston.” The combo MIFARE and iCLASS card is proving to be an ideal solution. The campus wanted to use HID’s iCLASS contactless technology for physical access control, but the Massachusetts Bay Transit Authority’s uses MIFARE, explains Bonitatibus. “MIFARE ignores the iCLASS (signal) and vice versa, so there’s no conflict in the card,” he says. Also pivotal to the project at UMass Boston is the role of the university’s local transit authority. “Our transit authority is very cooperative,” says Bonitatibus. “We are set to go, and so far I have had no issues putting money on the card.”

CR80News

Summer 2015

Whatcom Transit Authority bus system for the full academic year. The bus passes are manually encoded onto the university’s Western ID card’s mag stripe, and must be re-encoded for each new academic year and summer session.

CLIMB ABOARD Transit integration on the campus card is anything but impossible, but some caveats remain. “Transit companies have often held fairly tight control over the credential technology used, and they have not always seen that integration with a campus card system as providing a boost in ridership,” says CBORD’s Winkelman. In an urban environment, the transit agency could have to integrate with numerous campus card systems to see real benefit, he adds. Where some have tried and failed in the past, others are now making inroads. Careful planning and open dialogue between all stakeholders will be key, and provided everyone at the table is willing to work through the logistical challenges, students may yet be able to hitch a ride. “There are quite a few cases where transit and the campus have figured this out. It primarily comes down to issuance of the credential,” says Gretz. “Campuses and transit agencies are both issuers of their own credentials. Moving to the multiapplication model, the transit systems in particular needs to be comfortable with their account information being securely stored on a card that is issued by someone else.” Transit integration strikes at the heart of what the university ID, specifically the idea of a ‘one card,’ is all about – the student experience. “This all goes back to the idea of enhancing the user experience,” says Blackboard’s Staples. “A successful program will be about more than just the difference between one or two cards, it will be about making it easy for the user to obtain, fund and use a credential that simply does more for them.”

Campuses preparing for EMV acceptance Looming liability shift causes race to upgrade payment systems ZACK MARTIN, EDITOR, AVISIAN PUBLICATIONS

As summer approaches, college campuses prep for and undertake many different projects while a segment of the students are back at home. General remodeling, upgrading computer systems and overall maintenance are just a few tasks that are easier to do when students are on break. This summer, many campuses will be spending time and money to upgrade their point-of-sale payment terminals to ensure they are compliant with new payment technology coming to the U.S. It is called EMV – short for Europay, MasterCard, Visa – and it is the smart card standard used by the majority of the industrialized world for payment cards. It started its global rollout region-by-region way back in the mid-1990s, and the U.S. is one the last markets to jump on board.

CR80News

Summer 2015

EMV payment cards traditionally have a contact chip, and when making a purchase the consumer inserts the card into a reader, enters a PIN and conducts the transaction. This will be different in the U.S., as consumers will insert their card and then sign to complete the transaction, rather than enter a PIN. A major security benefit is that EMV doesn’t transmit the payment card number as it is shown on the card, but instead creates a one-time number that is only usable for that specific transaction. If that transaction is intercepted, it cannot be reused and the card number is not compromised, reducing the chance of fraud. Additionally, the inclusion of the cryptographicallysecure chip makes it virtually impossible to clone or counterfeit ad EMV card.

WHY DO CAMPUSES NEED TO SWITCH? To begin, EMV only impacts those payment terminals that accept branded payment cards, specifically Visa, MasterCard, American Express and Discover. Universities only need to be concerned about terminals that accept these payment types and don’t have to worry about terminals that just accept campus cards. In many cases, however, terminals in food services, c-stores, bookstores and a host of other locations accept both branded cards and campus cards. These points-of-sale are where the challenges arise. Still, it is important to note that neither universities nor any other merchant are mandated to accept EMV payments. There

COST-EFFECTIVE CAMPUS CARD SOLUTION

one card

is, however, an October 2015 liability shift mandated by the payment brands that encourages this to happen. In the past, the merchant has been liable for the cost of fraud from payment cards, but the liability shift puts the onus on the party with the weaker technology – either the merchant or the card-issuing bank. For example, if a merchant has upgraded the point-of-sale terminal and backend system to accept EMV but the issuing bank has not provided an EMV card, the bank will be responsible for a fraudulent transaction. The opposite is also true. If a bank has issued an EMV card but the retailer has not upgraded systems, fraudulent transactions will be the responsibility of the merchant. Bringing this example closer to home, if a campus doesn’t upgrade its point-of-sale systems for EMV, the campus will be liable for the fraud that occurs. Campus card providers who also provide payment systems to their clients report that universities are taking the EMV

switch seriously. “We’ve been in discussions with our clients for the last year and many of them have been moving briskly to take care of the EMV obligations,” says Jeff Staples, vice president of market development at Blackboard Transact. The CBORD Group has also seen requests for new payment technology on campus, says Scott Jerabek, product manager at the company. “The demand is very high and a lot of campuses are moving at the same time,” he explains. While EMV is a priority on campus, CBORD is seeing more interest in pointto-point encryption, Jerabek says. Pointto-point encryption secures all the sensitive data from the swipe at the payment terminal all the way through the process and, he stresses, should be done before or concurrent with any move to EMV. “The EMV liability shift is looming and the gateway partners need to have point-topoint encryption solutions that are EMV ready,” he adds.

