Slashdot Mirror
Chicago Transit System Fooled By Federal ID Cards
New submitter johnslater writes "The Chicago Transit Authority's new 'Ventra' stored-value fare card system has another big problem. It had a difficult birth, with troubles earlier this fall when legitimate cards failed to allow passage, or sometimes double-billed the holders. Last week a server failure disabled a large portion of the system at rush hour. Now it is reported that some federal government employee ID cards allow free rides on the system. The system is being implemented by Cubic Transportation Systems for the bargain price of $454 million."
...doesn't sound very unintentional to me.
For that amount, they could have failed at health care for most of the country. How does one city get that far lost?
If you think I voted for Trump because of this post, you're wrong. I voted for Dr. Jill Stein of the Green Party. Again.
Why are all cities moving from easy-to-use tokens to these expensive, complicated systems?
Sounds like someone put in a little something to get free stuff for the feds.
That doesn't look like something that would happen by accident.
you get what you pay for.
Anons need not reply. Questions end with a question mark.
http://en.wikipedia.org/wiki/Akbil_(smart_ticket)
It was unbelievable, Guys, it seems you had serious problems in government.
[My english is better than most other people's Turkish, so please point out mistakes politely. Thank you.]
$454 million to collect subway fares? Would love to know how many bribes brought this trainwreck into being.
Didn't anyone sit down at any point to run a few numbers on evasion losses using the current system versus the new one? If it's less that $50 million difference per year, it's a no-brainer to stick with the existing system.
Corporate welfare at its most blatant.
This is what happens when you let a bunch of musicians run things.
The reason that everybody is trying to move to this type of things is the success of the London oyster card system. Not perfect, but good enough, and is widely adopted.
The key with the London system was the transit fare system was very well integrated to start with. If you bought a zone 1-4 weekly pass, you could take buses tube and trains everywhere within zone 1-4.
The trick to getting adoption was the cash "penalty" fare. For instance a cash bus fare is nearly twice the price of an oyster card fare. And if you buy a season ticket it gets loaded onto an oyster card. So anybody in London needs an oyster card, and so has one.
The other effective thing that was done was to only have oyster top up and ticket sales at stations and offered exclusively to local independent corner stores. The advantage to the store holder is 2 fold, it gave a small financial return to the store owner, but more importantly for the store owner it got people in the store. Topping up oyster cards and at the same time getting a drink or chocolate bar etc. So very quickly every store had one, and in London there are a lot of them so it was widely accessible with very little staffing costs.
> so they can charge variable rates based on supply and demand.
> During peak usage, they can make the fee higher
NO NO NO NO NO
Boston MBTA has fare cards and THEY DO NOT DO ANY OF THESE THINGS
> because people can buy a mass of tokens just before the rate hike
You have apparently NEVER seen the mechanisms and tokens switched out at a fare hike!
But you DO give good cover for surveillance
I just now hopped over to the CTA website and checked out their budget.
In broad terms, they take in about $650 million from fares, $650 million in public funding (from taxes), and an operating budget of $1.3 billion.
Hypothetically speaking, what would the budget be if they eliminated fares? The budget doesn't break out the expenses in a way to examine this (at least - I couldn't find it), but it would eliminate a big chunk of the expenses. Not only are there turnstyles and fare sellers, but collection and counting of the money, maintenance on the styles and ticket machines, and so on. Even the financial cost of maintaining a bank account and driving the money to the bank for deposit could be eliminated.
On the flip side, a person making $15/hr delayed by waiting in line at the turnstyle or purchasing tokens/tickets loses $0.25 worth of time for each minute of delay. A commuter would lose this much twice a day, and the loss would be more valuable if the commuter made more money.
And this change would benefit poor people the most. It's an efficient way to preferentially give them the benefit of a public service.
It seems like a more efficient method might be to eliminate the fares and increase public support to cover the difference. The net gain in customer time plus eliminating the fare network might be more than the increase in taxes. Just eliminating the fare mechanisms alone might reduce expenses enough to cover the loss of revenue.
Has anyone looked into this?
[...also, sky blue, water wet.]
I kept waiting for the article that said, "So we went down to a transit terminal armed with as many different RFID and NFC cards as we could find, trying to see which ones worked and which didn't." Then we used our easily purchasable RFID/NFC card reader to see what information the cards we tried had in common with the Federal IDs and the transit cards -- and here's our findings.
Now, I understood *that* sort of journalism would have taken a hundred bucks and a couple of hours, but... ...sheesh, people.
Hm...doesn't sound very unintentional to me.
I bet Rahm Emanuel still has a federal ID. Current Mayor, former White House Chief of Staff.
"Please be advised that intentional misuse of federal credentials is prohibited"
That's sort of pushing it, isn't it? I don't think the machine is letting them in on basis of the card being a federal credential. It probably lets them in on bases of the one system being confused by a different system's raw data. It could easily be interpreted as fraud but unless the system actually understands on some level that this is a government ID card, it's hardly comparable to pulling a scary-looking badge on a live person or something.
