Too smart for their own good! Academia once predicted the smart card would take campus services into the next millennium. Now it has virtually disappeared--or has it?

The year 1998 was a watershed for the University of Kansas. Endowments were soaring, enrollment was up, and spirits were high on the school's main campus in Lawrenceville. What's more, after a year-long search for new, cutting-edge functionality to incorporate into the campus card, Campus Services officials were kicking off the school year with a product from the tiny start-up vendor Cybermark. The "KU Card," as it was dubbed, was embedded with a microchip as well as the traditional magnetic stripe, and it offered functionality far superior to anything school administrators had seen before. They called it the "smart card," and the name said it all.

It was only natural, then, that when KU rolled out the new card that November, Program Director Nancy Miles could hardly contain her excitement. To friends, she promised the cards would enable users to ride campus buses, make purchases from vending and photocopy machines, and use washers and dryers in the residence halls. In a semi-annual newsletter to parents and alumni, Mires said the card also would be used to check out library materials and make long-distance calls. She even pronounced the school's other cards "dead," and termed them relics of a simpler, archaic time.

"When we went live with the program, I honestly thought we were at the forefront of a technology that would completely revolutionize the face of campus card services forever," Mires says now, looking back. "I was convinced: Smart cards were it."

The euphoria was short-lived, however. Although within the first year Cybermark set up systems that enabled students to use the new cards for laundry, photocopies, and vending, beyond that the vendor did little to help the Campus Services office to incorporate the product into everyday campus life, says Miles. Then, in 2000, a pilot program incorporating the technology into campus transportation failed miserably. The following year, KU officials tried to work with Cybermark to position the card at the center of a new campus authentication application. Again, failure. Finally, in June 2003, Miles got word that Cybermark was going out of business (see "Can't Keep a Good Man Down," page 60). Instead of sticking with an orphaned technology, school officials moved to a less sophisticated, less expensive magnetic-stripe card program. The smart chip experiment was over.

The tale of KU's failed foray into smart cards is not an isolated incident. Citing astronomic implementation lees and the failure of vendors (such as Cybermark) to deliver functionality promised, dozens of schools reported trashing smart card programs. In fact, of the 50 or so schools that implemented smart cards between 1997 and 2002, only a handful still use them, and only a handful of those are actually taking advantage of some of the enhanced capabilities the technology provides. No one has questioned the superiority of the smart chip technology itself, but according to Randy Vanderhoof, executive director of the industry-sponsored Smart Card Alliance (www.smartcardalliance.org), the smart card whirlwind that dazzled academia and swept Nancy Mires into its eye may in fact have been a fad before its time--albeit a fad whose time may come again.

"It's clear now that academia--as well as private business here in the U.S.--was simply not ready for transitioning to a smart card infrastructure in the late 1990s," says Vanderhoof. "But I'd say the technology is too useful to see a situation down the road that doesn't involve smart cards in some way of another."

What Went Wrong?

On paper, as Miles can attest, the premise of smart cards seems unbeatable. The cards come with microchips that feature varying amounts of memory ranging from four megabytes all the way up to 32 MB. The memory is divided into packets, or "purses," and each purse can be programmed to serve a different purpose. The cards require special smart card readers to work, and once users insert them into these readers, the readers capture and store information pertinent to the transaction in question. If, for instance, a student has $50 saved in the vending purse of her smart card and she wants to purchase a soda, she inserts the card into the vending machine and the reader identifies how much money exists in her account, deducts the price of a soda, and returns the card.

Batch processing hold-up. But here's where the technology gets complicated: Though the student thinks she's just paid for her can of Coke, technically, the price of that soda is not deducted from the student's bank account right away. While magnetic stripe technology is able to process and record transactions instantaneously, transactions with smart card technology occur offline during nightly batch processing, then link directly to a student's bank account. Though the smart chip is more secure (with the right technology, one can alter a magnetic stripe balance fairly easily), the added security sacrifices timeliness and efficiency, and smart chip processing may take up to 24 hours to reflect an accurate balance. According to Vanderhoof, in an environment where young people weaned on the Internet are accustomed to having access to information in real- or near real time, the offline reporting method simply doesn't make sense.