Access

Library & Book Store

Activities & Events

Dinning

I.D. Cards

Financial

Print & Copy Management

Parking

www.1card.com campussolutions@e-hps.com 1-800-486-4462

The vast majority of EMV ready solutions include point-to-point encryption, says Brian Hendrix, product manager at Sequoia Retail Systems. But campuses will want to make sure and ask the question. “EMV is about authenticating the person at the terminal, it has nothing to do with preventing a Target-like breach,” he says. To guard against this, he adds point-topoint encryption is key. Many campuses that have upgraded payment terminals in the past couple of years already have the hardware for EMV, Jerabek says. It’s a matter of making sure the gateway is prepared as well as making sure the software is capable of handling EMV transactions. “The software used on

the point-of-sale side might have to be upgraded,” Jerabek explains. “The software versions can range on campus, some stay up to date but some don’t.” Campuses can also be tricky in that the same terminals that accept payment cards are also used to run transactions for the campus ID, says Hendrix. Campuses need to take steps to make sure the new systems can handle both types of transactions. “We’ve seen campuses put new terminals in place and all of a sudden they can’t use their student cards,” he says. Universities need to work with the payment gateways to make sure those campus card transactions aren’t also processed by them. Gateways charge on a per transac-

Defining EMV readiness How retailers are preparing for the switch to EMV is a bit of a mixed bag. Campus payment providers say many campuses are busy making the move to accept chip cards for payments, but a survey of small businesses suggests retailers are unaware of the upcoming liability shift. Based on a poll from Newtek Business Services Corp of more than 990 respondents, 71% of business owners were not aware that by October of 2015, Visa and MasterCard would hold the merchant responsible for credit card fraud if they do not have an EMV compliant terminal. Additionally, 81% of business owners have not yet upgraded their terminals to be EMV ready. Overall, retailers fall into one of three categories, says Randy Vanderhoof, executive director of the Smart Card Alliance. First, you have those who know this has been in the works for a few years, have been making plans to upgrade their system, and will be fully operational by October. In the middle there are merchants who are aware of what’s coming but aren’t jumping to make changes, Vanderhoof says. They have begun the process but are moving deliberately and taking their time to make the switch sometime in 2016. “They don’t see a problem with fraud and don’t think they need to make the investment right now,” he adds. And in the last tier there are those who have no idea that the shift is coming, Vanderhoof says. “They either haven’t heard about EMV or they have no plans because they don’t see it as a priority,” he explains. The problem with these last two categories is that fraudsters might flock to them once they find out. Upgrading one point-of-sale terminal and the infrastructure costs between $250 and $500, Vanderhoof says. This could be a small price to pay. “Some small business will be shocked to see hundreds of thousands of dollars in fraud that they have never seen before,” he adds.

CR80News

Summer 2015

tion basis and costs will add up if campus ID purchases are counted, says John Diaz, vice president of business development at Sequoia Retail Systems. “You want to dig into the details of how you get that card number,” he explains. “You don’t want it leaving the campus.” In this situation, campus IDs are similar to closed-loop gift cards, says Randy Vanderhoof, executive director of the Smart Card Alliance. “Look at Subway, they work off a customized point-of-sale and they have a lot more work to do because of the way the payments are routed,” he explains. “They have customized settings in their terminal systems for handling closed loop cards as well as credit and debit cards.” Many gateways are still updating their software and some terminal manufacturers are also awaiting certification in preparation for the October liability shift, Hendrix says. “We’re still waiting for certification from the gateways and hardware manufacturers, some might not be ready for the October shift,” he explains. Making sure the hardware and software are EMV ready is paramount, but don’t skip the education, Hendrix says. “We tell the campuses that they have to train cashiers how the new transactions happen,” he adds. The mag stripe swipe won’t go away immediately, but they will be supplemented then eventually replaced with EMV. These transactions require consumers to leave their card in the terminal until the transaction is complete. “The cashiers have to understand that they’re not just dipping the card in the reader, but rather leaving it in there the entire time,” Hendrix explains. An unfortunate byproduct of this new workflow is that many cards are likely to be left behind in the readers. “Lost cards go up by an order of magnitude,” Hendrix explains. He cautions that some retailers have reported having drawers of leftbehind payment cards, but this seems a small price to pay to curb the counterfeiting of cards and reduce at least one major area of payment fraud.

NACAS 2015

SAN ANTONIO NOVEMBER 1 - 4, 2015

The conference for campus innovation.

• 80+ educational sessions covering all college auxiliaries: campus cards, dining, bookstores, parking, housing, printing, laundry, and more. • A Business Solutions Center with over 180 exhibiting business partners. • Discuss campus solutions in the new Business Connection Center. • Keynotes by world-renown speakers Tim Sanders and Alison Levine. • Play golf on the award-winning La Cantera Golf Course. • Explore the River Walk, just steps from the conference location.

Learn more and register at: nacas.org/annualconference

Is library ID keeping up with times? Card security questionable as check-out extends to laptops, tablets The library – a university service as old as academia itself – has long afforded students the ability to check out materials to be returned in a timely fashion. At least that’s traditionally been the idea. Over time, however, the resources students need to complete their coursework have evolved, and in many cases their value has skyrocketed. At Philadelphia’s Drexel University and other campus libraries across the country, students can check out expensive equipment such as laptops and tablets. With such valuable materials available, questions arise with the security of the patron ID process in the modern library.

