\,.)

Itr:t..it-Ho;-t-r-rrv,qt. Litrtvt-,RSt't\ ()r Lr]-r-Dtx: InÍbrnaticrn St:curitr. Crtrup - S::letl Ci'"rd Ce nlrr:

Revierv of thc Pt'oject Plan and Regional Fraud Manugentent Plart
by RHA'L
0E.09.08

l" lntroductiou
Ar 1:csull rrí tl:c clulrtr-.r exf'r1.1',;lsrr lCEt :crir;rt o[ the TNC) repc.rl. concertring t::,: \ltt'luc (-la-qsic
seculitl' pr-otrlems ilnd t?:c ()\'Ch:1kei:rt- the Inlbnlaticrn St:curirl- Grtre.rp/Srtt.rl [lard Centre
{15G/.$CC: rt:f Ro1'ul Iltlllorval,Universitt,oí'Lunrlrrn (RFItil.) udvised to set a rntErit:on Tl;;iÍrn:rlF
\ïilestone (N,|PN.Il pricrr tcr (hr.: nitl:onal roll-out of the 0\'Chipktitri, "l'i.c pubiic tl'rllsptlrt

i(lmpirn:És !rarr: irdolrted tl:!s RIIUL reco::tn'lenditÊion ?cr tlr:t'r:lop 't 'rl'iqruíirttt 1r/rrtr lor ihe (t'ilnsittttn
r(r:l neu,card technologv, Foilrr*'rng on frt'rrtr this:eco::rmendatirrn by RHtll.. tlrc \'finistrt'of
liirnspcrl uí the \etherlmds Í\'en\\il recluires-l'rirns J.-ink S1'sterus ÍTLS) and t?-.e pr;hl:ir Í:itnsp(!Íl
operittors ttr['(Jsl t(] hil\'c ';r ntiqrrt!iorr.r.,J:lr in plËtc€. ancrr to tiliing lhc gcrlcrirl rrhli-gatior to iti$c:pl
the pa1tr..r-based Strippenkuurl in locnl and regional Dutch public tB'itn\F(trt. llcrtvr"l'er. the
RoEtrerd6n1\( EIuktriscá:c Trnrn corrrparll {RE'I) anci'!'LS hirlr: itskerl perrltissitu: to'rlistuntinrtr: lltt:
Stricpcnk:rarr in Rotterdirm Frjor tiJ the gencral ,.lccisirrrr reterred to iibot€, irrr irn irtÍrrrrnetl
iuclgernent t-rr, lhis rr:qrtcst. \icr:W rr-'quiled RET rnd TI-S to subntit thc foLlor';ing tlucu::ren'.s
,

r À rr.,rliruirt! !ruut!.,1írr,trrs<lrlÊ,,rI pirrir Ícrr Rotler<iirm. [trr ïhc pcriod precu'ding t]:tr \IITNJ
c The iltitit't'! pftur lbr rcir)rsing thc rrrrerrírli{},t /rirtrt. [rr: the ItlPIr'l
\tzr\\i lssi,:ned Il.llLtL tq rcr.icr'. lhusu (l(rclrtr)c1Ês with tespÈf t rt-r L lumber crl'critcr:rr tlcfinct[ irt ;ltrItIti.:r r.r't';rs.igr:r'::errt t\,'en\\iDG\!tlil0LlttJllg6l.'lhc Hut F.xpcrtisc (-L-rtIl ulll illEUi 11'el\
:esptr4sitrle tol'1l<ne ral Ilcjlitatinn ni:hu ri,.rk lrrri irctr'r.l is thL' intL'rfitL'e ['!el$.:er'tl Ve n\\ ;lnil ltHt'l

2. The Revien'Task rrnd Àdopted \Íethodology
R.III-jL rvris asked t(r call-], (1rrt un urgcnl rct'ierr' of trvo docuntents : t, thu rt'ui'tttu! li'uuil
il14tt1gtficlt prian r,'rlrl tlte pxtjer rpirli. Wlrilst i( r'.'crttl<j har'c huun tcasih}c to uill'fv Ltut [u'Lr ieDilrillc
studies. a singlc r-rrmhined rcr,ics rviis rdopteri due t* the close linkages hcïtqt:;: ihc Jcrlut::etrt-;
un<í rFrc ur:ilr:rl1,ing itL-ti\.ities tc',rhir:il thel'relrl*, Tt rhrtulcl ht'noted rhlt lrotlt ittpttt tltrculrlcttÊr
supptÍr-d to RHUL rvere murkr:rl iis i:o*fidÈntial alrd suppLied under the Nllr\ *'rtlr'í"í-S. Thctc rvrs it
reliancc 6n TLS trr chcck tttis dtlcutrtet:t tor "leake4" ÍJllnfidtrntirrl intorrlrari<rr: prio:'io rtlenst:
lou.erc'r tlolle r\:Ls lbuncl. Nrrtu.;rlitr th;tr thc origirta[ CE reptrrt ii-orl l{HL. l-;s tt(rt\ :r puhlic
r!ocunrÈl:t ;.rrtcl srr thele applopriate ma1'be ttsecl as il bl:ckgrttttncÍ rc'íeretrce.

Thil relieq,u'il1 proceed b1'lirst:ecirpci',g ozr thc sigetifici:.nce r-.Ittre nrigrntion planning \'?.i]cstorte
"fhis
{l\,1PI\,l1 imd clarill,ing;t\ lnclrniÍrg in order to r€lno}-e sonrc persistcnt;lt:sinte:';)retiltioll.
\cÊtiort rrrlll *lsr-r sunrmarise some oi ti"is uritrcr:l cri{er!a tiotrt YenW rvith respcct tc thc l-rrtal

niprntion r,rÍ114 1n(l prur,ide sgttte }:'ieÍ'intbrnration <.rn áhc Rcrt(crtiltnt netrucrk. The rr,'pcr;. '.r'ill titn
ir thr'
l:o (.rn ro rcliew ttre plr,',;ct'l 1,r1all, Nr-rtc lhat ft:r the aroidancl'of doubt, ihe prr'rÍ<tr 1;Jrtri
I

?orvarrls tlrc encl r.rí thc rcvticw. \tciW ai-so prol'icled.t rropl'i trf thc urigirrll tt'rttl-t at:d conCititus lirr
disc1r11;nrrinir rhc rrhlig;rtioll to accepÊ paper-tritsed nltiionirl l[ilr)spt)Ít tickets {pne -\[ilurc prllrlcr:tsi

v 1.0

RD\',\Lil{)t-t-(ri\ rt. (- rtytl:<st:\ r.)FZ-rlNDo\: Ini'orlrtation.S'lcuritl Group - Snrart Clartl (-t::t:É
r:ctiliied 1:l:u: rtf ;1ctivitif-* lrnrl |rutrirrilli(\)s lo crsste the rtllgrrttiorr 1l/rtrr (ii.i ,.'r'ide::ce r;l ii sli:tr rti
slirl-trl:prr rultiinessl lrl'ttre \ÍP-\í: it ri not thc rni.eruÍi{irl.I/íÍlt itscll, Whr:* terrr"tr'1t:g the 1;irrfc'r.'t
p/r,,rr tr.ifh rr.sp€ci trr the VcnW .;ritclri \\'L'iire Èons!ielin-s $hct'n$r lhctsc ctiterii: irre iikeil io Lrr'
'lhu':rext
srtisfietl n1'rru \ÍP\.1. gircrr the,cc:eduled at:tivilics/litsir iltfirted u'ithin the pn!t<'t 7r/rrri
\cc€i(-)r: of t:'1e re-rort *,ill iqnsrtir:r tltt rrair.rnni_/i.tatd tn(tnÍIgencnt P!nt ftrr RutterCltlrt rli(: l-(:s:lccÍ
Itr the:;1in \tn\t uritcrion. I:ssezrtiallr \tn\\rscck;tssurÀ,Lcè th&t the nteasr.rrc: suÍ ttut il thr'
;e,,qionct! /i(19íl rll(lrírscnrcnt trítir lirlrr:. :r good bntir t(t ntxtlilgti iruuri tisks xnd iuppr-rrt cusÍ(rtÈlcl
i;r.:t \tcri irruiiessÉ:1 rtirh th< pt'erpnt .Sl:[irt-t Cilssic [)\''-ChiPk.rart ic I{rrrtc:'iirirll. :]: ti:e pt-:'itrd
ir<tr.reen trilniÍ'*t'lo irn \: t:ckclizlg ailil'solutioll atd thc ilïF\'1 Thc lrirckg,l'rrznd i$ thi\ i\ lht::cqucrl
l':13: TI.S und RET ia aholish oirpcr hlst:el trckets {Strinpenkaítltl in Rr.r(lt:rtirlnt prior trr the I\'ÍltNl
-the
lir,lrl sci'ti<rn trÍ tilr: rtport u'il. crnrr c(rttc:!.1\i,.tns frtirn ltotl: tlf the [e\'1c'$ctl rians rncl
ciare.
rccirnrnr,:ntlatics:s tr ill he ntade.

2.1. Clarifïcation ()l' thc lligration Plattning l\{ilesfurne
l'i:.-: l\'llttU tvrrr t|:scntrcd irt the uLigin:Ll CË rtporl Íl'rlrn RHIII-'

"'l h1 ( !:.8 rírz,rr (1,r, t?r'r,,rtí,r!<'ri.r1.s nr ?.trlit r in!c'rint urile.sÍottc' rtli'rret! ,'it .r '

f

í!r'

;ri,,:rirtrsn nlalrring. Milcstoue, sci ii;r'Jtlurrrirl fí;lí19 lrr ioitttidt ttiIh l[t.' s<'iiertitlul
t't.ttttttlt,!istt ri 'ltt'ttr;títrt t/ lir,t,t 11Í i?rt tltri ({{ii?'lii 51!l('f,rt, 7ïrir is ií,'r't!\lll? lllrii iiirlil
IIlc rÍrriï ll lrttirtrt"ti'ir.lc, ttrri,'+t tlct'c ls (r.r,rtlI{' ttÍ litt'ittrttlrtrrss /i;'t'lilt'llliqt:{Íir)it irr rr
/ricili,/- !t,', t! <t! (.(llïi l'r'('Í4 iir ,lJ;.. 111igp-rrtririlr 1;1rlr- sltllrirl ilt.littt, 11fi 111'1'a'\ttil'r rlí li I ili.'Í,
niirrh r,,/ rr.ríír-ifí'\, huclt4'-'t.r iilrr.j lllirtrr/rr,tr: 1}ttrl'it/itr( tt!t('I'! (''!rtilttr!tttit It!l(tJ! ít,! jÍ;lí!i.']('.{r
írrrr cu-cls tftr lrtiie,rtcrttl'trrrir iltii{. r'i //(Ícrr?n,í t{íeti ttt rliÍ(lí'kdl'.f rtlttf r/tr' ittciaFrt:niarc!
It'i icrr ,J r/rrrií l,r,r'rjrl|yl ri/ r.irc ,il/uri .r/trrrr/r/.1;ttrt 'tír *ldtd unttid.'rtc'{ il'i{i'.Í rriiq-''riíiritt
jt', Itrií)t' !(t !lte tnilesrtttt'. iJrt Í' rit
i,, jJI rrlr r lr,ri II rr,r.rtrltj rt'uy,lirc si,ryriiii,'olll rtt tii
tilr'ttt,tr't'altJ irt'Àrtr.tJrrqr" rii'lirrjrlr;
irirrrli/-t'ittq
tt,rlrlrrr'Iirr4 tr rir'1{'lrír?ry' ri'i: iir:nirrir,
,t,rrríÍjeIs zrlrti .'iJ nritcr ;rrLtrrir;/
rtrt'rirrgirt,{
rtr;rplirrs,
rciÉ'cíi4e
i1Í1i,rír-rri.lg1r rr1,,,r1rrrdr,.i
glc' rirlti/rrr'lfr Í/ií)\:í ,ií,'l(lJIÍ(ri
rriti<'/l
rJc..riiis.
7ïirst,.tit'Ps.
pntir
r,i
/rrqirll,:. ttnr!
1'llrililg
ir /',\''{J qt.ttlcl sl,4z r/lot'i rrI trri', Piilsicr,'i rfuplrt';ne.r!. ïht'.li,lul r/g,:'isiorr lt' \!tIi'! !ír(
nr!g..ririrrtr :tu[{ raka lliiit: rrrrtit,!ittit, lrtltr, lri':tl on uqtatil /r?.,Í('J.{*! (ii!./ iíi{Í]arr
"
r srrt'/l tl.r í/te 4l<,ir1rrzrÍ lrt rl r!'!'rttti' t itlitted rr'itiriit .'ltt' Ilti,(f1flií)tl pJfrrr.

l{Htll.'s cuÍrL"tlt ilssignllteut tiottr \ien\4'', thc it'l1'\Í lilÍgcl dÍr:e ilils
r,.-sïerÊahlI'ri* RIIUL's trpiniolrrb<c-n stril'tcd to.lrrnu.iCt '' lí]09. h1 u'hic!: time'[l-5 1* 1Í:11uj1i:r: ttr
'l'he rrllqrtitít!n
srih:nr{. lfie iomr;rl iuiqro!irnr plrrri ltr \tnW lnt cullsideriltion.
f!Im t|i.l rrr-:lide
.!iric
1s i1 61E',','t:tlrrl
<rI:r:utlittess
tbr
nli-e!'etion
ir
reitchc:<l
Pl'C)s
ha'.-e
rr,ielerri:r-. rh;t TLS índ thr.

,{ccorclin-g to the inlirrntlti{ln ll

(\:chn(l[(!g\

trl thr: \'!P\í êrld:t sinlple \f il)'to
Èolsidrrr rj:e :r:ilestonc ir ;:r thu llrrt rr,arlah:lit1,of r ci:td tuigríttiou "C()-!lutton" lf :hc "GC)iJulï<14" ir pÍÈssed. t!:e ,,ri.qt'{rIj{r1J /-rfÍr4 slnply rr('d t.íí.',\' ilÍtd rlrr-' t: iltlspurt -{\'stenls í:rc
c6nrpÍtrhcnsrvr:lv upgrarlcrl kr ircct.llllrtzodrt'the tle\r'card technologl'. I his :s por,rilrl: l,"ecaust' ltll
the acti'"ities requi!'ing e\:a:uiltjon, \\.lsctior. irllrrcat:on.;ti:d -_qettc'rll tt'chtricl:l ilnd bttsinc!! cicciriorl
lrak:nc rllus{ he t'inalrscri l.rcfrlr-^:ht \{P\{ The olr.lv ouÊsta*din-c clecision fcr tl "(i(l'Rtitiot}". is
'í'11:r,.: rlrll uppcÍl\ tu Írr. sullrc. colïÊ'usiot: oïer thc itrte:?rci;riinn

v t.D

Roy,tl LIoLLo$',\y. Llslvenstr"l trt-. tr-.r-rxtrttN: lnforrniriion Securitl' Group - Smart Cetrtl Ce nÍrc
ru'hc'r: rrr pres:; it and the conditlon-. Íbr this tinclucling r,,'hr h:!s thr: rtuth<lritl"to llïess rhe Cc-Button)
shall be unambiguonsli"defined rr':lhin thc ntigruliut p/rtrr. Tlte ntig,rution plan reccnuncndcd h1'

Rl-lUI. docr nrrt rnciude un1'shrrrter tern: ren'led;aÍ meitsttms (SR\Í). Thc use of a SRN'I is

considere'J a5 pflrt uÍ'norma! diry (lr dirl' busincss and frcud tna!?ilgemeltt operfltion-r: ancl if ;r SRIr'Í is
rrl'signil'ic:rnt r.'alue it shouid tre inrple::reuted well helbre the \'Ílrlt'|,
The rrri,graliorr,nftvr deliversri by t::e ItrPIÍ shoukl trt: r'r:?crrcrj (rr as the ltttseline rrrlgt'rr,'ir:tt./rÍcrrr lrntl
this will bs trscd ls thc husis for thc \Ien\\t decision on uhelhÈr lo aFprovc thu na(i<lliwitle

withdrawa? of oaper tickets. lt is conr-'eiv:.rb3e thlt lhe lngiZcri lor thc "GC)-Butttrn" ivill nct ttccr::
fur sonre (rme ilnd srr thcre is u tJanger tlrat r-'lements crf the plan Lrecr.rme obsolctc. ií tor cxanrplc ir
'I'he
suppl!er is tro lon_eter lavourec or il' inrpror'c<l tcchnic:rI cot?lfr$nÈ'nís trec*nte ar-ailaLrle,
ilieftili{n pÍrn ntav therefrrre tre r'er':sed :urd subnritted tbr approvttl untler a sc:hctrtc :rcceptable tt

\tenNj. A[ unt. given time ilfter t'te NÍPIr'Í. ir rs th* lltost currÈrlt "aPpro\íed" plan that rlould he
r.'.rrc'irr(,t/ hy Ihc "{it)'Btttlon"r\s a lkrt!:crn*sasuÍc lu itvrtid F()tËntial cnnfusiort. the rl'it!:dran'ul of Stripper:kaiut! tion ir nclrlt-rrk
rt,ill tre tet'ened to as Paper ficket \\jithclrilrval {P'l'W) anil ntrt Inlgrillrun.