"Students don't want to wait 24 hours to see their purchases show up on their bank statements," he says. "And from the university's perspective, between manual downloads [for the batch processing] and regular maintenance, there's just a tremendous amount of maintenance on the main system to support enough transaction points around campus, to make smart cards work."

Incompatibility problems. In addition, of course, since the microchip itself is the only direct link to a student's account, if that student loses or damages his card, he loses access to his money. Vanderhoof alleges that all of these functionality issues spurred the smart card disfavor--the beginning of the end of a technology that excelled in one area (security) but faltered in another (usability). Other smart card experts agree. At Robert Huber Associates (www.all-campuscard.com), a consulting firm specializing in campus cards, CEO Bob Huber complains that while smart card technology is sophisticated, it is compatible with few forms of technology here in the U.S., making it difficult to integrate without a full-fledged implementation. Even smart card vendors admit these aspects of the technology may have been its undoing. At Diebold (www.diebold.com), Custom Card Specialist Sean McDonald describes smart cards as "efficiency drains" for many schools; at Blackboard (www.blackboard.com), VP of Industry Relations Tom Bell notes that there are now other technologies that provide just as much security for less money and trouble (see "That Other 'Smart' Technology," page 51).

Cost drain. But if functionality flaws contributed to the demise of smart cards, cost certainly had something to do with it, too. Magnetic stripe cards ate cheap, and go for between 50 cents and $1 per card. Smart cards, on the other hand, are almost prohibitively expensive, and can cost anywhere from $4 (for a four-megabyte chip) to $8 (for an eight-megabyte chip). When you consider that the infrastructure to read magnetic stripe cards already exists in the U.S., and you factor in the price of smart card readers that can cost upwards of $700 apiece, converting a campus from magnetic stripe or low-tech cards to smart cards can be a daunting financial proposition. Miles says the University of Kansas spent roughly $500,000 on its smart card implementation in 1998, and less than half of that amount on the reinstitution of a magnetic stripe program five years later. At the National Association of College Auxiliary Services (www.nacas.org), executive director Bob Hassenmiller reluctantly admits that numbers like these speak for themselves.

"If you're conducting a cost analysis, it's easier to justify lower-cost magnetic stripe technology than smart cards," says Hassenmiller. "Besides, off campus and on, the entire infrastructure here in the U.S. right now is geared toward cards [with magnetic stripes]."

State of the Union

Hybrids. Still, there is a select group of schools that took the smart card plunge in the late 1990s and has not given up hope just yet. As a form of compromise, many of these schools have combined the smart card technology they purchased with some sort of magnetic stripe. At the University of Central Florida, for instance, students use cards with both microchips and magnetic stripes--a hybrid that is a combination of the original Cybermark product and more recent improvisation. On these cards, according to Tammy Kidder, retail supervisor for the school's Business Services department, the magnetic stripes tackle issues such as building security, while three different chip purses serve just about every spending need campuswide. One purse stores up to $500 students can use to pay for small-ticket items such as snacks, copies, and laundry. Another purse links to savings accounts that can store up to $5,000 for larger-dollar purchases such as books and computer equipment. A third purse serves as a repository for meal plan data.

Exploiting interest. A similar system is in place at Florida State University, where Dianna Norwood, director of the FSUCard program (and wife of former FSU staffer Bill Norwood, who headed up the now defunct Cybermark), has set up a strategy that incorporates both microchip and magnetic stripe to offer basic functionality and generate modest revenue. The program began in 1996, and today links vending, laundry, and photocopy services to the card's microchip. The revenue model revolves around bank interest: Because the FSU card links its lone savings purse with school-sponsored savings accounts at a local bank, the school earns interest on the money students store therein. Norwood notes that at any given time, FSU's student body of 32,000 students stores an average of $250,000 to $300,000, netting the school about $2,500 to $3,000 a month in interest.