CR80News

Summer 2015

To check out these coveted devices, are students required to do anything more than swipe a card or hold it under the red glow of a bar code scanner? A 2002 CR80News article on library patron ID explored how mag stripes seemed to be replacing bar codes as the gold standard for library identification. After nearly 15 years and the arrival of newer and more secure card technologies, it seems logical that things would once again have progressed. But are new technologies being used to drive credentials into library systems today? “Although a large portion of libraries continue to use the bar code to retrieve patron data for book check out, we are

seeing an increase in alternate technologies,” says Fred Emery, Heartland OneCard director of sales. Contactless is making inroads at the library, says Kent Pawlak, Blackboard Transact’s director of product strategy. “There are still many libraries that request bar code on a card, but that is decreasing as they accept contactless and other identity verification methods,” he adds. Still, bar codes are the tool of choice at the vast majority of libraries, says Grey Bartholomew, product manager for Odyssey PCS and Odyssey Direct at CBORD. “Anecdotally I would say 95-98% of our campuses are using bar code, 2-5% mag

stripe and virtually none are using prox or contactless.” Heartland’s Emery concurs, citing that about 85% of the company’s clients still use bar code, 10% use mag stripe and about 5% use some form of contactless technology. Bartholomew believes that it less about universities opting for bar code than simply going with what they know. “I would say that bar code has been the standard for so long that campuses – library management specifically – takes the path of least resistance and sticks with what they know,” he explains. “However, campus card professionals see the benefits of card technology standardization and are beginning to educate library managers on other options.” The example of checking out laptops and tablets is crucial to this education because it stresses the value of the materials that students have access to using their campus card. While a vast majority will utilize a service like this properly and return the gear, the worst-case scenario could paint a very different picture. Suppose a student decided to produce counterfeit cards with valid identification numbers and use them to check out and resell expensive equipment.

REIGN OF THE BAR CODE The long-standing king of library check out remains the bar code. But it is an inherently insecure technology designed to expedite data entry and reduce human data input errors. Common bar codes are based on standardized symbologies so there is nothing secret or obscure about library codes, nor are they difficult to reproduce. Much like type fonts, most bar code formats are available for download online. “Bar codes are primarily used to identify check-out materials, and as a result, every circulation station already has a bar code scanner,” says Pawlak. “The use of bar codes on cards at libraries has primarily been due to the simple fact that the reader was readily available.”

Over time, however, more libraries discovered that they could identify the patron in a different manner than the one they use identify books and materials. This realization, according to Pawlak, ushered in the acceptance of other card technologies. “One driving factor is security. Bar codes are readily duplicable, providing for higher risk of fraud,” explains Pawlak. Additionally, the need for a bar code is often outweighed by the valuable card real estate it requires and the few demands for it beyond the library. As for those valuable checkout materials, it seems that universities may be taking notice of the vulnerabilities of the bar code. “Quite often we see use of patron ID solutions other than the bar code – mag stripe or contactless – for check out of non-book items, such as laptops and AV equipment, particularly if the items are being managed in a system outside of the one used to check out books,” says Emery.

KEYBOARD-EMULATING READERS ENABLE MAG AND CONTACTLESS The use of a keyboard-emulating readers enable libraries to use magnetic stripe or contactless technology to push a patron ID number into an existing library check out system. In essence, these readers connect to the computer and mimic keystrokes. It enables data to be entered to a form or application field as if it were being physically typed at the keyboard. In a library checkout system, the application waits for a fixed-length patron ID number to be presented. Using keyboard-emulating readers, this data can be typed in or provided by a bar code reader, a mag stripe reader or a contactless card reader. For two decades, libraries have used mag stripe readers to eliminate bar codes. While it works fine, it provides little to no increase in security. This is because a mag stripe is arguably no more difficult to counterfeit than a bar code.

Contactless is another story, as it greatly ups the security ante. “Contactless keyboard-emulating readers enhance security and card utility without impacting the backend system,” explains Pawlak. While contactless is an ideal candidate in library ID, few universities have opted to go this route.

THE ROAD AHEAD While the immediate future likely won’t bring a tidal wave of change, there are certainly ways in which library patron ID can evolve. “During recent campus library visits, the use of automated checkout and return systems seems to be growing in popularity,” says Pawlak. “Return stations allow patrons to present the card and then scan or tap the book and place it in the automated return.” As these self-service solutions proliferate, the need for higher security from the patron ID grows. Contactless brings two benefits to solutions where staff is not involved. First, it is easy for the student or patron to present the card as the reader does not require a specific orientation or swipe. It can simply be held within range. More importantly, however, contactless is vastly more difficult to counterfeit. In traditional check out environments, library staff takes possession of and physically scans the ID card. This process entails at least a rudimentary visual inspection, and the photo must match the presenter. Even if staff is not vigorously validating the ID, this chance that it may occur is enough to ward off many would-be fraudsters. When the human factor is removed and self check out is used, only the identification technology and number need to be valid. A blank white card with a counterfeit bar code or mag strip could be passable. Perhaps this trend coupled with the need to protect the high value laptops and tablets that are offered by modern libraries, will drive the bar code off the card in favor of a more secure option.

