Fredericton Transit is introducing a new security feature to its monthly bus passes, several months after a CBC News story revealed how easy it was to copy the previous passes.

Wayne Knorr, a spokesperson for the City of Fredericton, said the transit service decided to add a hologram to the monthly bus pass to guard against future forgeries.

“The suggestion from the successful vendor was to use a hologram. As I said, the hologram is virtually impossible to copy or to duplicate,” he said.

Rainbow Printing won the bid to design the new Fredericton Transit passes. The company had been making the passes until the end of 2013, when it lost its contract to a lower bidder.

Knorr said on Wednesday that possible forgeries were not the reason the city switched back to Rainbow Printing for its bus passes.

“From a financial perspective and from a security perspective, the right thing to do was to put a hologram onto the passes,” he said.

The holograms will first appear on seniors’ passes next year and after that, they will gradually be phased-in for all passes on the system as the existing stock of rider cards runs out.

The Sussex Downtown Business Association poster campaign that asks residents to shop local hasn’t practiced what it preached.

After the closure of the Potash Corp mine, business associated administrator Pam Kaye said the town of Sussex was low-spirited and needed to hear a positive message.

“We wanted something in a hurry to put up to get people thinking about shopping local instead of doom and gloom” she said.
She placed an order with Vistaprint for the signs, saying she thought it would be the quickest option at the time.

“There were rumors about stores closing and that there would be nothing left in Sussex”, she said. “We wanted to do something really fast.”
It took two business days for Vistaprint to complete the order according to Kaye. Vistaprint is an online Dutch company that services more than 130 countries.

The posters feature a green, brown and white image of a hand with others branching off of it like a tree. It says “Grow your community, buy local.” Kaye found the picture online. Text below it says “Support your local community and it will support you.”

“I was pleased with how it turned out but others weren’t so much,” she said. “It was something done in a hurry on a Friday afternoon.”

Kaye ordered 100 posters in February and distributed them to all the downtown businesses. Most can be seen in store windows.

Grant Obermeier, the owner of Rainbow Printing in Sussex, said he has noticed the posters but doesn’t take it personally.

“They jumped the gun and bought elsewhere, but when it comes down to it, it is just a poster,” he said. “We have the capability right here in our back yard if they want it.”

Rainbow Printing opened in Sussex in 1995. It offers security and commercial offset printing including business cards, flyers, invoices and, of course, posters. It employs more than nine residents.

“Buying local is important to keep jobs here,” he said. “If you shop local your company becomes stronger and you can support everyone else.”
Obermeier said it builds momentum in the local economy.

“If I am buying tires I go to Sussex Tire and they buy their invoices from us,” he said. “It helps the community grow stronger and roots grow deeper so when we are competing outside we can be more aggressive.”

Once a proof of the poster is approved it can be printed within days according to Obermeier.

“They figured for the timely fashion they wanted it would be better to order it elsewhere, but sometimes… we should look at when we have it here first,” he said.

Kaye said she is sure she would never use Vistaprint for such a campaign again.

“In the end it’s probably something that should have been approved by the board and we should have taken more time to do it but at that time wew were all caught up in trying to make some good news for Sussex,” she said. “I definetly would do it differently next time.”

Transit systems across Canada stand to lose tens of thousands of dollars to fare fraud, and access to office buildings could be compromised, after a security flaw in some of their smart-card technology was widely publicized this week.

Computer-security researchers at the Radboud University Nijmegen in the Netherlands revealed how the smart-card technology, called Mifare, can be hacked to let anyone with a computer and $100 worth of parts create counterfeit transit and building-access passes.

Mifare uses a radio-frequency-emitting computer chip embedded in a plastic card. Transit riders wave the card over a reader to pay fares, while employees and students flash it at secured doorways to gain admittance in many offices and schools.

The technology has been implemented in transit systems in St. John’s, Gatineau, Que., the Greater Toronto Area and the Ontario cities of Kingston and Brantford, and is under consideration for use in Saskatoon.

Mifare chips, according to Dutch-based vendor NXP Semiconductors, are used in more than a billion radio-frequency identification (RFID) cards around the world – including security passes used to access buildings – and represent 70 per cent of the market for so-called contactless smart cards.

“The proprietary cryptography used on the Mifare Classic RFID chip is severely flawed,” Wouter Teepe, one of the Dutch researchers, writes in a paper published Monday. “The management summary would be something like, ‘Mifare Classic is broken.'”

Teepe and his colleagues cracked the encryption code on Mifare chips. They reported the security flaw in March, in the wake of earlier work by University of Virginia grad student Karsten Nohl, but only published the full details this week.

Once they’d cracked the encryption, the Dutch researchers were able to use hand-held antennas to remotely read the contents of someone’s building-access pass, then forge a fake duplicate pass that gave them access to the same building.

The researchers also successfully hacked the Dutch national transit system and London’s transit, showing how someone could get a day of free rides with little effort.