7)

The VenlV Criterirr

Thr.. mnjoritl' uf Che Ven\\' cri(eri.ir ir.:ia(e lct lhc ari.grrttiari ptitrr iïsclf. Thcl'' inc!ude:

c R isk ;\s::r.:s$tncnt
:-i [s there u: adequate u\\es-sr]lent crl thg set:'r:r;tr riskr itrsrruiittcti rvrth thc cuÍÍL'nt clti;: clrd
tcchnrtk rgy.''l

o Securitl'.A.rchitectnre
': Ir {he Sccuritl"Arcltitccru:'c irdetluale' in lis!:t ttf che idr-'ntified risks'.'
r Chipicardi s,-'lectlotr
,- F{as a chiJr lreen se !ecred rr ith an <tpen cry;:tolcg1"
r lniïastnrcturc up.urarlcr
r- ls there u gt:od oven'ielr. ilf tire ïÈquired inti-ast:'ucturll chatrges t':eedec tct nti.tritlc'
r Vencior plarrs
L Àre adequilte co[t.ingencl'pllns egreed u'ith the !,']ain ÍselÈctedl venciors tr-r errcsutt: li-.cir
1

role in {hil r.rvcrlrll plirn'i'

e Acril'itv plan
a It th+rr; ir r(:llistic irr:tivilr :rlun in rvhith rirc ntritr lc:tir'ities hale hee:r identified anri
r

r

e ssigrred tr.r the trrain i-rctot'-s itlvoll'ed't
Í)csisron Frantcw<n'kn
+ [s there a Decisiolt Frurnervork rvith clear stclts itntl t'itting triggcrs rtnd sritcria to.euidL'
rhc clcc:sion rnakirrg proËess sith regard to shttrt-teult meilsures or nti-sratioil. inclttsirc
qhe decision making prr;cess itsclfl

Budgers
:l í[]cciarur.t (]ut (rl. seule ftrr thir rericu'/asst,Eulllenti

.\tn\\'rrrru1tl:t*ltl1:rect[1'JpllÍ(t!r':tÊ\:\it.Jr|-\k}th,J,!ÍB'lJltdi|t1.l/ari,lutrritujrlet:rute

't( wrruld bÈ Llerler (o rssk ittt oplimal t'+thcl than udequctc Sccuritvr\rchiicctnrc
'Thc rn','tning oíthis is rli,icursctl in sc'r:tinr 'l J. I

" Allhr:ugh :ror cxplirrti y stirlcd in thr: \t r:\\' c rrtrne. it is clzt;cal11' :mpartÊnl ín d cfi nc rvhn ha r thc lt:t htrn tl írr tti:rlic

thu llnul migralion dr:cisi<tn

v t_0

Roval Ho1.r-orv.qr'- LjNIvERsITï or Lor-DoN: lnformatiott Securit;- Cruup ' Srnart Card Centre
'I'he critcrirrn for thÈ ptoiect plan is"

r

Whether it is reasgnahle ttr expect a cornpliimt nigruti<ttt plan by June ?009

The above criteria couftl h+ve heen predicted from thc originnl RHUL CE report: horvcvcr, the
reque$t to uholish pÊpÈr tickets creates new criÍeril.

r

Do the measures sel out rn Êlre t".sior1ftf,l fraud tnanagenrcnt plan form a good husis ltl
mirnftge frgud risks and supponing cusÍoÍncr service processes with thc present Mil'are
Classic OV-Chipkaart in Rotterdarn in the pericrcl betucun trÍrnsfer to an e-licketing onll'
situation and the MPM'I

2.3. ïhe Rotterdam $Ystem
Rotterdlm hils bccn ir pioneÈring s1'sl€m tbr the use of rhc O\'-Chipkaart. The tbllowing quote iri
lakcn frorn the official u"ebsite hti!::iir'. u ''r'.or "CiiiÍlki$rt-r:i
"7'hc OV-Chipkaar! Iawtcls is cttrried att in phu!íes thnuglrtsut the Netherlanr/.r. Ál the end oÍ'
20A5, Ratteryt(rfn rrr{r,r the lirst to lcutnt..lt l/le ltse qf the OV"L-hipkaarl. Tlte OltChiqkoart hc.r
hc.ctr u.rcc! tu 1ltl litrjour'tr('t.r Drr lfit,i:rrs. !tuin ancl ftrÉ,Í,'Í.) íJttllcd lr1'Crrrrrl<rltinrr, tÀt'NS íDrrlt'lt
Railvav ('oln1xtnt ) aml RET sirrce Dccenr her 2006 cntl in lhe RN lrtuns rtrtrí àn-'ire I sittcr-' ./rrÀ'

2ffi7."
Cuneltl1.- the Rotterdanr s!.slern -rupp(-rrrs both the O\"-Chipktart and lhc Strippenkarrt paper
tickerr. Custunrcrs hrve beerr wamed that the puper tickets are_expected to be withdrirrvn (PT\\"}
when \en\U decides rhilt lhe rime is uppropriate- TLS and RET' would likc thc PTÏt'' decision lbr
ILrrtterclitm tr.r hc nradc nrrw-

-

Note or:lv RET nr.i nrcnttoncd in thu inpur dr:cunrens and nol the othcr comFilnics nrcnti<rncr.l in (hÈ \r'eb$!tc guotc.

vl.0

Ror..cL Hr)Í,t.orvr'r. [.txtvrnstr.r'cF Lost]crs: tnl'r:rm:rliorr Securitl' Group - Snrnrt Carti Ct-ner'e

J. The Project PIan
T!:e pro-iect ptran dcscnhcs ahc rctivities to reach the i\'Ílr\{. Thc t'ersion thf,t $'ns retioved in thi-'
ruFgrr rvÈs ciued t" August 200ti anri its crcttirrrt was a Lesult ol'l r*clucrt h1 TLS/RET tr:
discontinue the u-sc r:f paper rickers in Rotterdam, 'fu considtr the request. Ven\\ uxlic<l firr r'ále
1ttr1jt,t:t p/rur {and rc.giortttl lruud ntanagtnrcut plan\ to be pror'ided fbr independent rcr ierv
?he proie<,1 picrir w'oulcl be expeclert trr rncludc'&ctitities itonr the l" August l*0S ul:til the IÍP\'I.
'fLS :lvc prouided
54t rloes ntr( nr:qcssurily include irll ectivities initiated by 7l.S lnd t]re PTOs.
ailditirlnal 6r,etviËn'inibrmation on il ''sccuril-v Prr:-eram". The Security Prugrern appeí:rs t positi"'c
lï:$p()Ílric to llre reuent secu:'it,v nroblenr-s lind thc in[rrrttratiort descrilres. in high icve I su:::ttrai\'ÍbtrD.
I rrunrher of prutcqls ilnd procÊsti initiatives. 'fhe main projÈcÍs tre listerl beloru.

r
r

Fraud !lonilrlnng antl l\'Íunagetne::t
rj Optirrrisation of esistrng liaud nranagu-rlletlt srstert'!s ancl proccsses
{.r First rlcli','cn:rble: Tlte Rr)tterdaur regionnl ti'ttud ntnagemrnr plat
Short Tr-'rnt rneasures

,ll Assess:ilcnl of shor!-t,.rrnr renru.dial mÈasures thitt ::t:ry irttpror'e securit! mi Ji-autl
dr't€cti0n

r

J Progíess not y'e( reponed
ltljsratiun ltlan
a-r Work to rerrch the lr{P\t
.-: First deliveratrlc: I'hc yttrt-irrt plut

SccorttiarY Fl'ojects incltrded u ili:n thc ;trcllrillll lirÈ.
r ï.rfc Ctclc \{anugenre nt
tl Relevan( ttr Sccurit-r" uvtrlutirrrt and manugell)e111, L.n( also designr:il lo lrllpro\r-- g.eneral
tcchrticrrl atrd husine-ss tleribilitv t(r supFort lrdltplirtn ttr chtnsing scenarics ltnd

conditions

r

C Progre-ss no( yel reported
Carcl Rcrrdcr Sulution
ir Evaiuation cré"card rciuler optirms to 1>rovidr: secilre. cost ÈÍlectil'e und lirturc lttDtrl-

soï*titrns for current anc! luture Lrusiness need'-i

r

:-j Progress nrll yet rePortt(l
OverirlZ Securitl'' N{auagen;ent
r; 'l<l manage tn crverlll *nrJ strtrcturcd approach to trtgani.satiouai ri-{k i'.ssesrnlent,

a |trogrcs; not .vct Ícported

The Security Pr+_gritrr: is also intendctl ir: conlnhulc i: nunthcr<tl'g:rocess initilti'.'es

r

lnÊernationtI Co-opcratitln

r

;{r:tdenric F-xchangc
r-' Su!Folt tbr tbrums itntl invusti-ullitrn irrrignntcltts
SuFplicrRcsponsihilitl'
il, To corrrdinirte hcr*' supplicrs u'rll conuibute to inrproved secuiltl' soltlti<-tns

t
r

.,: Inii.lrrrr;trirtn cxchange ;rnd collaburration with sintilitr intcrntlional lrnrrsp(.lrl scltetttes

StlkeholderManagenrent
3 lr{entieins lhe rc}iltionship u'ith Vcrr\rt'
'J Na othel' stakeholders explicitiy' mcnlioncrl

vt.0

Rr-ry,q- Holi-(l\\'A\. Usrvp-nstrr cr [-osrror*: Intbrnration Securitr: Croup - Snra:: Clrd Ct'llÊre

.J.

t.

The Objective of the Praiecl Plan

Thestatecobjecriveoftheprtryccl ,'.'/rllistcreachthsf\,íPlVl. Thcquotedrequirenrentt'c:?hetr4PIr't
rs ir rcirsonithlc, hut nol fuli!' prccise. interpretation of the original CE repcrrt. itr the prrrjet't;rltlrt
?rcntit.'D\ lErnq disrancc rravel t.rr conlplete covelage in the Netherlirnclr. Thc linkase:o rl*tiona]
Êovel?gË acttrrlll'relates t(r the \irlue rrf tirc asscts tltirt are pÍ(ltectcd i.e- the ticket lalues ritthcF íhall
rhe íact thirt e p["iserrger i-t tr*r'elling I long distance {a?though lhe lwr: rL^- ncrrrltll!r'!i:tkr.'dt,
C6rpletc ccrl'È:ilEs {.rf tl,e Ncthcrlnnrís tith itirndalrtrre regiorla.l s]steln-s rlc'.lji tror nr:st:$ritrilr
rcsult i* higlt :ickez t'ulucs.

3.?. Fhasing arrd Deliverables
The pru.ju-ct plirrr rlescribes thlee pha-ses of activity, u,hich u'hcn lirlly clctarlctl rhtrttlJ irdclress:tll th.'
rritrrriir rcquired b1 \Ícn\V. Ench phasc prcrduccs \(I!!!È'docttrÏ]ented ouÊ;lut n)lo',ring \enW crr-its
rr.rr.rlrr,es to c1!Í\. out independelt Ler.iervs il'and u'hen re<1uired,
r Phirsc I t.luly-()ctober l{}0$t includcs rrrucJr r:f rhe tu"cltrricll/secu:it1 L'\'iliua{i$l'1. selection
iu:d design u'ork
:-- l)u lir crahlcs
t Structured Securitl' Assess:nel'l(

.

t
:

C;rrd Sr-'icctiort

High Ler,el IJes:gi cf Sei:urity';\t-chltccturc
Ithi:sc .-l iNrrr J0{j8 Jirrlrirrr 1009) rhc crtrc contriburiort i. to deiinc infiastruu'ture
upgrades. rvirh se';ondar-l acti\'::\'related to ïhe Dr.'cisiotr Frame$'ork tmigr.tlit-rn (:l-sgc:',!

r

a Í)clircrahlcs 'TBi\

Phlrsc. -i tFetr-June ?(X)9i detí.iled p,ann:lg anC contrilctut!,rpricing ilc(i\it:s\

x [)r:lrvcrahlc': TBi\

Dereiled plunnir',g :rni rjeliverlbles urr cËrrL'ntllr onl-r' detinr,'d tbr Phue I Or-rtlire pians art:
,;rriril:rblu li.rr lthi*er J nnr.l -1.

3.3. Phase I of the Proiect PIan
?raseltrftheplojr'ct'plalrisshtrrt''nttstbtrt'rtlb-prct-iectsili-stedbelr'rrr')<ritci''stlh-tliiiclc<llirr-thc:
inlrl r rturril>cr of sub-tasks.

!

"'(::(-' + Rick r\n*i_"-sis'"

:

'l'he main purpose ol' this task is to cflrrt- out and docunrent t risk ussessnlent
:.rccot'diu-s to a relecred nrethodologl'alld iur associa(ed workshtrp.;urd to thetr
clcvclup a Sccuritl'Iugct ba-.cd crn a Cumr:lun Crrterir approirch

r

"Card Selection"
,: This is oinred &t selectin-E a nerv card technology'and runs in parallel u'ith the CC Ris[: i\nalysir tlsk

vt,0

I(ttr,.r:-. Hr-tt.:-orr,.lt'. U}ltvrR.sll y tt: LosnoN: [nlbnnatlttn Security Group - Srtrart C;.rid Centrc

.

"H I- .;\rchitL'ctul€"

:: The primlry puïx)se u.í this task is rrr clevelep the high lclcl tlesiqr: architcclu:r: :rtrd
it starts atier a tlrtít ST docun'tent is lvailirhlc

o ''(lcsE Estitrrates lbr Phasc 2/.i"
,: "['hc rlteirnit]g is se lÍ-e rpilrnatorl'

A tirst drali rrí' lhc nri.grurliut plutr is nrltic avirrlah!r-- at the end crÍ' Phir.c l -

3.3.r.
-[he

Phase I Deliverable Defïnition

pir4cct;rkur tlcscr ibes three delivcr;rb]rs tirE' Pi:rse I '

r
r
r

SÊructsred Sectrritl'.,\sscr\fitcnt
Carr,! Sclqcttttn

IIigtt Lr'vel Desigtr of Sccurirl'Àrchitectutr

'l'hc rlcli'cra6les are lll itsstlmcil t("r bB documents thrt rvcrulcl be irvdlable li'rr rt:r'ie$'i' Each
deliv..:.able has a trnuf clcscripeion and the renruining irttbrtnaÊion is rcalll"rclutin+:c lllE tiisk(\; ilnrl
to he
tr(l!i(xtFL.r\ tkat created it ]'his inli.rrrl:',Ltiort ir:dicates some sqncrrc rtr[c*/t'esourc*-. t1'ts 11s1ir'ilies
Cnnicrl Orll. rclL.\'ailt qUnlit.v- criter::r lr.ntl tupics that nre. or lte ll(rt lrl ic$;)L'.