"Financially, our program is in good shape," she says. "If you can set up a smart card program with strong programs on the banking side, it doesn't necessarily have to be a prohibitive expense."

At the University of Arizona, where students and faculty members have used the smart card-based "CatCard" system since 1998, the financial situation is a bit different. When school begins every August, parents deposit a collective $1 million into the microchip purses of the school's 37,000 students. The CatCard office manages this money, but the monthly interest from the deposit goes directly into a general funds pool earmarked for a variety of student services. Though the school collects a sizeable interest payout on this money for the first few months, the revenue decreases steadily over the year, to a dribble by May. When asked to explain how this money supports the program overall, Bursar Suellyn Hull admits that the interest earmarked for the smart card program barely enables CatCard officials to break even--sad, considering the lack of alternate revenue sources.

Making the best of it. Hull, who headed the CatCard program until recently, openly admits that without a magnetic stripe to meter services such as meal plans and door access, the CatCard would be relatively useless. Still, she insists that the university "has no choice but to make it work," noting that UA spent $1.3 million on the implementation in 1998, has seen little return on that investment since, and does not have the funding necessary to switch back the way the University of Kansas did. To this end, Hull and new CatCard director Diane Tatterfield are exploring cost-effective ways they can augment functionality without overspending on additional card readers or other hardware. After preliminary discussions with Kidder at UCF, the duo is seriously considering activating a second purse for big-dollar purchases such as books. Other ideas on the table include increasing memory capability and incorporating digital certificates (digital forms of identification), but both of these would require significant investments in new software, and upgrades to the four-megabyte chip the school currently uses.

"If all you want is a declining balance like we have, the smart card is too expensive and magnetic stripe cards do it better," Hull says, admitting that Arizona essentially is "stuck" with the cards they've got. "By and large, even the most sophisticated schools today don't have the resources to invest in the hardware and software you'd need to make the smart cards worthwhile."

Hope Springs Eternal

Smart cards for security. With statements like these, Hull clearly is not aware of what's cooking outside of Paradise Valley. At New York University--in a city where security has become paramount--programmers working in conjunction with the NYU-Card office and Campus Services department are piloting a smart card program that incorporates a variety of digital certificate technologies to control access to certain areas of campus, including selected areas of the campus hospital and the medical school. At Duke University (NC), Matthew Drummond, acting director and project manager for the school's DukeCard program, says Campus Service officials are doing much of the same--continually evaluating chip-based technologies that might add security and access control to some of the capabilities on the school's existing magnetic stripe offering. Both of these programs are just launching, but administrators at the schools seem to think that these kinds of implementations could soon become a reality, when the time is right.

Then, of course, there's the research that's going on al the University of California, Berkeley. There, working off of a $10,000 grant from the state chancellor's office, technologists have started testing a Public Key Infrastructure (PKI) that eventually could revolutionize access across the entire campus. Programmers designed this trial system to grant access to certain areas of their workspace only after a card reader authenticates digital certificates embedded in smart card microchips. According to Mike Blasingame, manager for the school's Campus Active Directories Service, the technology will be ready for implementation across campus by the end of next year. Blasingame notes that a potential partnership with the (San Francisco) Bay Area Rapid Transit system to incorporate microchips into public transportation fare cards could spur the smart cards to become reality even sooner than that.

"It's like a chicken-and-the-egg equation for us in that once we build up critical mass, this project will gather momentum of its own," Blasingame says. He adds, however, that Gov. Arnold Schwarzenneger's recent cuts to the California public school system could set back the efforts indefinitely. But, "once we secure the funds to [launch] this [technology], it could make campus life completely different than it is today."