NXP working on solutions

Transit systems that use Mifare Classic smart cards are vulnerable in two ways. Because the cards communicate through the air using radio waves, a hacker could wirelessly read a transit rider’s pass from a distance — several inches, or, as some hackers have demonstrated, up to 10 feet — and then “clone” the confidential information onto a blank impostor card that would seem like the original to a bus farebox. In transit systems where riders put money onto their smart cards that gets deducted with each trip, a hacker could also tinker with the card to increase its balance.

NXP Semiconductors has acknowledged the security problems and says it is working on solutions.

“It is NXP’s objective to transparently update all system integrators and operators of infrastructures which use Mifare Classic in a timely manner,” the company says in a statement on its website.

There are also ways to mitigate the security gaps, according to Juan Liverant, CEO of BEA Transit Solutions, which implemented smart-card payment systems for the transit networks in St. John’s, Kingston and Brantford, as well as cities in Mexico.

“One is for the software on the back end to keep track of the balance on all the cards, and if one doesn’t match what I have on my system, then the next time it’s tried to be used it can be invalidated,” Liverant told CBC News. “So far, to our knowledge, we haven’t had a card cloned of all the systems we have in Canada or anywhere in the world.”

But that fix has its shortcomings, Liverant acknowledged. Payment information has to be downloaded from every bus in the transit system onto a central database, which typically can only happen once the buses are parked for the night, so high-tech fare cheats would enjoy 24 hours of potentially free rides.

Also, riders with legit transit cards that were copied by a hacker would see their cards invalidated, in the same way that credit cards can be automatically blocked in the event of suspected fraud.

‘It’s unlikely we’d use that’

Cities around the world have been shaken by the Mifare flaw. In addition to London and the Netherlands, Mifare Classic is used in Minneapolis-St. Paul, Boston and Brisbane, Australia.

Edmonton is using Mifare technology in a small, pilot smart-card program to test the feasibility of deploying contactless payments across its transit system. But Graydon Woods, the program’s manager, said the security flaw won’t affect the city’s transit in the long term.

“We’re aware of the vulnerabilities with Mifare, so it’s unlikely we’d use that,” Woods said Thursday. “It’s not applicable to us.”
Elsewhere in Canada, the Gatineau transit authority implemented its payment system based on Mifare Classic in 1998. Burlington, Ont., a city located west of Toronto, used a Mifare Classic system until last summer.

Vince Mauceri, a former manager with Burlington Transit and now the general manager of transportation operations for the Greater Toronto Area’s Metrolinx transit agency, played down the Mifare problem.

“We’re talking micropayments. We’re not talking about buying a couch at Leon’s,” Mauceri said. “I think the crooks want to go after the big-dollar items, not micropayments.”

Metrolinx is part of a project to implement a smart card called the Presto card for all Toronto-area transit systems over the next four years, and it will use a newer, more secure Mifare platform called DESFire — the same version Edmonton is considering.

Vancouver is also aiming to bring in smart-card payment systems, but transit authority TransLink is still in the early stages of planning and hasn’t settled on what technology it will use, spokesperson Ken Hardy said.

Manufacturer blamed

The Dutch researchers who successfully hacked Mifare said NXP is entirely to blame for the security issues because the manufacturer decided to use a confidential, proprietary encryption method that was untested.

“All this demonstrates, once again, the dangers of relying on ‘security by obscurity,’ keeping the design of a system secret and relying on this to keep the system secure,” the researchers said in a statement issued Monday.

“As all experts in the field agree, a better approach is … making the design of a system public so that it can be openly evaluated and scrutinized by experts.”

Complainants hope to ‘right a wrong’ and restore free bus service for legally blind in city

Three visually impaired people in Saint John have filed complaints with the New Brunswick Human Rights Commission over the loss of free bus service in the city.

Saint John Transit had been offering free bus rides for blind and partially sighted passengers for decades, but started charging those passengers full fare in July, citing concerns about discrimination and that other groups with disabilities would ask to be accommodated.

Gerald Harris, Scott Rinehart and Andrew Wilson say they hope to “right a wrong” and restore free transit for legally blind people in the city who hold CNIB cards.

They contend Saint John Transit’s board of directors voted on Feb. 21 to discontinue the free service, based on incorrect information in a report from staff.

The report suggested that many other municipal transit systems had also stopped offering free bus rides to the blind “primarily because they have been challenged by other disabled groups for the same consideration,” the three complainants said in a statement released during a news conference on Tuesday.

“The facts are that free bus transportation for the legally blind has not been discontinued at most transit systems in Canada and that many transit systems have not discontinued free transit for the legally blind because of legal challenges by other disabled groups,” they said.

Pat Riley, who speaks for the complainants, says Moncton, Halifax, Hamilton and Ottawa are just four of the cities that still recognize CNIB cards.

The complainants argue the board should have exercised due diligence by asking for documentation to substantiate staff’s claims and question whether board members have ever received any governance training with respect to their fiduciary duties.

They also question why CNIB was not consulted “on this most important matter.”

“We’re determined to get these bus passes back and we’re sure the law is behind us,” said Riley. “We’re very hopeful because the New Brunswick Human Rights Commission provides for a mediation process, that we can do it simply by getting the right information out,” he said.

