The last LGOC horse-drawn bus ran on 25 October 1911.

[From� Buses in London - Wikipedia, the free encyclopedia]

When engines were first introduced, there was an explosion of variety. Steam, electric, hybrid (yes, one of the first motorised London buses used a generator to power an electric motor – I’m told this was to avoid using gears, which the drivers didn’t understand having come straight from horses) and petrol. The first buses merely replaced the horses with an engine, but they didn’t redesign the rest of the bus.

(Photograph: London Transport Museum)

It takes a while for a new technology that improves on one part of a system to embed in a redesigned system. It’s a well-known phenomenon that the first electric motors were used to replace steam engines, and it took a while for factories to be redesigned so that there were lots of motors where they were needed rather than a big motor in the middle transmitting power via belts and drives. When the modern “one man” buses were first introduced, there was a similar dynamic. The buses were fitted with turnstiles and machines that you had to drop money into in order to get a paper ticket, just as you would have done with the human conductor.

Things stayed this way — handing over cash to get a paper ticket — until the contactless smart card came along (although magnetic stripe tickets were introduced on the tube starting in 1964). When the first smart cards with contactless interfaces arrived in London, the “Oyster” cards, they were used to simulate the complex cardboard tickets: weekly and monthly tickets, annual season tickets, staff passes, children and old persons concessions and so on. The real revolution arrived a little later, when they began the “capping” system so that you could ride around on your pay-as-you-go (PAYG) Oyster card but your charges would be capped at the cost of a one-day “travel card”. Now, to all intents and purposes, everyone in London has an Oyster card.

TfL spent a lot of money developing the Oyster scheme because one thing hadn’t changed from the days of the horse-drawn LCOG buses to today: the banks didn’t provide a payment mechanism that was quick enough and convenient enough for public transport, so the public transport operators had to sort things out from themselves. Well, now they do. Since the banks decided to roll out contactless payments, TfL have decided to institute a major programme to accept these bank products for travel in London. Starting next year with the buses, TfL are rolling out new readers so that customers will be able to use their bank cards to travel. No need to buy an Oyster card any more.

Contactless credit and debit card payment will be rolled out across the London transport network by the end of 2012, making the capital the first in the world to embrace the system so comprehensively.

[From� TfL's Oyster to accept contactless bank card payments by 2012 (Wired UK)]

At Consult Hyperion’s� recent workshop on Open Payments in Transport, Matthew Hudson from TfL explained to the delegates why TfL is moving to accept these “open” (i.e., Visa, MasterCard and Amex) contactless payment cards on the buses and tube starting next year. Given the thousands of acceptance points, millions of users and zillions of transactions this will involve, it’s quite a big deal in our neck of the secure electronic transactions woods. Nick Deere from Consult Hyperion explained how the system will work and the complexity of the reader development.

The move would mean mass ticket office closures and the loss of more than 1,500 jobs. The Operational Strategy Discussion Paper says £2 billion could be saved by 2018.

[From� Driverless trains on the Tube by 2021 | News]

That’s serious money and an obvious driver for change in the ticketing system. There’s another issue as well. While Oyster is a great customer experience that is much appreciated in London, it’s not a perfect customer experience. Just to give one example: because the data is stored on the card, it’s difficult to give consumers a good customer experience online. With the shift toward multi-channel sales and servicing underway, this is now important.

As I’m sure many of you know, Consult Hyperion has been advising TfL on this project for some time so we share their excitement about it going live in the not-too-distant future. The experience that we have gained in the prototyping, design and certification of card and phone EMV products in a demanding transit environment is literally unique, so we are hardly impartial observers. But I’m sure you’ll agree that TfL’s decision to set a high bar in terms of functionality and performance has paid off for them and for the industry as a whole.

While I appreciate the history of transport in London (see above!), I’m looking toward the future. Another change that will come with open payments is the arrival of mobile payments and ticketing. Since the gates will accept bank contactless card they will also accept Visa, MasterCard and Amex payments via mobile phone and that opens up the potential for value-adding services on the mobile that are simply not possible using cards.

Transport for London (TfL) has stated it will support NFC payments on mobile phones in 2012.