Not surprisingly, all three of these fledgling smart card research efforts address a common concern: security. Experts and vendors alike say that with the low cost and expanded functionality of magnetic stripe cards today, access control is perhaps the only function that can spark a smart card revival in the academic world. According to Hassenmiller at NACAS, it is relatively inexpensive for institutions currently using smart cards to incorporate digital certificate technology into one of the unused purses of their chips. The most significant expense, of course, is installing smart card readers at each of the points of access--a daunting proposition, considering that most schools have well-established access systems, and that even the cheapest readers on the market cost around $500 today.

Ahead, and now. Eventually, prices of these readers will come down, say the pundits, making this solution a reality once again. In the meantime, schools have started thinking about alternative ways to make access even more secure--combining smart card technologies with biometrics to engineer access protocols that incorporate digital certificates and physiological authentication, as well one such program is underway at the University of Georgia; another is under preliminary consideration at San Jose State University (CA). Back at the Smart Card Alliance, Vanderhoof is encouraged by such projects, and says that increased demand for enhanced campus security solutions may provide the kind of business case necessary for smart cards to regain ground in academia.

"It's not that smart card technology doesn't work in the university marketplace--it's just that in order for smart cards to be adopted, there has to be a smart business model and a technological need," he remarks. "Today there exist suitable alternatives at tower cost that are more attractive to those who might buy [new cards]. Tomorrow, though, with an increased emphasis on security and privacy, who knows?"

RELATED ARTICLE: Can't keep a good man down.

Smart card pioneer Bill Norwood founded Cybermark in 1996 with a vision of bringing the microchip technology to every Campus Services department across the country. He did just that, helping more than 50 schools implement the technology over a seven-year period. But although the smart card evangelist filed for bankruptcy and closed shop in 2003, he didn't abandon his vision one bit, and he didn't stay out of the campus card business for long.

Today, Norwood is at it again with a new company, HDO Card Systems, Inc. (www.hdocardsystems.com). The business bills itself as a provider of plastic cards, card printing, vending stripe encoding, ID cards, and related ID software and supplies. Norwood also runs a consulting arm (clients include his former employer, Florida State University), where he advises customers on everything from system integration to magnetic-stripe cards and--you guessed it--smart cards.

Norwood won't comment on the future of the smart card, but does say he is convinced that the technology will rise again. Perhaps he has another entrepreneurial trick up his sleeve? Stay tuned.--MV

RELATED ARTICLE: That other 'smart' technology.

Campus cards embedded with microchips aren't the only campus service technologies deemed "smart" by those in the know. As campus security becomes more of an issue for campus services officials across the country, some schools also are looking into a card-based technology that essentially runs on short-wave radio--a technology called the "proximity" card.

In a nutshell, proximity cards are another iteration of Radio Frequency Identification (RFID), a movement to reclassify items in the retail world. Cards are embedded with a thin metal stripe that emits a low-frequency short-wave radio signal. As users approach designated card readers, the readers pick up the signal and allow access. A user never has to swipe or insert his card at all; as long as he gets the card within five to 25 inches of the reader, the reader can detect the frequency and will let him in.

Thanks to help from vendors such as Diebold and Blackboard, colleges and universities are just starting to implement this new technology; NYU and the Massachusetts Institute of Technology, for instance, are among the early adopters. For these schools, proximity cards present a viable alternative to the Marlock and key cards of yesteryear. From the vender perspective, the technology presents a cost-effective alternative to smart cards that is easy to sell and even easier to implement into existing mag-stripe card systems.

"There are no moving parts to a proximity system--you take a reader and bolt it to a wall," explains Tom Bell, vice president of Industry Relations at Blackboard (www.blackboard.com). "For someone who might be turned off by the prospect of investing in smart cards and smart card readers, this is a good alternative." Bell notes that as proximity technology matures, the price should drop precipitously. He added that current research among vendors should extend the range of proximity card readers to several feet.--MV

Matt Villano is a freelance writer based in Moss Beach. CA, and a member of the National Writers Union.