3.4. High Level Project ()rganisation
The 2rrr,icclpltrrr is l tlclivcrable i'otrt tle I'vli-uralion Plrrn irnr.iect thar is parl r't['lhr: hrtuder Securitl'

Pnrgralr. The Securitl, tlrogrirrn ls Íhe responsibilitl't.tf ihr: Pitrgrltrlt f)irectol rtho is ir ntt:llbc; ttf

$e -l'LS cxcculirc hourd. TLS stat€ thitt !hq:ru itrc sutïic-iettt resources lo cilntillete irl: elr\isagcti
IruL'cti itrcl rlrat ti)e[e 1rr rr,eek]r,mcs(in.gs hctrveen p:o-iect l.l:;tchrri;tnrl ehc []r(19letn lllilràlt-ucnlullt"

Hor r:hangcs i-rt \atiot'!atr le,r'el {inrr,rl,.ing PTOsi (hÈl'Ë is I prr:-*sirlinu plucess t'ot'itr(rr-rtltlsin.s
'l'h:s is kttotvtt iri the Nationti llhar:ge illli Rel(1Íl\tr
ciran-ees ro lhc rranspor'l .ici:eme/st'stenls
Change Àtilisorv Bourd {NC"{tsi ;r:rrl thc National
thc'National
rnirnÈ_{e!!}È11 process.'l'hit invti:r,r-'.
(NRBi.
aspects oi'lhc rcquest aud \RB cqrnslclcrs
tcch*ical
thc
harrdlcr
NC]..\B
llclcir-su Bsrrrl
husirress asFel-ts belbrc giving finri approvai-

Arr or.en,ieg, c.rl' {hc n(rrrlrirl tlutr lrlPlr,l) pro{ic\s rvus provided rr.lith xuppcrring information:
'lcrticipan{ clstl*ain"
lr(rwcr,c.r. thc detail ot rvho rlqrcs rq h;rï il'as not entircl) cleirr. Therc is I

nlthotr-rrh th:s tcnl rs ntrt detrled. Tlre crverrict' Clingronr shotr.'s changË rcque{ts ger:errted hy P1'Ol
qilrrlcs out a
llthclug.i.r Tl-S atrd suppliers aru rrot r:tentiorled. fhere is a "nrtlittnal dtrnreitr'- that
rvh<-l
lc;td5/rr-'sources
stated
!s
not
hut
it
Nrlte.
schene conrpliance ils$clistllÈrlr ancl tiraËts a Chlngc
rhis. 'l-he "crrmbined domain" is the crrnrl:instion of the ){C:AB irnd Nltlt. Whilst it is meutioned lhat

ali "participtrnrs" hirve íl sear or': the NLI.{B. thc representation on thc NRB Jthflt takes the linal
dccrsion! is not stated-

'TT-S shrruill crrnirrm this tsr;umptkin

vt_0

ROVX1. HOI-I.rtrr'.1\.. [.]:,ltvER.StTy

ttr LOrrxtX: Infornration .Sccurit_V Grr:up - Sntart Casd Centle

3.5. TLS Own Risk Evaluation for the Pmiecl PIan
'l'LS hls quite righrly und resprlnribly.. tned to idcntifl' risks to thc activities in the prrlecl 2lart and
'tLS rvcrc laqk rrf
where pecessar-v introduced mitigating measurËs, The main risks identified byre$ouÍccs. lnck of cxpertise. insufficienr reviews and effectit'e decision making b1' TLS/PTOs, TLS
'[LS and PTO stlff. For rtdried cxp*tlisc an<l
a<ldresses the resource issue h1'- piaming to involve
rcviqrvs" rhird party' cxpeFtri ure lnvolved inclutting TNO, Thalcs ancl Vcn\À' norninces. According to
TLS. the approach to nrotivating efïective decisiorr making appÈani to be nrilestone Pressur€ qrÍ"fllcd
h1, cxternal resiews. public delirerables :rnci hlockri on sontc husiness initiatives e.g- roll-out of OVChipkuurts ur abcli shment ul' Slrippcnkaiul s.

vt,0

Rctt..r.l- IIot-:-*tr'i'r. L',rtr.r-nsitt irï. l-r-r\Do\; lnlbrml(run 5cc:,:nrv (.irtrur: Sltta:t Ce:c Cr'tltrÈ

1. Project P/an Reriew

d.1. Revierr of Itlanning
Orrll tlre lrllrrnir:g ftrr Pjrasr I ca::;rr:e..'ienreti as the *lher phitsr:r ure \till al ltn ,.rurIinc slsgÈ. ThÊ
1:ÍsÍ i)[:rlisrvnti*n is thr:t thcrc ir l: lut ,*f uhnllcrrg.in,g lc{i\ ir1 irt Phase I thrt is sihr-'duied firl
cornJrlctirrn b1' tlrc enrj nf (Jctobel ]Íl{)S Althrrugh the tiarc lre\\u!'cli itt'c ttttt!i'rslrrtr(:. lhd :u\ it$ ,it!:rl
tlÈrrsrl rrf lciuritr svstcrnr nercl tr,:nuí:t: irurtt hcin-e rurltc.i itnd )(r TI-S lus ttte rtsllrrttri[rjlitv to
L'nsurf thitt its Fll:':s atrd timescrrles *.t* realiiiic and \.ill *rt'i c(rnlF:ot?'?:sr: tltlitlllr

Ri.k iuillr'-.r' r il rr'nrkslrcrps .':.in lrr rluitc lznlÈ c(rn!ïtir.lint hteaur* tlf iirc t;ccci tu collc'r'l
trpiruru:rr':l:ïlnn:rttrrn irorn r,rril.riis !'!illirr-\ ur:d lherr'is tttiett.:tl itL-rírtive enprcach useC li'rcllne lnri
docunrellt the ïi nding: t f RHL-L t erc censideri ng suc:h :tn csr:rcisc the n ilt lcar! I rr o n t rrk s!:tïts I ui
rrpporcd {(} thc (}nc in the -;r!arr}n'oukl lrc *chcdulcd. rrs t1'pict[11'ehere ctn he iigttitlcal'.t discusstein
antl innut nfieï thr: drati from the iirst r','nrksi'lop i-s clrc:ttlltr.'C.'lb tcrnrple(e lhir tnsk rn (Jnc r$rlnth
and dur:r':g ti:r'-\ugust l{)Oli hnlider perioi seerrts quite *rrrhitious. Thr," ri.ck cil$lii be either thal tht
nrilerterne :lipr rr: perha2s ljrat nr-rt 0ll lclcl.ilfit:rputs itn,J ïit1\.s at( captr.rrei[ tn thc itnliir''tr
ï: ts lrot Jlc;rr hi",i rhr: r:rt:u?*lr.ir frt. r',ith tltc Fr:rud \ltrnilLrrins:urrl \lununr:ttt(:1t 11:{ricJt 1i.!ndÈt
thcSccur.ia1F:|rí.:ri.t1.;rti:i.ttt.leiirr-r:ei||]:r'it.glrrrralíi.uu,l'li.t'll(d...li,it|É.i!i,,rírtil|brR(.lt1(lr(]i!]
;r r'isk ilsies-ilnc":ll r.1 i[] initllllr tiliut on the tisks tu the (".il*rll. Jstets t$ hë pzr.'tËitr"tl. itttirck
ntcthrl(ls irntl rxislrng {[(euuti\u l|n(i i]r)rT(jutt\.c nliii!\l!t'r:\.'Í'hc tlr:l:ctenl:tl-(:its ri'lll thcn:-:utlcrillu
rec0lllntÈlldatirus tb:' optimisuti(rns. ihrrrt tL'rur itllproÏertler)ts and the iniltl. requitelllrlllis t(r:'
r::prrrrcti scctrritr rolutlnfi,i írrtigrliinnt .\cc:onlin-u llr th,i prrrir'r'l p/ttrr íhc nsk its-rcslntr.:l',t rti;l :;irt
t<-il'l'lplete. Lluii: thc' end oË .{trgust lílilS- ri'l:erels llte rc'gionhl .il-rrril r.!(r,ldc('r,lr'.'!I 1tfuirl i. clttt-rl |
Augui: lil(i.{ Tltr: rtisr'r È c(relcerrl rlilrt tlte:c rtrii\' ['rc:l:alcocr:llrl:t rir \lt:[rl;cl:tu rcrtlrnril;ut[i+r:xl risk
'

itiie\\t:ldnti:rr:,J:l'sc rrrÈ tl':È rtrult-;.nd,iec:.it.t:'.i ttrnsirtet:[] TL5 .!rLtuld hr'lrkec tt, il;ri.fr tht

lirllr'rrt i rtg iurtrruirl :cs.
It'thr.'r-e ir :r singlc risk tssessrrr-ni. rvho is in chlrqe rrf it iJrt(l rttakes ti:.'dr-'cirir.ttsr ltl:rl trtt

rr,lrrt hitiis tt'lis (lrc rgiorrril /iirrrr/ lrrtnrt.gculrrrí trririrr istur;rl hclirrc lhe lisk lr:if\.nlcn[ \rits
d,,:e :+ crrttt*lete,o

- ll :;rrltlplc risli rtssessntent{ irrL. p€fi$rnrr'd',r'ltrr.s ir: trrerlrll ch;.rrgc oi thr-'ttt:rtd llotr !1
r'tln i i rICtl g i (1I {}'i:lirUl i-f: iliflI i;i llL'C'

l-ollou?ri! thd rlik nsscssmerlt'r-i:Ërr i.:re tiisks to detlnt'r, Cr:rttlnt<':; Criter:;r tCCr S*cu:'rtr'ïtrgct

iSTl This r" usatlif ii llrL.ijt-t:s(r: l* th* forrttal CC .rt'*luairon rrf l \\'\lrrD. í:.r rtlLrrtttrn' l*
rsrtrtlrrrs,:rl ]cr.:ls i:i!n bg ve rv pl:itlle !'ronr it securitr DË[speLrt:\ e. buI catr i'.lsrr l-.e verv ti!11('
ccnsurrrirrg :u'.rl rvili rc.lv tu: r grcuirelr dcfincd ST. r\lahorruh nc rnu:rÍi(.rn ir .s:rcn ol'a pl;rnnccl ('C
cr,aiu:rrion tt i..:,luc\[i{.}t'}ulr]c r*heehel-thc S-l- eould actualll be cermpleted in ntru'::'tonth 5i"J.:'ins in
:à?il'id thÍi the;rr'l seleÊti+r'r task i\:uirnirrg in parallcl lnrl lhc tturk on thr: l-lÍgh lctr:l dr.''i..:n rlo*r
nrlt:rilrI un:il :hc tir;:l't S'f ir;:vaillrbl* -fLS rvould be a'jïi'ec t,r:'e-check $.ith rheir CC rldYistrr.
thilt thË tin'rc'.rrliiirblÊ is JdequctÉ tr:: !]r{}JucL'a qualitl" ST.ud ix:'r,. :t ntrul,l trc tr.cr,i ul l]:c Phu.u.
that tollcn-

The CirrrJ selt'ctitrn ilÈti\it!'is shclvr::rs l soln l:rsk:n thc planning chilfl \o nr.r r:inting dr:tuilr l:rc
pri:r'rrletl !ur duturlecl suh-t-:rsks: thÉ tx-ik shcrulcl he L'xpÍlnded Íurthr"r. Within rhe tex? ol'(i:c ,,rrrrjr"r I
P/rur it Izrdic;itt: t!.lilt the activitiL"s ir ill :nutr]r'c :dcutifl inti rari! rcplliJËrrr(nt e unditi;tlt:s :tr:il
\Írtr Íitc;Íl \r.:\ -1r1,'r"liIi' il:Ir:;trirl r:']Ítj-.lrc Lr-sht t.rrtí: l:rting crrnst';trcÉ tr- lk< lr.er-n:Èr::

vlí-)

R()\.,-\l.llot-t-ou.-rr'. LÍstvrnsrrr'íll l-.o\tx,)\: !rfr:rntltiozt Securitl'GrLrup - Sntitrt C;rrti Cetttrc
ilcr.clgr:izr,q u sc6r'ing procËss l'or struiturecl cgmpirrisrtn. Ir aistr appezus tL) use inptrt lior rt(hcr tusks
Íalfh6ugh ihr: rul'r:ruz;rcÍ íiri: rtot ir)nsistent \1'ith tlre plenning rhirrl i, rirning:trld ct)st issues. resicluii?
r:sks lu:{ the rjecision tloclrnre:lt {rcl;r(cs to rtti;ytrltion triggersl. The stitrt crl'th* ca:i! sc'lr--cticrl: task

seepts t{r ort:-tlai(: ull rrthcr tutks. b*r unr=xpectedIy"ilpFeitrs L^lrx(: lt) co:tlplt'liotr tretore ihc rirli
ii\\cssllcnl 1r:rl .ST rlrrrk hirs c+nrFieted and Lrelcrrc lhc Hí.:rrtltiteclure r'r,tork has r'.ill1\'(

Thr. Iil- iirchitr.ctul-€ tlrsk is i:c:nilru){uíi t* rt'r?hr:: (}t:e !}tr)ltÊh aud does nt}[ sl.ilr: unt:l ihr-'cald
-.clcctrcrn tirsk ri r',i:nurit fi:',:s!:ed. Tlris 3hasin-e is unerpcctt:d its thc HL s'rlrk'.';nuld hlvc hccn
crp:ected to r'ur: in 3arlrllel rvith tic cirnl rcl+ctitln cask The reltson is thilt tht'lrro tlr.iPl:s are
.::itic:irl[1' lrnkr:rÍ. Ftrr urlrnple if ;nrrr]r:r s]'ntnletric key- rlgerrithm lrpproach :s chosen :rs::sed lbr
\,Íifare Clasr,ict that :j'te) hirvc ihe l+ast cl'l'cct on lhc ir:f(ilstructure at'chit€ctttrq trntl tlict:rlc il cÉrtall:
\cri of'citndldlrtr: crrris. $'hcrÈi!.\ ií u PKI ilpptorch {its n(rted tr:r bc rvithin sctr:re tlf :hr:'-securil}
irsicssrltenti is usr'd. this rvorild hlrt: rolt: irttltitcl (l.l tht-'iIÍchiteL'tur€. tlud .'lr:icc. KÏríS and
nt::l ttrnutttuu | \ stlc-\.

Thr lirs{ prrr"t rrf Phu*c I is Íirt qeutatilrus tot'the',r'orli tn Pi:irrr: 'l antl .1. \\ltilst ti:is is the letst
r:r.chu:ctlll de:nanr.ling r-rf'lht: l;rsks. t',rrr snrkitts ïvcËks ntiru he averl.n- nlrtLrilirtus :l'r.ilr(.rft:s irrc hJsÈrl
trn (ieïili lcrl s l':c'ci fical iill::.

Thc s'-cncnrl i::rpreriion is that the tinre allocated t(r ('(rnlFlc(L: Phasr":l suutlt\ l()(, sl:ot't l::d ïhe
phlsing ol li:i::trh-tirsks is ptrzzltrr:t.