Summer 2015

CR80News

FROM THE DIRECTOR’S CHAIR:

Campus card procurement must balance security and cost SCOTT KACHMARIK, DIRECTOR OF AUXILIARY SERVICES, UNIVERSITY OF NOTRE DAME

While it is easy for a campus card manager to insist upon the highest security cards and systems, the reality is that no campus can afford to max out every system across all auxiliaries. There is a balance that must occur when weighing system upgrades and investments, and card office managers are not always privy to these internal wranglings. On an almost daily basis, Auxiliary Services directors are faced with difficult choices on projects and purchasing decisions. Many focus solely on the bottom line; how much is this going to cost? Others think through the myriad factors and issues that impact the decision-making and understand the need to balance cost with desired outcomes. Moreover, decisions hinge on predicting the future and positioning the decision to anticipate the latest trends and enhancements. So while the price was right on a truck load of mimeograph machines (for those not old enough to know what a mimeograph machine is, ask your parents and prepare for a trip down grade school memory lane), looking back on that decision does not seem like a wise investment any longer! With the technology explosion of smart phones, mobile technology, electronic wallets and even smart watches, no industry is changing more rapidly – or unpredictably – than the campus card industry. Until recently, the campus ID card was simply your physical manifestation of having made it: you were now officially a member of alma mater. You proudly displayed it to family and friends during breaks and maybe on too-infrequent trips to the library. Of course, it was also carried because it was required by university policy on the oft chance encounter with a hall director or campus safety officer. In the end, it proclaimed your acceptance and official confirmation that you were a member of the community. But today, the campus card has become so much more. It is the key to experiencing campus. As campus card programs continue to evolve, one thing is certain – they will require greater flexibility. On many campuses the card program is viewed as a service solution center. Questions of “how can we do this better?” more often than not lead to conversations involving the campus card. Responding with recommendations that leverage the technology to meet the need is the

CR80News

Summer 2015

challenge, but it is also an opportunity to demonstrate the value of the card as a campus-wide asset. Nevertheless, with this convenience comes responsibility and questions of security and compliance. Identity theft, fraud and consumer rights are now part of regular discussions in campus card offices across the country. Increased government interest, regulation and oversight continue to shift the landscape of how campus card offices respond. No longer is it simply the role of the card office to prevent identity theft and fraud, but now to even detect it while it is happening. As the credential replaces cash, keys and even the card itself, the burden of safety, security, disclosure and compliance must be balanced with customer service. So when faced with the task of replacing campus card systems – hardware and software – it is important to evaluate your campus approach to finding that balance. As the saying goes, it is better to be on the cutting edge and not the “bleeding edge.” How many times have we made decisions that jumped to new, unproven and untested technology that simply was not yet ready? In order to begin the process, it is important to consider key questions. How secure is secure enough? Cutting edge technology can be expensive and sometimes overkill on what a campus might need to keep data and card holders safe and secure. Bar code, mag stripe, prox, contactless and biometrics are all options that work and should be considered for credential use. Determine the campus risk and exposure and fit your plans to match your security and compliance needs. Do your best to become educated on the strengths and weaknesses of each technology so you are able to communicate the differences to campus decision-makers.

DO NOT ASSUME PEOPLE UNDERSTAND THE VULNERABILITIES THAT EXIST WITH LESS SECURE – AND LESS EXPENSIVE – TECHNOLOGY AND BE PREPARED TO EXPLAIN THE TRADE-OFFS Do not assume people understand the vulnerabilities that exist with less secure – and less expensive – technology and be prepared to explain the trade-offs. How will the decisions you make impact the campus, and how will they impact other campus partners? While important to mediate the demand for high security and compliance with cost, it is necessary to also consider longstanding partnerships and impacts on existing systems. Be sure to invest the time to identify, understand and acknowledge the “downstream” implications of system and hardware changes. Know that includes campus units, off-campus merchants and even other local institutions that collaborate across campus boundaries.

In the end, changing a campus card system or technology to meet ever-changing security and compliance demands can be a quick and easy process that simply “locks” everything down and creates another silo. But the campus and campus card holders deserve better. Approach the decision-making process as the steward of a campus asset and promote the opportunities to partners who may not understand how they can benefit. Strategic leaders create a vision, partner with others, manage change, communicate, strive for success and celebrate achievement. Be the change necessary for your campus to provide a secure and compliant environment that balances cost and customer service.

Does your decision take into account the scalability of the technology so that it can grow to meet future needs and technology enhancements? Sometimes campus units operate in silos and get caught up in the trap of existing to serve their own needs. When making decisions to promote a campus one card program, it is imperative to have a campus-wide view that understands current practices, cultures and operations. Anticipating future needs and future enhancements creates strategic relationships rather than ones of convenience or tradition. How do you build relationships with campus partners to make this a campus decision and not just a card office decision? Changing a card system is easy; changing a culture to one accepting and embracing of a one card concept is difficult. Building relationships and preparing the campus for change will create buy-in that leads to successful outcomes and a safe, secure and compliant card environment that everyone understands and meets the needs of the entire campus.

Summer 2015

CR80News

A case for contactless Northern Arizona upgrades campus card from prox There are a number of reasons for a university to consider changing its campus card whether it’s new aesthetic designs, new card technologies or a current system simply reaching the end of its intended lifespan. Whatever the reason, however, when the decision involves a change of card technology, the contactless smart card always seems to be a topic of discussion. It’s a decision that many universities and colleges grapple with, weighing the pros and cons of a more robust card technology with the cost its implementation will require. For many universities, the jump to contactless comes down to three main considerations. “It’s stronger card technology with encryption to prevent counterfeiting, additional functionality, and future proofing the campus,” says Brett St. Pierre, director of education solutions at HID Global.