[From� Transport for London to accept NFC payments from 2012 • NFC World]

It’s big deal. It’s not been possible to experiment with Oyster in mobile phones because the chipsets used for NFC do not (yet) support the more secure Oyster cards and the software emulations are too slow for practical use. By going down this route, TfL can avoid this problem completely and start to explore the next smart ticketing revolution, which will be integration of ticketing and mobiles. This is just the sort of thing I’m looking forward to learning about at� Transport Ticketing 2012 in London on the 24th-26th January 2012. I’ve been along to this event for the last couple of years and found it an excellent way to get an up-to-date picture of what’s happening in this space. The wonderful people at Clarion have given me a delegate pass for this event (worth an astonishing ONE THOUSAND THREE HUNDRED AND FORTY NINE POUNDS plus VAT) to give away as a prize on the blog. So if you are going to be in London on those day and you’d like to come along and meet some of the key players in the field — and me — then all you have to do is to be the first person to reply to this post with the name of the iconic London transport red bus model that was in service from 1956-2005, a new version of which is being developed for reintroduction in 2012.

This competition is open to all except employees of Consult Hyperion and members of their immediate families, is void where prohibited. The decision of the judge (me) will be arbitrary, capricious and final. Good luck.

These are personal opinions and should not be misunderstood as representing the opinions of�
Consult Hyperion or any of its clients or suppliers

Giving evidence to the London assembly transport committee about TfL’s plans to introduce contactless payment to London’s transport network, he answered yes when asked by a member of the committee whether the system was “100% safe” against “invisible pick pocketing”.

[From� Transport for London says new contactless tickets will be '100% safe' | Guardian Government Computing | Guardian Professional]

Will is, naturally, correct. If I am able to sneak a bogus reader onto the Underground and surreptitiously hold it against people’s pockets to read the card data inside, it’s not much of a crime. I have to put the reader up against your wallet. If I want to read your card from the other side of the carriage, I need an antenna the size of a wagon wheel pumping out so much power that the coins in commuters pockets would be sparking.

But even if I can access the card in your pocket, I can’t use the data to make counterfeit cards and I can only put spurious transactions through to a merchant account at a bank: I can’t “pickpocket” anything, in the sense that I can steal anything of any value. But it seems to me that electronic pickpocketing “meme” is unstoppable.

An ongoing effort by credit card companies to issue 1 billion radio frequency identification chip-enabled contactless cards by 2016 will dramatically increase the public’s susceptibility to identity and financial theft from electronic pickpocketing, Identity Stronghold announced today.

[From� ‘Electronic Pickpocketing’ Threat Worsened by Credit Card Industry Plan to Issue 1 Billion Contactless Payment Cards, According to Identity Stronghold - pymnts.com]

Now, I have to say, in all honesty, that I know of no report from a reputable source of any incident of electronic pickpocketing ever having taken place anywhere in the world. Not one. I have never seen an unauthorised charge on any of my contactless cards and if I did see one I would simply call my issuer and have it wiped.

The real question, of course, is security: If a special little reader can take and use your credit card data from your phone, how is Google going to ensure this only happens when you want it to happen?

[From� Google's Mobile Payment Platform to Launch, Report Says ( - Consumer Electronics )]

This is a misunderstanding of the difference between stripe cards and chip card (whether contactless or otherwise). We wrote an Android app to use a� Square to read the magnetic stripe data from a credit card, decode it and then send it on. But the problem here is not Square or Android or Twitter but the magnetic stripe. If you read a magnetic stripe, you have all the data you need to make a magnetic stripe transaction. But if you read a contactless card, you� do not have all the information you need to make a contactless card transaction.

Contactless card and phones, the ones with NFC interfaces like the Google phone referred to above, don’t send the data necessary to construct a bogus magnetic stripe and you can’t use the data that they do send to make a bogus NFC application because the secret keys that you need to create the secure messages are never transmitted – they stay inside the secure element (SE), just as they stay inside the chip on a chip and PIN card. So the strength of the electronic pickpocketing meme does not come from the technology, nor can it come from experience.

As I’ve said before about contactless, there must be something about contactless, about wireless interaction, that causes irrational concerns.

Among those that are not yet ready to use contactless, security appear to be the dominant consideration. Which means, of course, that whatever we might think about actual security situation we must get better at communicating it.

[From� Digital Money: Contactless update]

I’m at a loss what to do though. If I were the UK banks, I might try to persuade the BBC to get a contactless card story into� Eastenders, as that seems to be the standard public education channel these days. Otherwise the stories will just keep coming.

At least once a year, the contactless payments industry, indeed all of us, has to put up with someone spreading fear about contactless cards and the ability of someone to scan the card of a passerby with a portable contactless reader. Yes, it’s true. It can be done. But who cares? The risk is beyond minuscule.

[From� PaymentsJournal - Non-Existent Monsters in Your Wallet, Reporting Finds]

If the London Assembly were being really forward looking, they would have asked Will what terrific new services TfL will be able to deliver once customers begin using the coming generation of NFC phones instead of contactless cards. This is only just around the corner now.