1,2. Itcvicrr of Deliverables
l';:c "Strrrctrrrr:cl Sucrrr:tv r\rrci::nter:t^'rlclirerill'rlc lcc*tds J itÍtlÈtured risk lssessntenl iri thr: O\'
(-hi1rk*urt sïstem. focussin-l l':::rin[1 oi: th€ cilrd ÍLilt thc i:ci;t:sr rl,;vicus/:'c:t(lcr: ll.ii lrtc ti:e TI S
Lrirck cllice sïstenl; ÍL,tl, u'ith r!'!J:rui't ttr 1:arÍicul?r iSsur-'s rrisins tlonr the \Íiialc Classic lt((itch:
Tlrr'rxecutiurr ol'thc rask arpeir:'s i,r L.,e .'uisourced r.o'Í'helts CËACll'j, r,;hiÍ.:h 'rlri) lrarc :ttflueneed
lhr: sclr,:crlurr;rl'thc F.Il[(-),\ r:rsthodolr)È\'. althrrugh it is rtot cielt rthich.]rgtlli,\iltion i's;rrr-rr,'icl::.9 t-t
"Risk Expu-rt" trr ir:'ad ihr-- ta-sk. (jir',..n tlut risk aisessmc::t benefits lltrnt intcrirciillr: r',itlt::l:rltr
irr[crnirl :,tul'l iinrl L:xpL'rtr"'Í'l S *o*ld hc cxpectetl to !ead irni f:tcilitlte tlre task, r.tsin-u [-h;llcr
expÈrriir- cs rLp:rcopt'ilte , Iuter-esti::g11., rrrrcier lhe ritrlir,crabls r!ciinitit.rn llrc .S"f tiurk ii tlcscrihed as
prrrirllcl :rctivir\- althttuglr ir is si:trtrn as sequential utithir: the ;:lan. lt is utrclert il'thr'tlelivcrilblr": ir
iust tle ou(Dut frDnl the risk r-\)es-\u'lent or r','hether it \',ill ill$o include thr: Sr:t:Lrrit-t l*r1rct. Níc:'t
rclcliq'rÍ tccIn:cal uspcctr. u:c tlc'tincri tc: l.e withirt lhr'sc+pr-'of the tts]J,jelilernhlr' :tlthorrr.:i
o:gailisíttiLrrll aspects irnd I'I'í\\ithsit{ iqïtte \ are crcErrclcil

''l-

'l'he "Hl- Destgn r.rf'(hr.: Securitr ,,\ruhitccturc" rlclivcn:hlc ir ilescrihud irr ;:cfL'tL'rlce Íbr the cntd
:electicrrr rnrj fi:r dc'lu.lrlpi:rg tite Speciflr'ations Documení. Open.\rchitecture t.SDO,\i;rntl shtrulcl
llsrr cleti:il rvorli pac:kitgc rctprircmcntr. Ít nrcr:tron; lhat tlrc HI. tntl card srr'lectltrn *'ill interact 1<r
Èl)sute il titting contbinatiorl hor'.er-e:-. the phasing crl- th.e r,v*rk pliur docs noÍ \\:cn: to lcfiur:l tltis.
rl'irh lht: FJI-. rrurk sturring ríter nr<rsr uf tlrr: crLrtl sclcction actilitl, In the actir itir-=s list it state-s that
tre IlÍ- desi-un is hased on the selectecj snrart uílftl 1n(l tfic risk lrsr:\smqnr tvqrk. rrhrcir irrlds N't'ight
r(l the suêgestion thar the rard is selected befbre thr'IIL design is t:onsidereci, It is not cicirr ruhich
or_sunisatir-rr, lr:irds rhc 1115|q ill(h(.r.rgh l]'l'0 tuuhnic:tl (:xtrrËr"ts irttrt Ti:nlc-s Tra::spo:l itre irtrnlved ln tht'

llJ t'hL: r: il rc:ttretril liih lh:rt re:r'rcrl oul ihe CC ctiiluirtrrrt t r: tl:c I'l'S0 Scr:uru t] .\ppiiciltrcr: IÍrdu,+ tlS.\I{l

vt.0

l{l

Roy,r.t-Ílot-t-9rv..t1., l-lNtvÍ:Írsi11'1.1pl.1irt16r: InforntatitrtrSecuritl.'Grcrtrp-.Srnirrl(lrrdCi'nlIe

pr6jccr crccution irlong rvith secuntl'and smarl crrrc! rpcr:iirlists- The qualitl'r.-uterilt ilrc r:nlnl\'t()
ensLrre tlrrt r|ere is adeeuuts dctr:l ttr rcelcfinc the SDOA ar:d begin some FrotolllinË.
Í'hc "C:rrrl Sclcctiorr'' deli'r'eroble/task is a structurcd antl docuntcnlcd llrocedure ib:'seleclitrs :r ;:c'.r'
card iechpo|.rg), 1-s part rrl'thc rivcrall ic'curit,v-:uchitecture. The actir'iti,;s ltlryccÍ tlpical lbr I
s).\temat(i(: protlucr rcrrring an<i selectioz': prcrce,ss. lt i-s nr.rt clcar rrhicil ot*eatlisltiott leacls tht: task.
illt]1ou-eh it is r:r-rterJ that P'Í'O sÍpurts u*.. rnt,oived x-t lr,ell it-. securitr, ancl smlrl cir:ti t-r'peris. Neu'
'7'ht: qtt:rlit1
lrurirrcss rL.qulÍL.l:)Ènts are ,lecllrred rrut (rf \C:opc. *'!:icJr \cerllri lilthe!'s!:r-rrt-slghtcti
c:iteria crrnect[]'ncrtes Ihirt thr: rciltrt:r:::tcnt. fïr:tn lhe rer:ulit1 :ri'ises!imel]t shr"rulql lrc;,cctritlrtlrld.ltedtcr hrtpPen
hirr :l rr clitfiuulr f(r seL'l"to$, rlre IIL design cu Lre satisl;cd rvhi:n tllc rc-l:rïr-'d tasks see:::-fJris
.'Open
'l'hu

is un
Cr,vplttlc{-t''.
qartirl' criteril alsa inc]ude
atit'r ti:e ciircl sclcction t:t$k.
irnrlrigugu.i tern anrl no( <Jetinerl rl'itlin tlrc prc.ic<'t plmt. ll is theretorr.' !:ect'sser): lr> r:xpk.rrc lhc
poss!b?u ntcunin.s: oi this teÍtn errd ho\r'it r''"lates to secur!ty ltntl ctttnmcrcill issue'
cl.2.l, lVhat is \'Ieant by Open Cryptology?
Cry,ptolcr_u1 i\ il term usc:(! li.rr rhc crr:nhin:rtirrr: of crvprogra;:hl'tcode nraking/uir.'l i.lncl cr)'Fliltlill)'si\

{code trre:rkir:gi. C)ur irlteíDrËtiltirr!: trt tle \en\\'t:r-itcrirltr is lhir( it is rclrlll'"Opu'rr Crlptog[anh1"that is ol'prinrurl, Inrqrcsi. Thu tirllo*ing dr-'*criptiocr s,ill therel'ole iocus on c:]'Ptogrilphl, althrrui:h
we $Íe of c,.rursË looking *br a solutlon that rlill render cry'ptanallsis inerfl'cctjvr.:.
Frunr ir ic.cur:tr perspectir,e r,1g rr,'r-ruld [:ke t,--r see a card techncricrgy trasccl (.]n cr]1.11(tgritJ:i:\ th:lt círl
hr: sr:cn to trc Iit li-rr purprlsc i.c. it is inuiialllc frrr.critical telierr''. it satisl'ies i-.ll requi:'ements
idc,tt:tieci tro::t tJes!gu. risk lr.ises-*rneut iini agurcssivtr lcs:inE r:r;rvpt.linl.. Irr ltclplng. ttr lir:rl utr
irnpro-rr:r:l u \(1|u{ií!n *'e recitlI rllc tiilI rttr i ng Jtrinciitlt'i
iti 'l'hr: rccrrritr. ol'thc solrrtirrn tlrLruld nor rcly. r)tt ti:È sL'clect ttl'ti:e llgr-rrithnt
b: The kcv sizt' should Lre in itccotJlllss rlt{h lnlsl'llitti(rnitl rt:c.-tttlnrcndati(rr:s
ct Thc rigurirlirn :r::;:ic.i'i:entltion sht:uid re sist ettacks tntde a-saiust implenle:tlatio:"\

It i:,:eir.i(rNrub'lr'ttt:lsrult)rt ihat sonre t:ublished irl-eorithtns isttch ls AHSíttS,.f i itre;trrsiclcrctl lit'
l'or-purpgsr-: Lreuatrse lficy ï:avc: srrrrirud rigcrottr ruvicrr b1, intcntlrltonitl c\J.tcrls 11',-' llicr knertr'thar
it i-r po-ssible ttr inrl:lerrrent suci algor.ithrls in a rnflr)nef desi-uned trr t-esist lttacks iit'td tnitl lhir altack

;r:ritlltncu can he ltgcr<.rttr!v lcrtct.l br ctttttrtturuiRl :llbrrraltrrics.

'l'hcru ;rlry rvcll hc rrnpubiirhctl/pr<.rpriclur; alr_:trfithntr lhat *re .iust ;rs gtxrci ius pulllishr.'d
algorithnrsi. har.ing treen expertly'cle,si-cneci. revieu'etl itnd tested in a ri-ucrri:rlts Initnn(:r. ht)tr'ct'er
ihcrr. rr':ll li$irl's lrc grr:rrtr:r \ccpÍrc:sr;: rq'i:cl) iiri algrrrithnl is kept secret. h is a gener:rl
recolrrnrendation ot'RltLiL thflt cï:lptogr:lphv used i:', slsten:s cr!'nitticrnal imFortilnce bi: lrascd rln
;rilrorithnts (hut lttvc hccn ntir<lc :rt'atliLï:lc for puhliclcxpcrt scrutin-\'.
Clne definitioll (lf rhL' "C)p.rl Crlprogrirp!ry'" criteriLrn couid l.lt'thr-- ttse of pulrlishei ltlgorithtns t!:at

havc irern succe:;sl\rllv evllrtatt:11 b\ lhc ernqr( communi(r'.'T'lrr,t lcrnt "Opcn" titlt ltlrtr rclíitc t(r
Intu.llectual Properrl, and LicL.rlsing. Idea.ll' the alga:'ithnr should bu' ti'ee to use and not b(tut'ld t(r
rcsÍriciirc liccncr:s or rcirn(la(or! [eEr. \\hi?sr this is primarill ir crrtnrttcrcirlj issu( rhar ltifccts tlt'.'
costs cf cucls. infrastfi.rcture rnd c:?oic(' of supp?ier it could heconre il securit)' !ssue iÍ'uommcrciirl
l:u.cr:cc rcquircrncrlrs crertc il rrrarkct for ctruntcrfcit producís. Ir is also pos-sible to híIve atr "Open
[.ranrcg'rrrk" lirr cnv,ptourlphy, ri'hcrr:hy onc or .n{.:t-c rrl'it rang:c ol'itleori!hms crruld hc '':scd lrccuusu'

\i!.0

ll

Ror,,qt-llr:.rlI-ou',r\', UlrveRslrr oFLo\Do\: lnlr.rrnrarirxt Sl'curi()'Group - Snt;rrt Card Centre

*'rrrtlcl ullnru svstenrs tr-r i:sc crther "tiee' o;
r''.c inrerface contbnns (u an Open Stanciard.
ctrtltttlercial
chcrice,
otr
antl
dependin-e
securitl
licensed algcrn?hrrrs

'l'his

4.3.

Revieu' of High [,evel ]Ianagement

hr tle nr:rmll change rnat)agen'rent prrrcess of 'IT.S/PTOs- r)nce il changu h:ts treel: lpproveti th'crc ts

iu: ohligation Ibr ali pirticiprrnrs tc. inrple melrt it (áilhough the pennittetl ttncscalu' 1-or

irnplemcntirlr(.rn \t:ts rrrrt detlnc'd in the ;nput clccunlr'ntatir,.r:1. In the casc +f ?lt ntigrutitstl;71t?rr rvt:
rr-'q*ire ïhr. process {{.) itppt-rivc lhc nrigrtrtjr.,rt pÍrtrt, btrt not huy-irr i:ttpletnentation trnltl lhc l)ecisit'n
l-ran'rr:rvprk isrill rvtlrk in progresst r:iggcr. r:\i:cutiotl of the rttt'qrtt/ian plnn.lt is cllou-sht likel,r thot
rhe Decisicru Franrervork irscll'rr':ll ai-so lesttlt in schcmc chrtngc's prior to trligt'ir(i(-xl irr it re<;uires r
ltc\\ opcr:líi()naI irnd decision nraking prr.rcÈss plus suppoltin-E lesls. lruit]s unc'l statistics gÍlthe.in!:

Wtriist {[e rratir;nr[ Lrrgar]ts.rti(]n :rnd c!:irnge cotrtrol príJr:(:ssc\ upJtear quite t1'picul irnti tltistr tu
inl,qlv* sunirlrdecisions ntakers s'ithin thc lppnrpriate orgatrisatZons. thcy'risk irttroduciion oí dclill
i;:trr ?hr'nriglation plunning FroriL'ii ls the NCAB and NRB rv:ll lreed udequate tinte tr.r rcviËu'atrd
discuss the tech*icul irnct business aspectt <ll'lhe prtrposr'd /,r..g,tlli.,rt ltlan lt l. :lisit intlrortlnt trr
nt'oiC duplicating the cliscrrssion rrl)cÉss onÈe the trigger conclitii'uls ÍlÍe ntL't. The onlr tcïiuil)'
slou?ci hc thun (o corlíinn thirt the tri-uger i:on<Jrlions ere indeecl coffect anrl thcn lc lruhlish tht'
irssrrcrarÈd Change Note(sl l'or rnundaÍorr etecution of the rrli.cratir.tl lttrttt.
Greater clarjrt is rcqurrcc! rcgurdin._e u'ho at'tualty rnakes the cfrtnqc note decisions s'ithrn tlrc \RB
*'hc'r u,!ll apprcrvs th<: nii,grrtior, l,l'rtt ar:d decide lvhc:n I,he tniÍlÍirtioll trigget
iurrl in

Far!iculat

condititrns are llet.

,1.4. ltevics of 'I'LS orvn Risli Evaluation Íbr Íhe Projecl Plan
l'hr-.rc:rrc.:r i'i.*'risk reduction ciccirions:hat shou:tl he nrrted tinrl'l'LS'r rrrt'n rttttk trtt risk
idenlillcirticrn irnrl tuit:gltio* Íirr tlte 1tnt1t'<'! 1t[ttttBeciruse ol the lilnr: prcssure rln II[- Securitl'Architecture unrl Crrrd Se:ectirrn tasks. thtr
nritigatin-c nt(:il$(rrc is nct tc considÈr neu business requircmenls. ['hir i'ou]d he a nristake
thar his significant Lru,sine-ss inrp:rct in thr: l'uturr:. Srnart CarC sy-\tetus r:rlien suÍ'fcr br:cÍrusc
"le-eac1-" proLrlerns itrc tL:s:gnutl in due tr) tirlle and cost pres\urc,{. \\ih:lcr tltere:::r.1'tre
in:rufï:clcnt trrtre ro cor:s:cier particulttr neu, busincss initilrtilc's itt detail. it is recontntt:ncicil
thilË s(.r?Ttc r*:rsrr:tilhlc e lïrrrts ilrc used (o ensure that urigrati<-ln tcchnuloprcs rtill h;.n'e flex!L.le
securitl'and applicaticrn cnahlsrs lo suppoÍ1 future lrroducts and sen'ices,
'T'hc (lhrp Sclecriorr is descrihed as starting Í'r<rm tn cxisling short.list suaplied !r1'TNO 'l'à*

criteria uscri trr sr:arch irr Fro(iuct\ and cotrtpile dris initial selet:ticrn itL,i ttnknt.t$tt- Cleattl'
óe iist should be as cr:mprehcns;vc ar possihle utd u1"siguificant fitteing should bc
cunlrncrl rrr thc. Chip Selection task. The list rr.ns not prí.)vi(ic(l rrs irn input drrcutlrcnt t'or this
Ie lite\\j

There Ís a risk that nr-rt all infrustructurc up.erades can br-' identiiiecl iu.lequ*tcl.v.'. 'fhe
nritlgati*g lnL.asure proposecl hi't'LS í1r.r copc with tilnr: pressutes). is trr deal r"ith lhc rrir-irx
supplicrs tr) ctr:iurc that rt lt-'usr 801i of the upgrades iue coverc<i.'l"his :s ttnll u reas<lz',able

v 1.0

ll

Ror..tL IInLLT-rr'..t\', LIttl'rRsrt't',Í.)F | r]SÍxll: Irrfirrnrltior: Seturitl' Gror.rp - Sntitri C'art! Crnlr'c

comprolnile il Lhe 801i inclu(jcr eli fccuÍit]'critir-'ul upgrades and C(les n(r('citl'u;: "wclk
l;*k" rn tirc s1,'stcnr. Tl-S shoutri conflrr:r tll{ all sr:curiíl.criticai upgr:rdei are hein-s
addres-ieC.