“Section 15 (2) of the Canadian Charter of Rights and Freedoms actually protects an accommodation like that, rather than prohibits it.”

Section 15 of the Charter deals with equality rights. Subsection (1) states: “Every individual is equal before and under the law and has the right to the equal protection and equal benefit of the law without discrimination and, in particular, without discrimination based on race, national or ethnic origin, colour, religion, sex, age or mental or physical disability.”

Subsection 2 goes on to say: “Subsection (1) does not preclude any law, program or activity that has as its object the amelioration of conditions of disadvantaged individuals or groups including those that are disadvantaged because of race, national or ethnic origin, colour, religion, sex, age or mental or physical disability.”

The three complainants say free bus transit for the legally blind was instituted in communities across Canada and around the world for several valid reasons, including:

• Legally blind people can’t be accommodated to drive their own vehicles.
• Legally blind people have a right to transportation to access their health, education, employment and other human rights.
• Legally blind people have a right to dignity and now having to depend on family and friends, when possible, to access their human rights.
• Eight out of 10 legally blind people do not have a job and have an inferior standard of living compared to other Canadians. The labour force participation rate is 20 per cent for blind persons, 44 per cent for persons with disabilities and 73 per cent for non-disabled Canadians.

Thirty-eight CNIB clients use Saint John Transit on a regular basis.

The three complainants pledge their full co-operation in the Human Rights Commission’s mediation process.

Saint John Police received a complaint over transit passes sold online

Saint John Police are warning about fraud after fake city bus passes were sold on the online classified site Kijiji.

The police launched an investigation after one person complained about fraudulent bus passes being advertised on the website.

Undercover police officers contacted the seller listed on the Kijiji posting and arranged a meeting.

When the seller produced the fake transit passes, he was arrested and taken into police custody.

The man will appear in court on Thursday morning.

Police are encouraging anyone else who may have purchased a fraudulent bus pass to come forward.

COUNTERFEITING: Anyone with a computer, scanner and high resolution printer can make fake government documents

A computer or photocopier are all a counterfeiter needs to create fraudulent documents and a Sussex printing company is urging the province to beef up its security measures.

The arrest of a Moncton-area man last week has raised concerns about professionally counterfeited insurance papers.

On July 15 RCMP seized counterfeit inspection stickers, counterfeit inspection slips, counterfeit insurance cards, temporary permits and documents to counterfeit $100 from a home in Lakeville, nine kilometres from Moncton. David Campbell of Lakeville pleaded guilty to charges of forgery, counterfeiting and breech of probation in the matter.

The operator of the only security printing company in Atlantic Canada says this discovery is only the tip of the iceberg.

“In the older days only trades people were doing it. Now anyone with a computer, scanner and high resolution printer can be a counterfeiter,” said Grant Obermeier, operator of Rainbow Printing Ltd. in Sussex.

“Those $100 bills which were counterfeited a couple years ago (and found in Campbellton) were made on a high resolution printer bought at Staples.”

Mr. Obermeier has already contacted the provincial Department of Public Safety and the Insurance Bureau of Canada to suggest changes in printing of insurance cards or government documents.

“The province needs to look at the value of documents and if a document has value they should look at what kind of security value has been added,” he said.

Currently, he said, many government documents are printed on standard bond paper, which is easily photocopied. Instead he suggests using a watermark that is made in the paper. The watermark is only produced in a security mill and available to security printers, thus out of the hands of forgers.

Invisible fluorescent fibres and inks made in the paper could also be used. Unable to photocopied, scanned or digitally manipulated they can be seen only using an ultraviolet light.

Special inks that bleed through numbering, creating a red halo around serial numbers, or micro security printing in which tiny text fills in when photocopied, can also be used to safeguard against fraud.

Since costs come down proportionately to the volume being printed, the price tag for security would be minimal, Mr. Obermeier said.

“Basically it would cost pennies to do.” For instance, he said, a recent quote to a customer was 11 cents per gift certificate and 13 cents for advanced security on the same item.

The Department of Public Safety is aware of the growing threat of document fraud.

“We sit on national and international organizations to prevent auto theft and issues of fraudulent documents. It is an issue that challenges jurisdictions across North America,” said Public Safety spokeswoman Patricia Hyland.

Public Safety staff headed to Vermont Wednesday to attend a conference on identity theft and document counterfeiting at which they were to discuss latest techniques to stem these criminal activities.

Ms. Hyland said her department was approached by Rainbow Printing recently about security measures on provincial documents.

“Staff have spoken with Mr. Obermeier and certainly we are going to look at the suggestions he has made and forward them to our national and international colleges for feedback,” she said.

In the meantime the province wants to ensure co-operation between its own departments and local law enforcement to root out counterfeiters.

“We are asking the RCMP and municipal police to alert us as to any fraudulent documents and make us aware of any developments so that we can ensure our policies are up to date and staff are trained to detect forgeries,” Ms. Hyland said.