UNDERSTANDING THE DIFFERENCE Despite the more secure card technologies available to universities, many still rely on the so-called convenience technologies of mag stripe, bar code and prox. At its core, the 125 kHz prox card is created for the purpose of convenience. It’s great for providing a student quick access to an academic building, residence hall or rec center, but it’s doesn’t have the same security capabilities of a 13.56 MHz contactless card. “Proximity is a 30-year old technology that does not have security built into the communication,” says St. Pierre. Like bar codes and mag stripes, the lack of cryptographic capabilities leaves proximity cards susceptible to cloning and counterfeiting. Smart cards – both contact and contactless – contain integrated circuits or chips that virtually eliminate the potential for card cloning via cryptographic controls. “With contactless smart card technology, you get a hand shake that is much more secure,” explains St. Pierre. St. Pierre goes on to explain that contactless smart cards also provide the ability to store multiple identities or credential numbers. “Multiple identities can provide a university ID for use on campus, a medical center ID and third-party research labs,” he adds. This flexibility enables a campus to tether additional functionality to its credentials beyond just physical access. “With contactless smart cards, you open the door to many more uses on campus, including physical access control, payments, library, logical access, mobile and transit functionality just to name a few,” says St. Pierre.

CR80News

Summer 2015

In addition to the added functionality, the ability to add multiple applications helps an issuer to future proof the system. Building in flexibility to address unforeseen needs that may arise during the life of the program, provides peace of mind and improves the overall return on investment.

REMOVING VULNERABILITIES AT NORTHERN ARIZONA Northern Arizona University recently made the jump from prox cards to contactless smart cards. “As we became aware of vulnerabilities and limitations with proximity chip technology, we began to investigate options for a more secure and future-resistant technology,” says Joe Harting, systems administrator for campus services and activities at Northern Arizona University (NAU). Last year, Northern Arizona was the subject of an on-campus demonstration wherein the university’s then-prox credentials were shown to be vulnerable to counterfeiting. Harting says that he and the administration were aware of prox’s vulnerability to the “bump-and-clone” attack that made headlines, and that they had been making plans to migrate to contactless for some time. “Prox technology lends itself to cloning using inexpensive materials purchased on the Internet,” he says. To better paint the picture, the bump-and-clone attack goes something like this: Depending on the type of equipment used, a prox card can be read at varying distances, through wallets, purses, backpacks, etc. without the victim being aware their card was scanned. Once the prox data is read, it can be transferred to another prox card or prox-emulating device. As long as the data from the victim’s card is identical, there is no need to decipher anything, says Harting. “Once the raw data from a credential is presented to a prox reader, it will treat it the same, whether it is the original credential or a clone.” One of the security features of contactless smart cards prevents such attacks. By cryptographically challenging the card’s chip prior to any transaction, a reader can identify a cloned card and deny its attempted use. While NAU was already planning a jump to contactless cards, the demo on campus expedited the transition. “We had no instances of anyone experiencing any theft or unauthorized access as a result of the vulnerabilities with prox, but we believe in taking a proactive approach to overall campus safety,” says Harting.

THE TRANSITION Handling the transition from one card technology to another is a case-by-case consideration, as each university has to make a decision based on how it wants to impact the student, St. Pierre explains. As the name suggests, multi-technology readers can facilitate this transition, offering flexibility as the university navigates the issuance and re-carding process. These readers accept multiple card technologies – for example prox and contactless – to facilitate a transition over time. “Installing multi-technology readers gives existing students the ability to keep their current card until they graduate, but lets the institution provision contactless cards for incoming freshman,” says St. Pierre. On the other hand, all cards can be reissued in mass. “A rebadge is a quicker

transition, as everyone would receive the technology card in a short period of time,” explains St. Pierre. But it is often difficult to time such a transition in a campus environment. NAU had installed multi-technology readers from HID – called multiCLASS – across much of its campus prior to the changeover. “We chose the multiCLASS reader, along with a multi-technology card – mag stripe, prox and SEOS (contactless) – to allow for as smooth of a transition as possible,” explains Harting. “The flexibility meant that we could turn off the portion of the new readers that accepted prox, leaving only the contactless portion on.” Harting says that the university prioritized its facilities and performed a phased re-carding campaign accordingly. “Students living in residence halls were

Lessons from NAU’s migration Northern Arizona isn’t the first university to adopt contactless smart cards, and it won’t be the last. As other universities weigh up the pros and cons of this decision, it’s folks like Harting that will perhaps have the best advice. “The first thing is always safety. The commitment to safety that we have at NAU made it possible to access the necessary resources to change over,” says Harting. “An honest and comprehensive evaluation of the current systems must be presented to the administration in a concise and easy to understand manner.” From there, Harting stresses careful planning and coordination with other stakeholders as key to a successful transition. “Make sure everybody who could be affected by the change is communicated with and brought to the table,” he says. Once all stakeholders are at the table, it’s time to do some homework. For NAU, ListServ email groups and organizations like HELUG, the Higher Education Lenel User Group, were invaluable resources. “Speak with vendors and peer institutions to learn as much as possible about the potential impacts of the change,” adds Harting. Still he cautions to make your own decisions. “Giving too much credence to a technology because other institutions are using it is a good way to fall into the obsolete technology trap,” he stresses. “Vendors can be very helpful, too, but avoid relying on them as your sole source of information.”

among the first re-carded, and as soon as we verified that all that needed access to a facility were re-carded, we switched those readers to only accept SEOS.” The cards are just being used for physical access for now, Harting says. “In the future we will consider other functions such as attendance, event access and retail transactions,” he adds.