Anrrrher cl\pÈern voiced t'l I"E-S is being. al-'lc tt dcíine upgrude-c in suÍïicient detail th;tt
rrpalrr:rs rq,ill hc rrhle !u lrroi ide cuotótions/ol1'êrs tbr the s,ork" 'fhe mit:gltrr:g tllec,\u:e :s Lo
prioritise the n'r!ting <-rl rFr:crlicrtlons n:r tle critical upgrirde path. \\:[i.51 this is rr t',:tv ttf
oplimisrng thc tirrrc' ;r!itihblc' *,'ithin the ptrijt'ct irlrut it does ntrt tlter thc fittt tltac ;',ll rhe
s;lecificltiernslofters are requlred to L.e linalisecl belors (hr; l!ÍP\"f .

The Decisian !:lanrervork discussion nlcnli(!ns l rrsii ro dr'r rvitlt "not kllo$'in-tr ah(ttll
aiÊq:rni:ltrcs ru nrigrttion rnd lack oi knowledge rrf thes!'told values lc Fu( inlt) Íhc lnggÈr
prLrcËss". llorveveL the reqnirenrent f(rr a lnggqr rncchir*isrtr in tlte nrirlrtrlitttt pÍtttt is qtritc
.inrplel if r certaitz conrhir:etion ot'tactols 'Jci:urs then the "G(J-Frrqton" ir presscC utd the
rrli,grlrliílr picrr ts e,\r:cuted; nr'i*:rrttrng lo lfrc nc'u'card tvpr-'/tectrnolog\'. An1'Lrsefr:! .SRlWs
nrll'hr'introduccd r,-ulier as no:.rrlal da1.-tcr-dl1'hc.rsiness in r.rlrlcr ttr clclay rnigraticrn h1:
keepin-u the rrri.qrtlfiol;;/rlr lrigr:r:r factrrrr l:cíor,r tolerullle thlesht'rlds An rdd:qicrztl risk nt.rí
rner:riol:tcl lr1'TLS ls uncertriintl over g'ht: ntakes the ljnrrl dccisttttt l(? ltre\s the ''Gollutton.'.

\lonittrring r-rf'buck ollice renrrrtr ilnr! stirtrstics ls irnp()rtlrnl hoth in ileterrttin:t:g tectors to
contlibute to:::igratior: tri-egers rrncl the th:eshoitis to lppll'.'l'hc l-iicrnrs sh<ruid tttrl ottlv hs
thc l*r'cl ut rrvr:nuc losr rlr ri:ler'::n1 tiaucl. but alsc the ctrsti ol t-etned;,al m€ltsutes itttti
)rocL'sses.'rhe t!equenc)'cl'erploits ancl ti:e d<";ecticrn antl ':llLsrilicitlton trl r\llorl t\'Í)esQualirv Col:t:'ols Ébl the three sulr-prcr.iects arc mtinll'ensured h;- intr.rr:irl itn(: !:xtc:::irl
ir:'rí.in's. Rcgirrrlin.e it \t;itcllrcnl *'rth thc Higlt I.r-",'c'l rlcsign under qu:rlitf il s;r's that ''the
IIt- iit-.ign shouid t:e highll compatible with the existing inlrerstr*r:lttre" \\rhtlst ihr.: rlus::c
lbr t?::s i-s unclerstantllhlc it scun \ t(] cr.rrÍiir:t u'ith thc !e st rr.:llricltve icitÍ-1r.' of ri:c' III. tasks

4.5. Srtrnmar3' ;rn<í llevier+ $'ith Respect to I'enlV Criteria
'lht: crilcrion ltrr thc yrr$t:r't prirui itscll'ts srrtt6rtl rll:cthcr rl ir rcasr;rtahle i* rr'x1:ect a co:'t'tpliaui
miqnttintt 1/arr h1 Jrne 2í109. \ir..n\\: hirs conlinnecl that "compliant'nleiur-{ atltlressini:;rll th* Vcn\\I
urircrrr tíur :hc mignttirxt Trirrrri :tr:d heirr.g a detailed "exetu(ir1r)-r)nlv" plan. '.'r,'itlr lll dr:ciqicDs.
'"'<lrrrpatisr:ns.

selectir-rns, ncgoriilti(^rns. ctrsting. budi:cring lr::il cácLuilcd lrllut:ling crld L:olltract\

lrirving heen conttrleteti during ihe irrrlecÍ pfan period. The nrfgi'rtllon plttn n'il: lneltrclc thtr tttaln
esecntion pJiiri Ichangeo\rer IL! u lle\\' cnrd/technclcrg]i and ln unalnhil:urtrrs dcfillitio:t ol tlle
ticcrsil:r: ïircï+r. and authorisc'rl partier that rrigger it- An)' SRI\'Ís should be descriheC u'ithin thc
apllropriil{e uRionu! .iizttrcl lrtdrtar;enrettí Dlattr lnd ncrt s'ithin thc tli,!rnlinn p!nti.
fjasu<l r.rn the tjocrrmcnÍittiL]n reí'(ivurl írr.rm'ILS. it rs cvt<len( thar TI ..S iiiri c'rrtirriicci the Ven\V
rÈquire:'!'t€nts itnd tire recornnrendctions tiom the original CE report. Consiclerable rc\(lrrrcc aplcirr\
ir: htvc bcr:n cr.'rnnrittcd to thc projcct pltn. a*d rvidcr ilritialivcs {SecuritY Progl'a:':rt i.ave been
-l'he
initiativcs shcruirl hclp
introduced which extend he1'ond the requirenrents lbr tire \ÍP\{.
inrprovc risk managcnlcnÍ ànd:hu handlin,s of tiaud;utd securitl. i-rsues for the hrture beue{It ot
TLS. tl:e PTCs nud ttre contiderce trf tlre trar,e llin-c pub[!c. Ct.rnsitlr:ring thq cÈtrrcnt r"crsion of thr.-

\r: .0

í{or'..,t [{crt.t.rtu'..t-. Listr,'r,RSïr} (,)F Í.trrfr{rr: Information Security, Grcrup Snrart Cirrd Cenir-c
/rrrrjcc,t plurr tt woultl ai:pear drat all the VqnW fr-itcriir are [:eing acldrcssed n'ithin the planned taskr.

rlthouglr the tnsrvcrs ro lhc \tnW quÈstions are stili unknonn: lleitr-e wark in prr:gress. The
contribrlti(ln\ and responsihitities o[ the rirri*tts Pàfties to tasks lijdre-.sing the VenW qtlestions ar!:
not full)'ieflneci: ancl rhis is a cuuse fr-rr r.'oncenr. ;rlthough the skilÏ sets Índ experl thltd pirrties are
defined for -rorne initiul tusks.
I'hc conrplerion rrf the Phase t rvurk in u Írranner that rvill itdequatuly' nlcr't a:l ob.iectives ilppcrlrs
extrenrelv anrhitir-rus tcsJrecialll'rvith respect (e ttrnc\calcsl. Risk *-\sessntcnl rlrlrkshrr;rs atr'
rx.lvisabll,itr.ratlve over multiple rr,orkshc;:s and the nvailabilit;" of kty personne! iTLS/P'lOs and
rhili partl'e\pcrtsl. fhc tirzrr-'for docunrentati(rn, rcvlqwing rnd responding nleltn {hitl ccrtlclusitrtr
*'ithrn a.nont!'í iespècinl?."- Augrrst/holirla_r'trnlÈ)\fr)uld be dilïictrlt, The Hl..arcltitecïure u'ork dttes
nLrt start until rnid SL'lÍenrher 200S and includes a demlndinp set of tasks relateci {o <ir"lctrrnt'ntitrg
clcrigns ar:d defining det:riled ur:rk packagcs. The IIL task shottld bl: itcrrttile lritlt the carcl
selecticrn prercsr) {altlreiuglr car'd selection sub-taskr and interrnedia(e nrilestones ltre aol dcfil':cdi. In
iurnlrltr\,. RITULlo;ouirl rrcrt hc surpnscC if t!:e end of Phase I :lipped or thar tl:c' delil'ered drlÍl ol'

thr ;.lrigrlrlirrn nlatt *'as t)r,'tt txs co!'tlpt€hensivc us anticipaced.
l-lnwÈ$ct. TLS cleallv:lut(:\ tzut ?r hur adcqucte resourcÈ lo complele itll rhc Drtrlectr in tlrr-' Scrcuiit)
Prcgranr iancl thcrchl, rcirch rl:e Ii.IP!Íl aud has carried uut st)ïTlc risk Ier,ierv tf Fro-iÈct íinl*'scitlc':
:rnd actil'iries to pre-L'rnpt potent;iri pl:rnning, and progress problents, lt rvur n<trt prrssihle tc t'evierr'
the Írh;r-sc I *nti 3:iiilrvitil-s in mv detail as the tasks werc not ful[1.'defined and presentecl ir rr:;
<rveÍr,ir'n'tolm. ThereÉbre i( vr-us nct nossihlc to deÊer:lrine rvhether potentiul slipptge in Phase I
will affcct rnue'ting thc \'ÍPltv{ tilte.

tt shoultl irlsr: hu nored thirt whilsr t!:e celit'ered ntigntion plun nrav lrc ott ritue snd "L'ompliilnl" it
i:an onll,be considere-cl "corrplrant" in Vcn\\'' decision-r:rrking once it hus bcin5 inclcg:er:tlenliv
chci:kcrl/rcrilied. This ivill adi r'.rms lullher month\ rrÍ'rlel:i1'he1'tlnd d:e lvlPlr'l rnd s.ir the Ven\ï
rlrrcision pr.int on lh,; nriqrrliatt plun sili l:kel1'be sometin:te betrveen St:ptcrrrlrcr ttr l)u'centhel'
200e.

\i 1.0

t4

Rgy.a,r Hut-L-rt*.+y- LiN:vERSlry {-)F l-t-r\L:(tr: Inlirr:::utir:n Securitl, Group - Swart Crrrtl ( cntrt

5. Rrvierv of the Rcgionul F'raud ,V[anagenrcnt Plan - for ltotterdant
.li'tiucl nutnugeilte'lÍ lt!.tn rdliqrl l'' i\ugust.1008i is described by't'LS il5 ln {}i.lt;)ui flo:l-Í
the Frau{ ir'lr:nitnring and lvÍarrage*rent project rvithin thc Scuurirv Prograur. The p}an rv;ts
}íP\'Ílrv:thdrarval
lrrcscnrerl tirr rer.iew in order 1o rsatisf y thc \tcn\À'' Íequest to-i'tlstit-v the eirrly {prr:
lf the Strippenkaarl {l{"Wj in Rcrrtertiam bl' demonstrêting (hirl thc risks to clrdholderu itnd lhe
tran$porl huiinc-ss u'err.. rvel! managei anrl contro!lcd. Rr'aring in tttirtd tlrat ttEï/l"LS $rruld sutfer
il'there ,,rerc securitr anrl tiaud;rroblelr-s in t|e Ilcrtaerd;rm \vslr:rr!- rhc fact that t!:e1 rlish ttr nti:lc
ltnr irrrtus thlt
Fl.(líl.css hctorc rhe \,tPN{ :s nn ind:catlcrn ol'thcrr bc'licf ;rnd c<ufrCence to lïlt::iit:u
'I'hr: rrgir'rrur/

:nil]' anse.
'[hr: lirlc tli thc suppIied docunreLt is rather nrisluircirng us tll{: cr)ntctlt rs nat rest:irter,i t(-r trlilnitlitn!l
tiaud. lrut a]so reliltes to rr:curill, irttirÊk\JL':ip!oits $here thert is tlo tlircc:t iltlcnllt:fl qain il nlonetiu]'
Íd\,tÍtlirge. The recen( lcaiolt rtl's$nte re\sílr('hcrs is included irr tlte report a-s "Àcadenric Àtrttsc" iu:tl
'I'he
1lescriberJ us "lcirdcrpiu crlrlrrrrunitt investlgation of u'eakuesses in th,(t ()\i"(-hrpkaa:t slstetn"rncaning rnav hate been clran-eed in tran-*lation íÏcm Dutch t+ Ilnglish. but the uotd "irbuqr."'rrl(ctt
suggests I clark. :*rirrus :rrtrl crirrrirra] !ratuÍe of an ilction ancl imptf ing thi:t rl $hil:L'ircede!:::È
crrr?ruurrit_\,is !lrrolved in this wa;- is innr:cru-ale ancl not ettrttlucivc to atnicahle co-Qperati{-}:'!
It cotrld h< bettirr (<.r rt:-lirlc rhc t1.'pr:s trf "rbuse" &\ t)'pes of "exploit", "l'he ;:ctt<Jr:nz:u crnloit could
tl':en he renlnrerj ris l "prool-oi-c*nccpr" cxploit u' titis type ol'xttlck nla\. tr,.'i;rrli*tl trul hy a::1'i.-g1ou\ rrnri rr:rr-rnrhlf ikilleLi indit'idull n'lln nrAr,hlr-r- ltc a55Írrsiittilrn willt:rci,ilct;lic i:lstiiurions
(!r theiï ideal5.

The tjocuurent:s ''high levej" unct ir.rus nlrt incltttlu:h,:.lcÍiriÍ thlt *'uuld lre espected trrrm il rtsi
:tss{ji\nlcnl i}n ti'ic lvlcs of r'xplciits lnd the back officr.'detectiolr flnd r:(trrcct;ttn :lcllirrt*. This rltul'
ce in iinr: rvith t[r: qrncc'iirlion pf \rcn\\'. anr]/or ïh'; rtcr'tl lrr sategutrd secul'itl ser.siqjr-,.: jtrli,rrnr;r(i<::.

antl/or the tect thflt the detiriled risk ussessnrent hud nirl ,'r.rlrrplctucl hy'rhe 1'' August 1{)iltt

ilccorcing tcr the /l'tric'c'l ploul "l'l':* i.lr,rutulrr:rrt rlocs lterucrr'r rll'scrihL- thc'tlpicll principlcs:tnti
llr0cÈssL"\ thar ri'cruld be used tirr ttranageurent of sttch il s\sten)

The rj$cunrr-|lt iltteR]pts tc chssifl'the trper oí exploit trilit'ri crn lhu 'ltr.rtivr'tltrn,,rtrhicctrvt cf l]rr
perpL:lrlirlr, 'l'ht:rc irc livc tvper itÍr:scrihci! in tablr-s;int! 1r.:x1;,.

r Prtiof-trl -ctrncel)t
r Deriaí-ol'-scrvit:t:
e Crirnilirl schenrettrusitres-r
r ínrlr rrlrr:ri lirrc r:\it\i(fT'l
r FaIse r-lrrir:rs

'f hc crrrtt :rttr-rcks lrre hroken inttt lhle r'

r
r
r

,!:riuDs

Cr.rd manipLrlation

Can[ cr.rp.ving
Crrd cloning/enrulaticrn

Nt consicjer thlt tl',c tlesuriptÍr,rn rri'i:urci ctrpl"ing is jtrsi ;i sttlr sr,:] uf u:trcl c!onin.-t/etnulltinn r.vhe:r-'
lhcrr-- is;r hl:rnk lr{iíare Cl:Lssic *ith a tjrerl (and inr,nlidl lD. srr in our opinir:n r,rttll'trt'tt tttajttr
l(trck grcrups are describedt mirniptllitu(rn and c?oning. Ttre ciittlrr:rl{ chaÍilcteriscics of clotte ty'pe-i
Ircrld k) t:e rr,ell utrdersk-tod {and l:eeter described than in the report) as thelr ellèctir-e detcctirrn bi'
hack rrff ilc s!'\l*nl\ is rcievant k) ntll onl\ mÍInagcr!)ent (lf the svstÊnl. hul al-so ta the r?tjSrtlliort plutt

v l,()

t-\

RrJy,il- Fít-r;-lr:n',-t)', {-ixtvr.Rst'l't r-rr Lr.rrir(t.r: lnl'r-rrnrutir:n Secrrntl Graup - Sn-rlr1 CiLrd (-r:nlrc
r.:'l,ggers.