Ezekiel 23:20
For that amount, they could have failed at health care for most of the country. How does one city get that far lost?
We don't really know what it costs to fail at a national health care IT project yet. They have even started to implement 40% of the functionality.
...doesn't sound very unintentional to me.
Its a beta test for when we all have federally issued ID cards. :-)
The same company makes the current and future card system used by WMATA and they intend to let federal employees use their PIV cards to charge the gov for subsidized rides
and the metra rail system is still on the hole punch system
Ha! We here in melbourne laugh at your statements and install $1,500,000,000 dollar Ticketing systems!
which works wonderfully. All the conductor has to do is walk down the car punch a hole in the 10 ride and one way tickets and sell tickets to the people who didn't buy them at the station. During rush hour a conductor can check a car in about 2 to 3 minuets tops while the train is in motion. this works because most passengers buy their tickets at the station and the Metra fare structure is setup so that each train ride costs the same proportional to how far you travel on their system. CTA and Pace, which use the new system, are setup so that the driver has a minuet or less at each stop to make sure the people getting on pay the proper fare on a fare system that has different rates based on the number of transfers that a person makes.
IIRC, their RFID card just broadcast a number, and the government cards broadcast valid numbers as well. This suggests that government cards do not allow free ride, but ride on someone else's account.
What I do not get is that TFA says the cards have a smart chip. Why then just use a number, where they can do better?
Which has worked reliably without fail since the late 1890s or whenver those tracks were first laid and passenger rail put in service. (At least outside of any strikes that may have happened.) The conductors do their job. Not only taking fares, but keeping an eye on things and dealing with the occasional rifraff and making for a generally pleasant train ride. It seems antiquated, but it puts a human touch on things and most Metra riders appreciate this. It ain't broke, so don't fix it.
Please, everyone, stop with the token comparisons. Chicago did not go from tokens to Ventra. Chicagoans in October could buy magnetic strip cards loaded with justabout any amount of money from vending machines, from grocery stores, from check cashers. The card readers on buses and train stations told how much money was left on the card. If the was insufficient funds when you boarded the bus, you could add the extra right there. We could also buy 1 day, 7 day, or 30 day passes. These could be delivered straight to your desk by your HR department as a pre-tax transit benefit. All of these options were anonymous and easily shared with others. For people who preferred a durable card loaded with funds, there was the Chicago Card too, which you could register online if that's your thing. Stuff usually worked and people were happy, except when trains fill with smoke and crash and stuff.
Here's the citation http://transport.kurtraschke.com/2010/12/reviewing-the-nepp
So Cubic's system was intentionally written to recognize the federal govt employee cards. The real story here is that someone forgot to disable that functionality in the Ventra deployment.
and the metra rail system is still on the hole punch system
Sorry, did you mean to say "and the metra rail system is still on the hole punch system"?
I didn't get it the first time in the subject line, or the second time in the body. Perhaps you can repeat yourself again for me please?
Monthly Metra pass was a huge bargain (2000 or so for me). $135/mo then (whatever zone Grayslake is in). Parking in The Loop was $15+20/day then, along with driving into/out of there. No brainer. I drove in only a couple of times...
How exactly did they find out the system could be fooled by a federal employee ID card? Did some federal employees purposely stick their ID into the reader to see what would happen? For the purposes of ... stealing rides? I'm SHOCKED, SHOCKED I tell you that a federal employee would attempt to steal something. In Chicago.
The CTA had a perfectly functional RFID fare system prior to the deal with Cubic. Cubic actually implemented the system FOR FREE. The benefit to the City of Chicago was the elimination of unionized CTA workers who collected the cash in the original card system. The $454MM price tag was footed by Cubic. This deal is much the same as the "leasing" of Chicago's other public assets in return for short term solutions. I am sure if one dug deeper they would find other revenue streams for Cubic, such as advertising on the sides of the trains and buses as well as the ability to raise fares. All of this comes during a massive face lift for the CTA stations. I am sure every level of city and county government was well bribed for this deal.
I love it when government throws our money at fraudsters and we get all upset about it. we're the ones who elected the fraudsters to begin with!
A Ventra card is basically a Debit card. So one would expect simple best security practices.
Imagine my surprise when I hit the forgot Name and Password button and after entering in my Debit card number and email, I was sent the original password I used (not a reset). As with Adobe, this is asking for a massive breach.
$454 Mil apparently can't buy programmers/designer familiar with password hashing, salt and slow algorithms. Or a basic security audit.
That's bunk. I found out the hard way that the vast majority of them are unregistered or registered to a random address. A police officer might get a lucky break but, to track a career criminal, it is useless.
Not completely useless, because you can combine the data with CCTV footage, and you have a very good idea where their nearest train station or bus stop to home is.