WHAT WILL IT COST ME? Simply put, re-carding an entire campus population is an expensive venture, but as St. Pierre explains, contactless smart cards have come down in price and are comparable to their proximity counterparts. The overall cost of the credential was roughly 25% higher than what NAU had paid for prox, and the readers were comparably priced to readers we had in the field, says Harting. “One of the major cost considerations, aside from having to recard our campus and trade out our readers, was the rest of our infrastructure – system controller boards, software, wiring and so on. That did not have to change at all,” he says. While Harting admits that cost is always a consideration, there were other considerations that went into the decision at NAU. “The first was the degree of security provided compared to other credential technologies, and we also considered how we would best leverage our investment for long-term usability,” he explains. Preparation and advanced planning will be key for universities contemplating a migration. “It is extremely important to start thinking about and deploying ways to migrate,” says St. Pierre. “When or if an incident happens, it’s much better for if there is already a working plan in place.”

Summer 2015

CR80News

A CASE STUDY ABROAD:

Spanish university embraces smart cards

Cantabria uses contact and contactless tech to power host of ID apps The conversation surrounding smart cards on campus is one that is met with reticence by some, but the reality is that universities in other countries have been leveraging smart cards for decades. It’s rare to see these programs in action, though, as the divide between both smart card opinion and geographical distance is often too great. In an effort to better understand how universities abroad are handling the campus card, the University of Cantabria, in Santander, Spain, shared its story.

MADE IN SANTANDER The University of Cantabria is one of the most advanced smart card implementations in higher education, using both contact and contactless technology to facilitate virtually every campus card service. Founded in 1972, the university is located in Santander, Spain, and has been a 15-year flagship for Santander Bank. Together they have built a campus card scheme used by universities across the continent and the globe.

CR80News

Summer 2015

The university maintains two campuses with more than 13,000 students and 1,400 faculty and staff – each outfitted with a university smart card. Sharing a city with Santander Bank has had its advantages for Cantabria, and the university has provided the ideal proving ground for the bank’s higher ed division, Santander Universities. “Cantabria has been critical to Santander Universities because everything started there,” says Vicente Prior, director of products and channels at Santander Universities. “Cantabria is where we had our very first agreement with a university, including academic, financial and technological collaboration with the smart card.” Santander Universities issues smart cards to 302 universities in 12 countries, according to Prior. The program is supported by five university research centers, the first of which was established in Cantabria in 2000. “Cantabria played a key role in communicating our collaboration to other universities, first in Spain and later in Portugal, the UK, Latin America, the U.S. and China,” says Prior.

CANTABRIA’S CASE Smart card services include access control, library patron ID, discounts at shops and, optionally debit, explains Prior. “Over time, universities have the choice to incorporate value-added services, such as digital signature and payments at public transit, or even use our university mobile app,” he adds. European countries have been working with smart cards for nearly three decades. In fact, Cantabria has never used magnetic stripe, implementing chip cards as far back as 1995. “The smart card better suits our requirements for secure offline and online services,” says Jorge Lanza, assistant professor and director of the University Smart Card Technological Research Centre at University of Cantabria. “We have Java Card, contactless MIFARE classic and at the same time DESFire,” explains Lanza. “It’s three technologies within the same card.” Lanza hails the university for practicing a “do it yourself” method of deployment, rather than relying solely on external solutions. “We require open interfaces in order to be able to fine tune the services we provide so we can learn, implement, test and deploy them ourselves,” he adds. The services supported by Cantabria’s smart card include library, access control, mobile apps, debit, ePurse (declining balance), print/copy, public transit, PC desktop login, online authentication and digital signature. These services are available using both contact and contactless technology. Added value for students also comes in the form of EMV compatibility, which makes the Cantabria smart card a viable solution for both on and off-campus transactions. The university and the city of Santander’s public transit body use the same con-

Cantabria’s smart card facilitates a full range of on- and off-campus services, with both contact and contactless options for all of the above functions.

tactless technology, so using the student card for transit access is another popular option.

WHAT’S NEXT? For a university that is already working with an advanced smart card system, it’s hard to posit what the next step could be. As with other universities, however, Cantabria has its eye on the mobile device. The ball is already rolling on the mobile front, as Cantabria maintains a campus mobile app that integrates a number of student services including: Student grades ePurse balance and transactions Library loans Real-time parking data Sport facility information Promotions and discounts The idea of a mobile credential is also in the cards for Cantabria, and Lanza is keen to leverage another of the smart card’s capabilities to add the service. “Our smart card is completely NFC compatible so that we can also use it in combination with our mobile phones,” says Lanza, adding that

physical access via a mobile device is close at hand for the university.

A NEW KIND OF CO-OP The idea behind Santander Universities is to promote the idea of a cooperative network between their campus clients. “The university decides what services are put in place, as the university smart card is their campus ID,” says Prior. “The role of the bank, as an outsourcer and partner, is to help the university enlarge the possibilities of services that can be added and help to implement them.” “Now, getting the full set of services takes much less time – often less than 12 months – for a new university than it did for Cantabria, which has been a pioneer over the 20 years that we have been issuing their card,” adds Prior. The work being done at Cantabria serves as a beacon for others in the Santander network … and vice versa. The ultimate goal is to enhance each university’s smart card ecosystem, based on the shared experience of the entire network. Santander Universities is a global system, says Lanza. “As a member of that system, your problem is also theirs.”