Thele is a stater]}€tlt that "at this::onrent'- carc clones are likely to he inrplenenicti onll'ttn
L'nrul:tí()Ís. Thir ir lrotrirhll'corr'Èc(. lrorveïer the plan has:cr safeguar'd the Rotcerdam sl'stenr 1-cr
2erfraps ir 1'ear he*bre the lvll'Ir,Í is seacled und the nigrstion p/crr is apprcrr,ecl; unrl tl';cn tirr at l*itsr
as long us ir rakcs tr.r rnigratc thc s1'slem titssumi*g an immcdilrtc triggcri. Ir ir quitc t-easihZe tn
(rxFcct countr:rÉeitlclone cirrd plltlbrns [o irppeai ciurin-u this tinre ruinrlcru unt! su il rs vcrt'
inrportnnt ihrt rhr ir.{P\'Í datc ttt,:s nor slip furthcr,
Thr.re is írr ovei\:!e\\' trf Jrack oÍict ntol',:tcrnrtlt. It :*cntittflr thal :ntlic:r(<rrt, d.\i:cttrox\ xn(l []a(lcÍI:s
;rrr.: nronitt-rred, Lrut as no detail is given, tlrer< is ne \ïa) ol'r.erif1.ing il'these are appropriate oreÍï'ective- It is ctrinred thrrt card rrranipulrrirln is rl:tected s! rl conrcnt (unrpccitïedi nrir-nratch rr"irh

the bitclt otlice slstem and clo*rs lre detected Lry anall'sis lunspeciíled) of !::ipossible iritvel
piltterÍrs as r"'c'll i:i clrd zrtaniJrulirtion crccplitrnsThr-.re ,:s a little rxt.rre detui[ .Birerr r:n r]:e tirttil:g c1'cle rrf tir'tt-'ctiolr. *nnl.'*si: :urtl ctrr:Írol. rvhiclr
hasicllll,confirms ti:* ecncrirl .i:1clc Iime nlentioned in the'l'N0 repLrrt.'I'he sp.it betrieen iiutíJmÍlt:c

a:rd human unalr,sis i-< ntrr cleaily dr-'fineri. alt,'touslr t!:crc ii cerrainlv sorï?c hurni:rr :rlrirl vsis <lf the
L'xccFtron leForlri."l'he principle contrírl is thrr blacklist u'hich prevents r cu'd of r Farticulfrf ID
ti'on: being used in the svster:r,
1-hr.' leport descrilles ;ut aprlxrruch trr h)ickiistirt.g. ric'ilcntiir:c- rrn whc{her r::rrcl nraliipula(ir:r: or
cloning is suspcctcd. tr'íorc ci:rt:
givcn lo lhs I'r11c1-cirse cs it is cltimed thitt a real/innocsnt
cïlstclmei is nto:e likelv to be inconvenieuL'ed, Deperrdirtg on thc t\pe rlf cxploit alrti carr[/clcr::c.
hlircklistrng nraY hc lcmporilrv oÍ pern]alreDt, Perilanent blar.-k-?isting is subject t'.r sL-rllle capaciiï

ir

cunsllirinls although the reporl ciai::rs that the capacitl"is.<ufficir'rrt for lrcr::rrner:t [rllck"list:ng nn
ti:e Rotterdtm rvster:) iirtcl ide *tiiir's r,iorErÈ nlcilsïtrcs lrr r-rptimi;r: thc $ss ol-the black-list.
As ;:art of l targere d rÈsp{rnsc ro gcntrtl rrpioits und surperctc<l lÏrrud, {he PTO r:iu: pur a card ID trrr
a ht'rllrrÊ rl(hr:r thun a Lrlac:klist.'[his rl'cuii alerc ]ocal securiïr'enf<ucernerrÍ rvhen:r pirÍliuulx: uirï(l
tr,ls used st) tltát turrtunli<)níl prrlicin;l lctiun tperhtps ha,.-ked up bt.CL]TVicu.';hi be taker:.

.{dditionirl risual inipccti<nrs r.r{s:r<ls itn: alscr nlsnljoned. Ib be elÍectivr.. this ri.ould also need:o he
uornbinc(i rvith reading of th'-' caril. orherrvist' when chirllerrgccl rn irltuckcr ct.ruld s;ntplr Frr:\crt ,:
icgitirnate card instead o{ his attack card/ertrulator. Thc CH rcport alscr rei:omnrends sc"rme ant:countcÍfcil nicÍrsur-(:\ thirt c:otrlrl hc consrr;{ently'cirecked hf inspectior: sraff :'eg;rrdless crf the rrr:ti{rils

lfl rvorks u se tl/plannr-- d ior' 0 \LC h i 1>kelr t s
Àn cnl'or-ccmÊnt process is al-srr i:leÍltiLlntd. hut it is stiil rr;ork in progrcsr,'ï'his is i:n intporlunt
rcril'it; and TI-.S,/PTOs tlrnd rhcir legal udr,isor-si rreed to he ab-solutely clea on the crimes and
porcnliai ptrni.shments associated u.iti: d:e t'arious t1:pes ol'cxploit azrrl thc pcrrverr lrnrl
responsiLtilities r-rf locll tccurr€! enitr:cr:nrcnt w'hen crrnÍlcrntina. suspected perpetrators. As the
rep(.rrt ilirlts. eomnrunicating the patentiai penalties to arllvellcr( ctn havu a detevunt tffr:ct. \\'i'.t]sl
sol'l'lr- tt'ft,velleí$ ttlav risk a pc*ahl' 1'*r,;. lhur, nirl'he less inclined to z'isk proser-rutltrn for l deliberate

;rttenrp( to rnrs-*su lhe sl's(crn.

Thelr-'i-r t discussirtn on handling lirruel lio;:: a cus[omer nnd custorner'-seE'\':cc's vic'uutrinr.. T?::s
tnclutlcs propcrsed conrtuunicatiou u.ith the Èustorncrs r:brrut thc hirndling t-rf suspected ti'nad azrd
V I,{J

t6

Rot,ql IIoLi-osl,r't-. LINI$ËRstry oË Lo\DoN: lníbmration .SccuÉt1' (inrup Srrrart Card Cet:tre
Jrrrrvides êssuÍar"rces tlrat the custom€r n'ill not incur any' tïnancial clumagc.

'Ihc rcpclrt clair:rs ti':nt

rhere :s llreacll' u liirud Fr Q tïrr u;,ic tr_v PTO/OV-Chipkaart service desk personDel. Although this
.rc.cÍiorl clear!1'addrr.sse.i ti'aud ir also -seenrs applicnhle tc ptool'-r-rt'-c(rnceFt and prrssrhll'dcnia?-of-

service erxploits.
Suspi.-ion of liaud can bre repcrrted lr;,rhe cardhohler, TI.S and/trr PTOs. Utdmateh'. blacklistlng is
colltrol?Ê,J bt'TLS tnd TLS lr also resprrnsihle lor n*1'lblkru-up actiYrlit.s n'ieh specielly trnined
sr*íf. ln rhL'È:tre of rhe cardlrolder suspecting l'rtu<J tprcsumabll'hecaust cf urtcxp*cÊeci ticket
chargesi rhere rs a nell <lefinec sëquetlce of steps thlt handh: brrth a*on-vrttous &tld personalised OVClripkaarrr. ,\ crrti{:tl ;tcp wtthin rhrs sequr-'ncr' {tltar is r}ot described in decailJ !s rhe uitl,vsis
leading to rhe decision of rvhethet'tiaud has tuken pluce. 'f,his rr usulrlí,n- not trivii:l to deter::l1lle in
cttlnin-u sccnurit:s and rcquiíes further explar:atiou. TLS zurd PTO suspecterl trtud hundling ts *lso
described cluite precisely. although the events Ani mc'asurcr tha( iecd to thc suspicion ale not
cie,scriheil.

A reporting rrrechanisnr is tlriefll- described for cornntunicatiLrn of exploits and liaudulen( àlelivït\'.

ïhc P'lOs rvill recc:vc a monthï] orcrtirJw lionr TLS with ïurthc'r details availirhle ott Íequest- It is

ntentir)ned thirt crlrrrparisons ci]r'r he nrade $'ith Strippenkafl!'t statistics. althor.egh it is aot itlR'itys
eas) t(r get il (nle ntcilsure flonr crIrt technologies ils carr.l {echncrlogicr anr] *irrerl "ifirti$ns II1ÍI!'

ident!t1,fi'audsiexploits ti:ut cor.lirj have been undetectable rvith paper tlckets. The Pt0s ri'ill provi<le
"S{lcltsrcgir-f lnd \enW rÍJpofl\ crn u qtriríerl}, tritsi:; ltr mrrte u[1en if r<rcluirctl, 'l'hcsc icpttrrs sl;+uirl
hu' to

l Icvcl oÍ dctlil acceptah]e ro the rL-tiil]iertÍs-

vl_0

tl

Ro\,\!- I Inli-cs',rr'. UNtvEnsttt' o!. LoNDCTN: Inlbnnation Securit;' Group - Smart (.1:ci ('cntre

6. Summnrl' Revierr of the Regictnal Fraud Managenent PIan
The rir,rlirurcrJ .[ruml nwnugemen! lt[un is a reasonable basis fbr managing lï'aucl ilnci (rth(r \ccuriÍ-\
*xploirs anrl irtliickr on thc ltottcrcirnr s]stcrt. Hor,tcvtr. the docunrettr is not suftlcient[r'detailed
?-ol a rigorous rer,lel and nrore precise intbrmation should be added to subseclucnt rr-:risir:ns hrfo:'e
PTW. er.en if thís nreans lppendis matenal thut Ínust remuin 'ILS confidcntial. Thc phn is rrtrrst
precisc in thc *rca ol prrrcess scquer)Ëes fcrr ca.rdholder and custourer service use-casÈs fbr suspected
liaud. A silrillr levsi of ;rrecislcrn/detail could be adcled to the local enfblcement m(:aÍiurcs so lh*r
thc rrrgecrs and irrucc.ses irss{}ciàaeÈ v,'itlt lilual inspcctions arrd hntlisting are unarttttiguous, Thete
ilpFeurs irn ilssumpti()n thilt uilr(i manípul{ti0* i$ iln "(rwÍr carcl'- exploit. howcvcr thcn: may'hc
scenarios rvhere this is not tl'ze case cnd d:!s should be considered n,ithin the customer-servicc
,rrocr:s\cs. ï"hc plun is rvcakcsq in its rlt:scriptir.rn of blck ofllce rnoniloring and cxccption seneÍation
and ditterentiatin_s betu,een the larious clone ty'pes and exploits that mfl-v threilten t!:r's1'stcm.'l'he
hack otficr-' rlrrr'.rtoring is cr:ticll r:ot <n:ir. for coltrlratrng tiaud/exploits but clstr generatiup tl'!e

iriggers und sttlistics thlt (:iln rrltinratelf inl'oke the rligraÍicat plan. Nothing !s slrirl rrhc?.rt lltc
r:urnher of incidelrts or suspu'ttr'd L'.\;)ir)its rhrt can he hantlled hy,' the h:rck rlffice nrocr'ssts .nt:d
s\sleurs, irlthou_sh this can probabll r.rnll'be iletermined h1'operational r'xpsrienc€,

liruc(icitl fr*uc! nranagen:ent,.rlten results irr reguirenrents ttN a runge of SRlvÍs ar:d sa jt is
tectrrnrnentlcrl thuL irll SR\'ts nru drrt;rjli:d uilhin rr4inrtnl iimul firfitntqeÍncrrt l.rlcrrs and ncÍ rvitlrin
the,,rrÍttrfirll /-t/rlrt
Furthcr inl'orrrratinn is .lrovidec iu secti+n T. tthich provides conclusior:s and iecortt:rtendetion-\. h\
considering hotlr the reqionul /i',lrri nr,rriri.tanrení plrn irnri lftc p,-.r.ic<'t ttltn,

v t,0

llt

Roy,tl l loLlon',ty. Usrvensrn'or. L0\nrl\; Inf o:rniltion Sccuritl, (inrup . .Sr::lrrt (-'itrel CL'ntr'-'

7. Conclusi<lns and Recommendations
1'he pru;ecl ,rríarr anc rcgit.tnat .li'ttud nanti1enrcnt plun wcrs pruscnlsd f(rr rct'icrn' it\ trr(! scllerxte
docunrcnts llthtrugh rhc rcirli(v is rhnt thcl'arc irtcxtricabli'linked h-v addressing -snme o1-Èrlilppil)g
r ssuci
Thu-:ilr-:rsulres in thc' regionu!.lrrrrrzi rrrarra.gerttettt plttt s,ould be expected ac have itriscn liqtm tiie
stnlctf.n?L! risk it;sessnrents in rhe pnit,t'! PJnrr and bc rvrisr:tl its fttrthi:r itsrÉssinunti \\'r'le carfiÈd
ruuÍ llrri irdtjitir:nli rrriti.-.:utin,"_, nrcilsuÍL'\ idcr:rifierj. The operirtitttrei ntrtnitoril:g l'Èllort-s capablt tt!
hcrng *cncrirtccl h1' thc Roltcrdanr svitr'rTr could 1'161'14c the ittputs to tlte Ceclsion nrakin-e

tianrervork ttrrthe ntigrotittu p/(r,r íln(: the operllionitl statistics inc!urling lj'aud lcvcl. [i'cqucacy attC
llnc of r-'rploia. coukl he tl:c "irig.ger" for erecution of the rli.grrtíion plan.