Summer 2015

CR80News

Helping schools prioritize security options Industry experts, vendors provide resource for K-12 implementations Security is arguably the most important service that a institution can provide for its students. There is a plethora of ways in which educational institutions can address security, but for the K-12 space in particular, implementing proper measures can be a daunting and confusing task. The Security Industry Association (SIA) and the National Systems Contractors Association (NSCA) know this all too well, and with the help of a host of industry stakeholders, have devised a way for schools to access the information they need to implement effective campus security measures.

THE FOUNDATIONS OF PASS In 2013, SIA launched a working group to identify ways to enhance school security. The following year, they partnered with NSCA to bring together members of the security industry, school officials and law enforcement. The goal was to develop a coordinated approach to protect K-12 students and educators.

CR80News

Summer 2015

This collaboration formed the Partner Alliance for Safer Schools (PASS) to provide insight and perspective to schools nationwide. The PASS goal is to create resources to help integrators and schools alike to implement the most appropriate and effective security technologies. PASS’ steering committee members have played a pivotal role in the planning and drafting of the K-12 safety guidelines document. Additionally, the committee draws from a wealth of industry knowledge and experience. “On the larger committee we have 25 people ranging from manufacturing personnel, system integrators, consultants, law enforcement, end users and organizations like Safe and Sound,” says Brett St. Pierre, HID Global’s director of education solutions and PASS chairman. Safe and Sound is a non-profit founded by parents, educators and community members in the wake of the Sandy Hook school shooting in Newtown, Connecticut. The organization’s founder, Michelle Gay is working with PASS to help spread the word.

A SECURITY CHEAT SHEET At the heart of the PASS initiative is a reality that schools across the country have to grapple with; school officials are rarely experts in physical security. With this in mind, PASS is looking to bridge that gap. Specifically, school administrators must answer two basic questions when planning to implement security systems: What should we do? And how do we pay for it? With this in mind, PASS has developed a document entitled, Safety and Security Guidelines for K-12 Schools. Through these guidelines, PASS will focus on addressing both ongoing and emerging threats to students and educators and will provide education regarding security and life safety best practices. The organization will also offer guidance to educators and security professionals en route to identifying the following: Guidelines and standards Best practices for security technology applications Technological advances Skills building opportunities

Solutions to funding challenges. “A lot of schools have little funding and lack knowledge of the tech out there,” says HID’s St. Pierre. “There are facilities employees that have been managing metal keys all their lives. This gives schools additional guidelines to help with things like that.” The resources provided by PASS seek to help school officials navigate the challenges associated with security equipment and processes. Developed by experts in the security industry, with extensive input from school officials and law enforcement, the guidelines: Analyze school security threats, including the numerous dangers that do not involve – and are far more common than – an active shooter Outline the legal, moral and other arguments for making investments in security Examine the nature of risk, risk assessment and risk mitigation Explain the importance of having “layers” of security Offer a unique set of guidelines containing specific recommendations for enhancing school security.

A TIERED APPROACH PASS tackles the process of security from multiple angles, forming a tiered approach to implementation. The group’s recommendations follow the practice of implementing security in depth, laying out solutions for property perimeters, parking lots, building perimeters, classrooms, visitor control, video surveillance and emergency notification. Within each layer of security the recommendations are divided into Tiers, progressing from Tier 1, which provides a good baseline level of security, to Tier 4 that includes the most aggressive measures for securing a facility. The reality is that many schools won’t be able to implement Tier 4 measures, nor will many have the need to do so. The purpose of the Tiers is to provide school administrators with the necessary tools to

gauge their risk level, security needs, and using their available resources, develop a security plan tailored to their school. One of the primary authors of the K-12 guidelines is Jim Crumbley president and CEO of Risk Response Team and PASS vice chairman. He sees the tiered structure as a means to create a more personalized security assessment for schools. “As a consultant, it’s important to understand the culture of the organization as well as the risks that it faces, mitigate those risks and match a solution to the available funding and budget,” he explains. Crumbley stresses that security systems must do more than cover liability alone. “Setting the bar higher than the organization is able to achieve is not doing anyone any favors,” he says. Suggesting a comprehensive access control system for a school that may not be able to afford one isn’t an effective approach. Instead, Crumbley says that a school must look at what it can do today. From there, it can present facts to its school board to lay a framework for further improvements going forward. “It gives schools a phased option for securing a facility,” he says. Crumbley often sees people emphasize the catastrophic events to gain traction for funding, but he says over time that traction can be lost. A better way would be to build a case study to show where a school actually stands on daily incidents – crime, violence in the area, car break-ins, vandalism, fights, drug or gang activity, and so on. Crumbley warns against making emotional decisions based on active shooter scenarios. “Schools will install bulletproof glass at the front door but won’t have cameras installed yet,” he says. “There has to be a baseline system in place first.” Crumbley explains that the tiered structure is designed to enable a school to move between the various levels over time as budgets allow for improvements or as needs change. “It’s vital to work with local authorities to determine a school’s risk and how to move up the tier continuum,” he says. The tiers aren’t reserved for particular types of schools, rather the tiers are de-

signed to be navigated over time. “While a Tier 4 could be difficult on the funding side, and higher Tiers may be difficult for a school to support, you could start out at a Tier 1 and upgrade to higher tiers over time,” Crumbley explains.