The clecisitrn to s,ithdrarr,thÈ paper tir'kets (PT\À''1 pro'r'ides nu opportutrilv ttr girther a ttsclui

\lrtlislic: rhr-: crrmparrrivc ltrrucl rrf thc'Stnppenkacrt and OV-Chipkaar( rYsre::ls. Thu'busint'ss
intbrnration gilthÈred lly careful rncnitoring durin-e the PT\\i period r,;ottld be usefïl for thc
Rr,rttertlam \vstenl, brrt llst-r ir:r r.rlher rcri:(rnr consiriering lhqr lulurc trí thc:ir plpcr tickcts'l'hc pru,lr,rI

lritln * l:r'e
Trirlri rkrus nut giv* rnuch cnrnh:rsts io collsu(ing rcpttrts itntl rlitlt:(ic'
-fh!s uoultj help u'itlt
operational ne(s'ork nnd so the ltotterdtnr i\.stem could assist in that t'espect,
currcnllt' unl:nsucrccl qucslions conccrnins thc nulnbcr trl pt.rtcntiirl r:xpk-riÍs ?hat u'ill ht: l'lags.ctl :irtti
rhr :rhilitl'' of the back ofïice prtrcesses to Èope. Fu:'t!:erurrrrr' it rvill he dlfricult to lre cottfident in t::e
nrigttttir.lt plnrr iiclttical intiastructurr: clenrcnts an<lcards hitr,c ncrt becn tricc on rt lirlll opcri:Íl(rníl
Jiïsteïl't. The Rt'rttercirrn s].stÈnl r:ould br: used as a teslJred tor ter[s:utl trills $hici: cnuld l-'e cf
nirrlirular lntcrcst rl'i:trnls rvr?h a icgircl' moilc are tstr(i. Ín this qasc "ncn'" (:itr(is coulci hc isrLtt:rl :tncl
rused on the s1'stern i* acltance of itttl'astlucture up-urlde.
'['he critir--ui question is r-ricou:'se wi:ethr:.! \:enW should perntit tltr'Rotterdant svsl€ttl trl diict:ntitrue
thu- llapr-'r Strippenkr:trt

prirrr to rhc

tc cust(rr]'?ers. P'fOs irncl 'fLS

'l\'ÍPl\Í

;rn<l

if ro whcthur thi' introtltrccs gnl1L'uri:pl::blc irtirlctl risli

'fhu C'E rcptrr! nrarlr rro Celinite reccr::rnrendatior: linred et legacy tickets r)tl lL'li\'l'art'iegiozul
svstems prior tc the NIPtr,Í- Fol legional O\iC!:ipkaarl infraslructure it is rrí co'.lrsc :rdvis:rhZe trt
cirn') rx.rt:r risk rcricrv antl up(im;sc blcii of,lice detective and qorrective controjs a-s ar,3 included in
the;rrrfcr'r p/urr ar:d the rc(iorrrrl !-rctrcl mmrcgemuil 1il':;r- This is gurtl pr::r-lict in unr casr'. hu( tri
incrc;rsc(l inlpcrrt:r::cc duc to lhr: I'lilare L'lassic ptoblems

[f Rtrtterdarrr is pcnnittcrl Íc) (li\c(.rntrn(rr: papcr tickets in irdvirnce crf thc lr'll'N'l then thc incrcitsctl
u,inclorv r:l' potentill risk lbr Rotterdatn is between the PT\\: and the ntigt'ttlitttt 1rlrur approval date
(ï\'tPI\'Í + rcvicg,/irpnroval tinr:1.'l'hls:s lrkely to bq in (he region of 6-12 months. A loriger ti:nc
perioci rvould t'tot be advised due to the potential developnrent oí clone cards and so thc r'arliest
PT\\ date should hc. Januury ?01)9: assruning that th': I\'lPIví rernains Íixecl at Jrrnc ?009. It shctr?tl hc
noted that ;:aper tickets do not rcpreselrr an ideal plactical trr fraud/courtterfeit resislÍu)t snlutiott trr
tickct:ng and indccd ïhal is t)ne of thc icasrrns u,h1.the1 arc l:eing incre;rsingll phitsct: orrt :n
rriu;\F(.rrÍ sv\rcnt\. \that the)'dc oÍ'ler is lamiljar oFtien tbr the custon'ler r:nd a guarantce ncrt t{)
ipend tnorr. thrn thu. ticket face value. Frrr the ticket instrrecriorr itaíf they'offer u "simple r,isual c!:c"cli
of vaiiditl'

V E.TJ

9

Ro\rL IIot-:.t.ru:rt'. LI.\tvnnsttY rti I.r)sDtt\: lnfolrratr<n .Sucun(r' Grr.rurr - Snrart C.arri Cr:ntrr;
l)cspitr: thc rcportetl lllifue Clirssic plr-rlrler:rs. smart card ticketir:g u'ith girteC ir:t-rastructuru. ofters
:ur et-fectivr-'w'Jv Í.o rt)anugc Lrilvel \\'stcïns. lvoiding farc tl<rrhrng lntl trthcr !ri:uils ihat ;r:r.: pr.rss:hlc
rrith papcr lickcts. Cuslonr*rs r.r'hc r:urentll.still use Strippenkaarrs will need to adapt to t3tÈ ne\\
system, lrut users of such s\stetns norntalll' find thar lhe c:rrds aÍe cor!\'er)!cnt lnti cost efÊ'ectivc.

Atlditrcrnirlly rl'ctrst(rmers $an be assured/convinced thlt tirel'rvil! not sntï'er tinancinl ef F€rsonill
dat;r loss fr'crnl lnv sccttritl,/írituci prttblerrr ínr is propcrssd in the TLS plansj and irrc oít'ercd bqsÍ
vitluc larcs. rhen (he OV-Chipklart should be accepteri. fhe.se assurances need to i:e i'ull1.'ciali!red
end conrnrunicrted ro custorne:-s. TLS/RET shcu?<i cc)nfirrn drar {:us(onrcrs will nor sutÍtr ítnancial
k:ss because of PTW.
l.ostns \oÍnc:!\pr.:ct; ol visttal lnspection cottlcl pre-*ent fl securÍt)'n'eakness. hLrwever this nral be
o\;ercon]e via a nutnbe: of nteasures. First:r'alt inspcct<tr neÈd\ lo ([L{ÈÍlïtinc (rr] ii rc:rrrrn;rhlL'c)ttÈrr!)
thal thc presenlcrl carcl is "genuin,.-". rvithout the need tbr ilispection equipnrent. Becau-se s:t']nt't ciird

lrltrork nral'bt'duplicated. the cards should inctirprrr:rtc irt lcast onc nnti cuunlcríciÍ:nq Íncrisuru.
I-ascr cnsrtvrng.houlrl hc consitlcrcd irs thc miilirnum initiai measule rvith a pianrred rpgnade to ir
ntcrre ssplli5licated solution such as:r hologranr. Sect:ndiy.. inspectcrrs slrould he cquipped rviti:
pr'lt'table card readirtg c'quiprtterrt irnd tra:nr:tl in thccxirnrinirlron rrl'ctrrl ccrnlenls lnil hr-,*'lLr [cilct t(r
;rrrrl rr:ptrrl irnr.rnra I ies,

Onc nright suggest lhat thÈ risk ar-erse slratety is to kr'ep thc Strippcnkulrt urilil thc \lÍr\Í. Inrlccrl
itr rhe o1:ir:icrn of RFÍtlt. lhir is thc simplcsÍ ancl recomrrrended so-ateg1'fol netrrr,rrks rhet hnve::oi
_t'ct tlcp!ovcti OV-Chipkaitrt iDl:'asu'usture. llorler,rr for lhe Rrrttcrdaln nct* rrrk Íhat i:lrr:iulr'
supllorts ho(l't sr:tartc:.rrd urtd plper tickcts. no (-rni; (:iul he certi!in iÍ'this reai!v ls a ''risk fl\.eÍse"
ilrittcÈt.ils thcr<l arc insullïcient publi-shed statistics ctrntparirt.e íraudicxplniti rrn Strippr:nkirai( iurri
OV-Chipkairrt tickc'tirr,e.. \cither ilr$ thclc: slatistics on the uolunre and ilrrpacr of "erpltrits" crzt O\rChipkaans nncl rhu clpac:ty'rrl'hack trllice ^sj-stems to deal rrith thell.

Ànulhcr lacler l(.r urrnsider is that tressin-s, tirÈ utigraiioil /liar "(iri"hullr.rn' *ill ir,rnosl ccrÍin:'i.\
requite lome st:ltistical input-s besc'ri on rlclt\'ork rcports. Il'u'e *'ait un(il the \'lP\,1 bet-ore gathet'in_É
iltis inforntltion lltcrt lhis nrlr' rntroiu(:e it fr.rfllrer perit'rd of rjr.lay, ar:d urlccrlilinlt uz:tll '"rc ci:n hr.
corrlïtient tha( the lrttttr:n slttruld irc 1rrr.:rrrtl íor nuí l.'l'hc l{ctterdnnr systr,.nr could therefore tre';.
'usefïl sourcr'oI trpcritlirrnirl rtritjtiics x-. rr'e!l as a iive svitenl to (crt nÈw rcchnolt.rr:isj. nr:c<lcql in ,ihi:
ntiura!irtn plttt,

Thc trlrrc u'lntlos lor the l{otterdanr concessior: is rl:c *lurc pcriorl irs lirr thc ctlmple{ian iu'td
approval ol'the lriqrrrrktn ltlan:.rrrcl sti :t rlr)uld sccm scnsibIe to. include it as part of tire;rlatr:r't p1rrrr
in orcic'r rit snip c-rip(:Íience itnd inÍbrntation that nrav hc'lp rcclucc risks i:srr-rc:lrletl rr';(h lhe
nigrr:t!ittrt ItIott.
'l'hetc is

r:sk in irtrt'eltdeavouÍ itrtrl it rronnirlll,cirnnot be conrpletelt. renror.ed. so risk Jn{lÏsis xÍ:rl
ulillagetllenl ts uhtrul iricnlil.vinu. understanding artd rneasuring risks rrnri raiiing rensonable
Ix!íii-:attng ancl r;ontingency rneilsuÍes lo dr'al wrth thcm. Fron'l n lraud risk petspective lherc i:
cut're!lti-\'in<utÏcicn( ?angiblc evidence to prevent TLS/RIIT frcrrn procccding sirh rheir business
sÍrate g)': lar the earl1" u.ithdrarual of thc Strippenktarr ( PT\ï I in Rouerdarn. ln Parricular. TL.S/RF,ï
appext' to provide assurancc lhir? q'ustc)rners rvill not suffer finarrcial or dara loss irntl hirvq .;11..n
ilttenli()n ttr thc moniklfing of liuud and o(her explo:ts untl assuciated customer-serr-ice procedur€-(.
What could ci:ange thi.* logic rs if thc ?ime u'indor','betneet: (he Rr:nerdarlr PTW anel thc migrc!iotr
plzrn appro,*'rtl- ht:crtn:cs extended as ihi-q nraY allo\r; or ilrdcccl uncourêge r:volulion crf clu<l based

v r.0

l0

Rorei. Ht)t,l or,.+r- l-:ltvtnsrt'crF L(rrl)t-lN: Inforntation Securitl' Group " Srnart Caii Centre
Íiirudl

l.

'lb *nsurc that sortre added det'ensivc nrcirtures are itr place lor the RcrttcrdÍInr sy-slerll rnd (hitt lherc
is slgniticurt benetlt lhr rhc pxlecr;;/rrrr tand eventually rhc rrri,grrriort;r/an) !t is rect-rmtnt:nded that
rhe Rolrerdam Srrippenkaan cernc€s:iion fronr VenW should be assoq-iated tuitlt the tbllorvtng
obligatior:r ror TLS/RE-l
'lirtrle I

Ohlrgurolr iurd Reievancc lar qhc rrgionul fnmd ttvtnugemenl plrrn irnrl pftt-i..t'! Irlu,l

t

Provrde clertr lssur rrnce that cusitomcrs r\,iÊl not sufíer
linarrciui loss becttrse of PTW
Ploridc clcar guiclanct '!L1 c''llitolnËÍs on ilSFects ol sccunl).
r-Y-l-s-!.

ltld-sJtjllge q! Íra ud

i

Ë{

:

lllprlsrve (he icvel oi' deiail in thc ne.lt revision of the
regiuru! /irlrtrÍ rrtatrtrr.lenwu! ltlart und inclurling SRIrí

Clenrl)'ir.lcn,.il'1' thc rJecision nraking pareies in a[l pluns irrnd
in thc Dccision l;rantervorh

)'es
Yes

{'".

inlbrrnrrtiorr

:

Reasqers errrl il'ncci'sserl

lnd

r,

,"ti.. Irc prnjet't.nlrlrr linrescales

lÉêsrng

Yer

"""--

Prosiclc rlcruil on tht' card selection srrh-l:rsks g'lthin the

Ye.

Pft.tt-cr.r. E4!---unti countcrlèit
1 Lrrsurc thít( ther(i is rrn :ÍÍeclive I'i-suíIl

\e:

ll)etslile orá the cÍrd
Ensure that rickct insrrcctorr hulc porl.tble reitder der'ices

\cs

s
q

l:td are lrair,ed itr their ususc

Errstrre tlrat lh-e eniorccmcnt situul.iorr is cleatlv urlders(tlod
an4 con:municatcr.l
::i. lr]cntiÍv urLd irnp['ltrer:t the rttack t-v"pe/flequency detection

t

;

l'es
Yc.t

rcpo:'ts und stiltiit!cal ÍEprltls thal will cventuuilv fccd into
thc Dccisiorr l;rarttetr r.tr I
(lntlect these lepcns and ilclivcr tu lYf(Jr :rnd \jen\\' irs

J:roposrd ir^ the reporcing

scc Lton

ul' thu" rc1icll,ul lmvd

,\nirl,r,sc tbu rcpurt\ its l lrput i:tro tlx rtitla.tirtt pkrrr nnd

tr]tcrii[tul] tGsÊeÍ 5
1.1 I*ake u qr,ÍtrltitllivÈ conrpurisan hctu'ccn OV-Ctrrpkttitrt
rttd !;rlt:r lickei tïaud at PT\\r
\Íeusurc lhc tirnclccrst oÍ hrndling vuÍi{]u{ stages oI nn
rrploil-r'cport anC prcdic'. hanrJlin.e clrpÍlc!(ie s tnd lrest

\i:s
ï'c;i

resporl-\L: Lrflles

ti, Lnsltre therc ilrë adeqtrate íacilities lo triill. test und

\ts

cr,írluÍrtc criltcal €Íerlents erl' !he nerv citrd technologt' und
inÍirstructuÍÈ orior to the IÍPlt
to Froride clarilicui.ií'iËi"i,ïr;;6t issues l:ighlighterl in this

' Spcl:ilir:;rll1'rrplirihrtirrn rrí i\'tilrre (l?c:s:rt '. ulncrlbtlttrÍes

vt í)

ll

Rcr-r"..\t.l"Ir)t-Lrtu'..r'r'. Llljl\,Eltstry ot LoilÍ.)o\: lnlïrnrra(rcrn .Securitt' Croup - Snrart Card (--entrc

In accorduncr: rrith Ven\,ï'instrlctions Íbr the t{HUI. il$sisnrlrcÍzt. TLSiRET uere shorvn lhu

preliminurl' lindings of this rcvic$' lnd ltrvited to provide any initill resp(lnsc: particularll' rvith
rcspcct ttr thr proposed obligations llsted ahove. Their drirft rcsponse is included rvithin .,\ppenrlir
A- Subject to llnal ccrnfirma(ion crí the contene af the response by.'ï'LS (aftcr riiscussiort wirh PTOst
Ir rvuuld tppcar that lli the plcposcrj obli-eations arc ircceptcd rn iri*ciph-'ilnd f,Íe being acted upttn
t(] soute exlent.
A-. ir llntl perrt ol thc t.rsi$nrncnt. the prar:tic'uliries L\f PT\\'' rvere discussed with VenW. lt :lppeírrr
thar there :rre significant logistical. contractuul antl legal tasks that w<rulti need to be started belbre
the actull P"l'\[ Íor Rottqrriarn. k is at this earller start point that YenW u"avirí nsct! to hc finall1convincr.d hy' direct assur&nces flonr TLS/RET that lll informarion. rïrcilsures i:nd titllirtg to -rupport
criticll ilssrrmpli(rn\ rvr:rc rn placc. RHtll- reconutlettds that the direct assurances shtruici i*clude the
f*llorv ing.
a) Reccrnt'imlirt]on {)t-rcv;si(rr: nf thc }'ÍP\'Í date irt the light of this reyierv, 1'l'LS hus confir*tc'd
Jnnr-. 1009 r.r'ítirin tlre revie$' inFut (ioc:umcnts (not vL'l sÈen h1,'VenWi. although RHUI- hrrs
loic,.'d rcrrnr'drrul'rt* ar:d;rdded pIqec'! pfuur oLtligations in'lirtric I.1,
bt Conllnnation that rhe'I'LSIRËT untlcrr{itnding of all critical lc'rtns used in t!:is revlet svch
rrr \ÍPlf, SRNÍ. przirlt,n/r.rn and nignttiotr,trlrrrr matches the detiuiticns imd clilriírculions
uiven in this revieu'.
ui Ccrnlirrrr;rtrrrn thaÉ {he Rrltterdanr PT1V s'ould not occur tnore than ír'rtrnths hclorc thc

\ÍF\t tter minin:ise lh$ r.;inrtorr r.rf p<rtr:ntirtl risk; as iussested h1,'RIlLILi.

rlj Ctiniirrnutiort thar ri:e ohligutltrns-- ir', Table l. rclevatrl to thÈ lr!.qfí)rrol ix;uti nttnttrqlt,t,(n!
t)li./r, would tre compieted p:-ior to VenW lreginning rtr PTW prcprtritlion r'.trrk.

As thc li:r)nL: nJ aclivrtrr:s ir rrrr chnlïr:nglng, ii is.ug.eesred tltat tirese assuïanr.'es conld be
providetl firsr in a formal lerter trr Vr.'n\\'and lhen discussed jn a sequencc ul'rc-urrlirr;'ncclin,qs
betrverrn \ren\\i xpd'f-LS. rather thirn relving s(rlell on rcvicrvs oínrajor pnt.iet'!;lrrrr ntiiestones.

!'lease nrrte that thr upinions of{crcd in thir rclrcrv arc lor Íhc Rr'!ïtcnllrn netuilrk llonc urd shouli
rl()t hc' uscd t.i l gr'rrer;rl guide tor iltht-'r r'eBiolrílI netrvorks.

This rronclucies lhË :e\,iÈ1r hrr RIilti-

'- Oblig;rti,rn I is r:qrrfirnjcrrletl rr tl;c iirst p:i,r;it.r

vl.í)

12

ROr:t- I'lttl.l.ctrl,r\, UttvrRstT}'or I-clstrril: lnlbrnration SecuritY Gr(rup - Smart Card Cc't]o'e

Appendix A

Draft response to the RHUL revie\ï of thÊ Project Plan and
the Rotterdam Fraud lVlanagement ltlan
-1 Septerrrber 20O8

Gtnerul re,'rrrrr-/ir
-l"his

rr-'spo:rse cr)nuÈrr!\ lhe RHL;L report "Rr-'r.icu <>l thc Ptrfe<'t Plurt ana Rt'gíotxil Fnttul
llírungotttrt Pàll'- und takin-e i*to accounl thc rcrrarks made in l clarifying tclcphune conference
of I Septerttber 1008. 'l-hrs respr::':se does not seek to comment the RHUL Levieu'. hut outlincs
\!hL'rc irn(l ho*'the Project PZan and thc Fraur! Manugement Plan will hc imprcved in response to
the resierr'. This draft Íesp(rr?sc has heen prepared by ï,S lnd RËï'and is made available to RHtll.
as art 'tdrlcndum' to be i*cluder{ in thr íinal lsses.snent of the plans with rcglrd tc tlre criteria
agrced '*'itit the lr'Íirlrs{rv trt"liur:sport. The final Íe$ponsr rvjll be r-o-ordinflted *'irlr PTC)s lrrd
crrntjlrrrcd ils so{)li as possible.

Fcr' qltc' n'uir.ru{tl lrttud tnr:,nu*ernt'tt! ttltin lhc critedon is as follows:

I)u tht',t,('ottí,c.r seÍ oul in tltt rcpiottttl .Íi'ttucl !nrtttd.qêtitctrt plutt lbrnt a qttotl ltultis ttt
tttutt.!Í:( _/izrrrrJ rr.rks ttnd tup!.tor!ing tur-lonrct- scn'ice pr"{rcr,.r.re.ï ',r,illt tlu, Fr(r(nt llíi.íitrc
(.'irt.s,rir í.)l!-Chipkrrtu't in Rottcnlnni Íl,i.r-rÍ-r'ís cttnvrí.íruud lavelsl in th<, ptriotl Ltetn'ret
t|{tt\.[eï kt ttrt t:-!irketinc oitlr siÍirctlitrrr tuvl tln'itliSrcti,li't PInnnin,g:ïíl1r'.rlr;rrr, tmitl :t]09i:'
Fr.tr thr' ltntir,'t Plrur the criterit:r: :s:

is il rïtrsrlrcrá lc !t.t e.rltct't ri r'rrlrryrlirurÍ lrtlgrcrtirrn plun ht Jwe 2009!

Tltr: rrgrce ment t ith thc t\{inirtrl' r-:t' -l'r'lnsp<trt fotesr:$s rhut. tl- the plan-s do nut tràcc{ tiie cr:(eria.
-l'LS
ani RET wrll hrve the oppr.rrrurrilr,Io.t\\e<s the recurnrncrrda(ir.rns mnde lr! Rllljl.. rrrcÍ
indicatc rl'hr;ther and how such rtconlnrtsndêrtions n,ill hc acscpted, Both rr,ill lrc rrrudc nurr oí lhc
RFIUL revierv and fin:rl rspofl,
Às ageei n'ith RHÍll. this respo*se l-ocusc'* on ïhc lirst à5 poir:ts of pag,c ll ol'thc draÍi report.
*'hich sunrr:rurizc ttsc nlo.ql inlilLlrlallt rccomnlen<laricr[s u'ilh respect ro lhc cnvist_ced uithdrirrval of
luper lickcts rn ll,ltterdanr- \\t n ill prc'vicle comments tbr cach ol'these points.

I. Prrtfidc r'lr'rtr- ttsstu'rrx'e !hat t:uste,trpt'.Í rr'íÍl rtot su-ffer.l'innx'írri lo.r.r becausc oI PTll'
This rc'cnrntncnditlion does nt:l rlga:ci lhe doctttttents as ruch. \l'e coufirared t!:irl custr.rrnsr.. ruould
not sull'er tinatzcitl lrrss due Lo potential security-/írirud issues We hirvc inírrrmed RIIUL of the
agreetrlent hetu'eetr the N{inistr-v c,t['l'rnnsoort and the PTOs lrith regard tr:'re\'Ènuf ncurrllitl.'.
nreaning Íhitl rln nvet&gË custorltcr\ irill pa1,the srrne tirr rhe kilo::rerre-baser-i ()tl(hirÍzarrï as thev
tt'o u ltl lbr t he zo tre-lr:rsetl slrrplcnÁcra rl.

v 1.0

?_l

Roral ilol-t.on'.,,v. tJxtttrnslt'r'tlF Lt)r-t.ltl,s: Inforrrration Securitl: Group - Snrurr Card CerrtÍe

-t Pntyidc. clcur qnidutc'tt to (rtÍIoi|,t.'r'.r .uf drl,?ccí.r ol'sc'crrriÍ..I ;rrir'dlt"r'orlr/ sl.rslrerÍr'ti íi'uuil
Wr: uiil tahc up this reqornmcnrl:rtir:n cD l\\'o lqvel\:
- As part of the or.elall securitl" p!'ogran TLS will n:alie irr.ailat:le such iufol'nration te'r the ptblic

-

un hcr *'chr;itc,
.{ t-otder rr,ith intbrnation u'iil be rnade available lbr custorners at the r:oint-ot-sales and service
iocrttirl*s +f RET.

-1" Clenr[y idsntií't'thr du'isiut ura['rir,g purtict in ull plunt uni in lhe l)srisiur Fruntn'ttrk

\Vr rvill clarifl'the pl:rns $herL'írL'cessBr)'iuld follow this thrrrugh in latc'r dclivcrahlt'< ns $'ell Íeuch
r:r lhc l)ccirittn Franrc*ork.;.

"1. httltltt'c the, level td letcil irt tli< nev rï-.'i.sl/.Jrr <t.í'lht' , girtnal ,froud rr',(uttlÊl,,ttr'.t! plrn otil
i nd ucl itrg S R llí irt-íà nnu i a n
In the or,erall securitl'' project rve rvill rÈport to PTOs in detail rvith reBard to tï;rud unil ShoÍl-ternl
Rcrr:lcdial l\'ícitsurcs rn CJctoher 10fi8. Frnrlings ani,l decision 'ur,ill be included in our Frnud
l\'lunagenreut Plans íbcrth ïEgíonal and nirtirrnell. which tr,ii3 [tr-'updrttc<l cvcr] t?:rcc rrr(lnÍhr.

-5 /iettssrss rtrtí/ i'/ rí,('É'.\,Íur\' rct i:t tha pnt-ict'! plan titrrc,;ttt!r\: rtwl pnt.ir<'t pftrTsillg
\Ve ircknr:u'leCge the lact that the tjnrescales are anbitir)us- especially in rhe lighr rrf lhc ncc<l to
inr.olve rltiotis purtrcs in thc ilccrsir:nr tlul musl he taken,,\liereach phase the project -rlan '*r'iZl be
uptlatcrl. antl dctailed Ítrr the nert phase When necessar'\' \\'e s'ill propose additi<lrr:rl reiouÍccs ol
changes tcr tlte cortter:ts of the plan. \\'r'r)otc lhct lhc first rnigration Flan w'itl lcrcus rln lhe secruitl'
ïcquirsnunts rr"hilr"r keeping thÈ t'unctionai specifïcations constant. For future insrancer nf thctrri-sratitrn pltn $'L'th;cscc tlrat chunsin_u husincss rerpirernents (-:lr: tle takel: intcr flcL-cunl-'fhis
approirch ir dcsurihe<J in our iettel of I August \vhere \r,È subr])i(ted r:ur clocurtrerrts thr rr-.iicr,,'.

6. Pnn iit detníl rnr !lv, clard,relcc'ri{lr rub-ra.r*s v'itltitt rhs 1trt4!t:t'! plur
\\Íc rcctlgnizu th* shor(comings i.f tt''e Fhlsing of this tirsk irnd tluvu rnu(lc thr.: arljuslnrc,rts sct out
trelorv

Wc hate tilken the l'ollorvin-e steps to colne to a chortliit rrÍ lhrce p<rtentia! successors:
- TNO has ;:rovided us rvith t long"lrst of'cirrds based orr an Dpen crvptognphr'- tali::rg into
ilccounl thc nerves( insi*shrs trom the !ÍiÍare Classic hack- With lnrr-'rrtal and erternnl u\prrts rrc have set out k::ock-ou[ criteria. evaluatior: uiteria enC ir
rvcighting ol these criteria.
- \\e haue ssored the curds on the lqrng-li-sl lnrl *lirde I shortlist of tllt'ee cflïds.
- TIis rne'lho(lol(rgy hus been revierreC b1'TNO and co!:ïrnents $'ill he tuken rilro ilcrj{}unl.

v t_0

2.1

Ro\'Àt" Hr)t-Lou'..rr', Uxrvrnsrrr'cF LcrrDo.r-: lnformatior: Securitl" Group . Srnart Card Ccntre

l'he next steirs are the ftrllotving:
. Taking inlu lqqorurt currenl. Iuncticrnarl specifïcations as u''ell c,\ the 'ne\\" assessrtler'!t rrf sccuritt'
lisks. I Iligh Level derign +f rhc sccurity ilrqhitecture fcrr eirsh of these threcr po(enlial
succcss(!Í{ ls maclc hy cxpertr l'rcrm 'fhales'Iiansport and Thales securitv. aud rr'itl: substantial

-

assislancc r:t'potential chip-supplier utrder supervision of Tl-S.
Evaiuaticrn of rhc thrue: sr.llu{iuns {ciud plus high level designi hy internal and exte:-nr[ eïperts.

Recomurendation oD th€ solutlon tc DOC (Íh€'dircstilr-* <rf 'l'L.S unr! P"ïOrt hi']"LS. ngain
levicu,'ed hv TNO.
Rcrrcu' oÍ'tleliverable by RI tI L as agreeC with the lv{inistrl' uf Trnnsporl.

7. F)wurc rhut thet'eis alr elJbctire ':isual ami counletfeil nteelurc ut the card
Às r!íscusscd in rrnr telephone ccnf'erence. the cards all h:rve a Iirscr e*graved lD. W'e are cun'en(l!'
assessin-e u'lrether \\'e càr) issuc itll r)tt: nu\t curris rvith holographic ÍbiE as part of the projece for the
Short'fcnn ltcme<lilrl l\'lelsures. Il, certain iiaud scenarios lve nral lrlso rcplacc clr<ls alreittlv
i

ssued.

,Í, Ensurc,thtt titktt ítnpti:tors lvtte Jtrtrtohle rc*ler deric'es ond qre traíned itr l/teit'rrsrr,4e
'l'his has heerr done md rvili be ctrntinucd on a rcuulitr bttsis,

9, Êitsttt'e tlttullte et1!itn'elncnÍ:;itutt!iorti., alnn,tl un<!erstottt! cttulcrttnmttnictterl
Thrs uili bc clrrne ancl contlr:ue'j rrn a rr'.qulÈr hr:sis. a*r-rngst others ns part of the abovr-'nre*t:oned
Íblder u'rth rcle,,':rrrr lnl'trrrnation RËl- is of the opinion thill traud with thc OV-Chipkrurt js rinri,i:rIu rrrirniptrlaticrn ol'eristing paper based tickcts.

l0- Iclenti.tt ttru'l inrplenrcnt lltc u!Íti.l: ttlvfiequetr:t'dtlrtitn rlpo,-tÍ arrrl s/rrli.riict:[ r(pot'ís tl..i]
rr'i// i'r'errflrallt 1'eed inkt !he I')u.'isirn f'r<iltotork
'Z'his is part oÍ'the Fraud rrr*nrloring ïrr(!.le(t, Substantla: results are plannccl ftrr Octotrcr líJ08. nÍicr

rvhich the rc;ulis u,ill Í'eed intc ouruprjated (regitlnnl and naÍir.ri:lli fruuci management plans.
I L ('olhr:t !ht,;t' ttpttrts ctntl dcliter tu PTOI und lkttl'r'r$ ptnposli in tlw rclu,rtittg tcttiort rt.!'lhe
rt g ion t I .t'V'a ttl ut a nu g e nt e Í p lurt
s

u

Th:s rv;ll be done a-s descl'ibed ;r) lhe Ror[c:(lam liiluri nranagement p[ln.
J2. Árrn/v.rc thc repttrrs as ritpul ittlt; tlte rnigxstitut plan ond migration trlgget:t

This i:; indccrl (-rffr inte!ït and lve will incluclc it r:xplic:itly in the update of the project nlan for (l:c
nr:rt phase tdue in 0ctoberllJ, Mnke a quutttirtttit'c rompurisuti bt'tv'ee'lt O\LChipkaurt ttrul gxtper til fut liaud nt P'l'll'
This will trs dcrne as described in the RotrÈrdam fi'irurl matrasement plar:-

v t,0

)s

f

lïoYrrl HctE-Low,ry. U:vtvrns:n'or Losoo:*: Information Security Croup - Srrrart Card Centre

!1, Meqsuru thc rinelcott ttÍ hmnlling lrl'dorrs ,t:ogt:t of an expluit-rcpon ailcl predict htutdlittg
<'upacitics uncl l>est wsponsr ín.ei
Currentt_'- lhcrc rs an ()vcÍcapilcity, Íor analysis. But this may change fls the svstem is rolled out
ilcross the Netherlands and the abilities of fraudster-s increase. \l'e u,ill include a specific evaluatiorr
ns pnrt ol'the National Fraud lvlanagement Plan (Ianuary 20091.

l5- Ensurc ilrcrc are udccJuute !-ac'ilitias tt triul, te.rt ftnd ev(luctrc c'rítical eluneus cq{the ne.r''card
taclrnolrrgl and infrastructurc prior n tfu MPM
We wiïl include prootlping of criticai elements in our plannirg for the third phrse. \le rvill use our
extensive experience and facilitiu's rhat rve have truilt up with regarcl to accÍ:ptance tetts. inlcgrution
tests and ccrtitication twts in the regulur OV-Chipkaat't programme.
t 6. Rrnminitr,g ;roitts,

W'e appreciatt' the levicw as a rvhoàc arrd will integrate fte remalning points u'herc thel- are
lpplicuble in the Íuture de lir,erables of the progrlrnrne-

f*

trte :rust that this addendum k) Í)ur pluns meets your require[lent-\. Should there he anrmisunderstanding in this respect. \re flre available for further clarificarion.

vt.0

2ó