A HELPING HAND For K-12 schools, security measures will be subject to budgets, and unless a school has unlimited resources, difficult decisions regarding how best to secure a campus and its students must be made. The guidelines identified in PASS’ document are not intended to provide solutions for every risk and every situation, nor will it make any product-specific recommendations. The document does, however, highlight the need for administrators and public safety officials to work together, using the guidelines as a basis to assess needs and develop a risk management strategy unique to each school. “The optimal goal is to make this a code where a school can say ‘I want a Tier 1 system,’ and the guidelines would give them the proper recommendations for that,” explains St. Pierre. “We want to help schools identify what tier they want to be at and give them specifics to make that a reality.” SIA and NCSA stress that the ideas and recommendations detailed in the PASS guide are meant to be “living.” That is, when new risks and new approaches are identified – technical or operational – PASS will update the Tiers and general recommendations accordingly. Physical security and campus safety make up the primary concern for parents and educators alike. Despite the undeniable need for such measures on campus, however, the process of implementing proper safety and security is a daunting one. By providing school administrators with the valuable insight they need to make educated decisions, the process can be a more manageable one. Additional information about PASS and the K-12 guidelines can be found at www.passk12.org.

Summer 2015

CR80News

Clemson secures cards with holograms When it comes to card security elements, the campus card tends to take a more reserved approach than its state or federal-issued counterparts. Few campus cards incorporate holograms, sophisticated laminates or other visual security features. And yet, a university has several options when it comes to adding a hologram to its ID. While these features may not yet be commonplace in the university setting, their addition can create a more secure credential that better stands up to fraud and counterfeiting attempts. One option is to add the hologram to the cardstock itself via surface foil stamping. Another option is to embed the hologram into the cardstock’s clear overlay. Finally, a hologram can be added during desktop personalization – in the overlaminate with dye-sublimation printers or transfer film with retransfer printers. I know what you’re thinking. What’s it going to cost me? The addition of a hologram to cards or overlays could add anywhere from an extra 20-75 cents per card, says Mark Degan, corporate marketing manager at ColorID. Cost also increases depending on the sophistication of design. If a university wanted their own custom hologram, Degan says the supplies would cost 10-20% more per roll and would include an origination fee for registering the hologram design. There could also be an order minimum attached to these credentials. In order to justify the additional cost of holograms and other card design features, it’s vital to first understand what it is you’re paying for.

LAYERED SECURITY There’s a reason that holographic elements appear on secure, official identity documents. Simply put, advanced graphic elements make it more difficult to counterfeit. “Holograms are an excellent deterrent to fraud and replication,” says Degan. “More times than not, forgers don’t try to duplicate the exact design of a card, but a similar looking layout instead, as holographic elements make exact replication virtually impossible.” Degan explains that add-ons like UV ink, custom overlay patterns and foil stamps can all be replicated to fool an untrained eye. “True holograms that feature guilloche patterns, micro-text, 2D features and nano-text are nearly impossible to duplicate,” he adds.

CR80News

Summer 2015

In Degan’s experience, most universities don’t opt to add holograms or advanced security features to their current campus cards. “But each year we do have more and more universities add the security component after understanding the benefits these elements can add to their the cards,” he adds. “Any institution can easily take their existing campus card and add a secure hologram to it for minimal cost per unit and next to zero changes to the infrastructure,” says Degan. “It can provide peace of mind that your cardstock can’t be duplicated.”

THE CLEMSON CASE Clemson University has employed holograms on its campus card to great effect. The Tiger OneCard features Datacard’s Duragard OptiExpress 0.6 mil Custom Laminate along with a registered security design specific to Clemson’s brand. Steve Robbins, associate vice president of student affairs at Clemson explains that the university initially considered a clear over laminate as part of its campus identity management and re-carding initiative in 2012. Since a new card design was being implemented, however, it was decided that it would also be a good time to add more security by selecting a custom laminate. “The idea of a hologram and custom laminate was thought of as a way to make counterfeiting the card more difficult but there was also an element of branding that would make the card unique and stand out,” says Robbins. “The biggest benefit other than the protection offered by a laminate is the unique design that is a deterrent to duplicating the card.” While the implementation of a custom, registered hologram is the pricier route, Robbins insists that the cost to Clemson’s card issuance process was nominal. “The cost was very reasonable considering the additional security it provided to deter fraudulent duplications and counterfeiting. Also, it really promotes the university brand and image,” he says. “We make about 10,000 cards per year, so based on current pricing we are spending less than $4000 for the custom laminate.” Robbins and the folks at Clemson implemented the hologram to great success , perhaps making a case for others to follow. “It makes our card more secure and aligns with our campus wide identity management initiative,” he says.

Text it. Tap it. Launch it.

OMG.

Take your campus card program mobile with CBORD®. • Access • Spending • Online Ordering • Account Management • Attendance Monitoring • And More!

CBORD 61 Brown Road Ithaca, NY 14850 607.257.2410 www.cbord.com

Make sure every visitor is a welcomed one.

HID Global Secure Visitor Management solutions track your guests and protect your facility. Upgrade from unsecured paper guest books to the robust security of our EasyLobby® Secure Visitor Management solution. With EasyLobby, you can identify who is in your facility and why, control access to secured areas, screen against unwanted guests and more. Just scan each visitor’s ID and print a customized badge in seconds. And it’s scalable, so you’ll get the protection you need as your company grows. Request a free web demo at hidglobal.com/welcomed-cr80 © 2014 HID Global Corporation/ASSA ABLOY AB. All rights reserved. HID, HID Global, the HID Blue Brick logo, the Chain Design, and EasyLobby are trademarks or registered trademarks of HID Global or its licensor(s)/supplier(s) in the US and other countries and may not be used without permission.