Forgot your password?
typodupeerror
Bug Transportation Software

Chicago Transit System Fooled By Federal ID Cards 196

Posted by Soulskill
from the also-by-yelling-really-loud-at-the-scanner dept.
New submitter johnslater writes "The Chicago Transit Authority's new 'Ventra' stored-value fare card system has another big problem. It had a difficult birth, with troubles earlier this fall when legitimate cards failed to allow passage, or sometimes double-billed the holders. Last week a server failure disabled a large portion of the system at rush hour. Now it is reported that some federal government employee ID cards allow free rides on the system. The system is being implemented by Cubic Transportation Systems for the bargain price of $454 million."
This discussion has been archived. No new comments can be posted.

Chicago Transit System Fooled By Federal ID Cards

Comments Filter:
  • $454 million?? (Score:5, Insightful)

    by I'm New Around Here (1154723) on Tuesday November 26, 2013 @05:59PM (#45532469)

    For that amount, they could have failed at health care for most of the country. How does one city get that far lost?

    • Re:$454 million?? (Score:4, Interesting)

      by Spy Handler (822350) on Tuesday November 26, 2013 @06:13PM (#45532627) Homepage Journal

      People like to rag on China's rampant corruption and how their high speed rail minister got jailed for skimming $ millions.

      Well, at least they have a functioning high speed rail. USA is just as corrupt, I guess Chicago politics especially, and unlike the Chinese we're left with nothing valuable at the end of the day.

    • Still cheaper than Myki [wikipedia.org]
      • by Macgrrl (762836)

        Melbourne is much bigger than Chicago - wait, it's not.... hrm.... there must be some reason Myki was more expensive.

        • Yes, Melbourne is bigger, but that doesn't excuse the budget blowout (budgeted at $450M, ended up costing over $1.5B) and it is still being rolled out despite being originally scheduled for March 2007. It is also extremely unreliable and there's no way for tourists to get temporary tickets. It would have been cheaper for the government to just scrap ticketing altogether and provide free public transport. Or just leave things as they were with the older ticketing system and send a rover to Mars.
      • Brisbane's version of this is called Go Card [wikipedia.org]. Budgeted at a mere AUD 134M it came with the long tail for Cubic who get to operate it for, presumably, a healthy slice (undisclosed) of each ticket. Especially healthy... every year since introduction in 2008 the trip price has risen 15%, more than swallowing the small price drop used to entice people on to the system. They also take 24 hours or more to credit accounts with electronic funds paid in, and operate a completely unaccountable system for penalis

        • They also take 24 hours or more to credit accounts with electronic funds paid in

          A luxury. Myki typically takes 48 hours when topped up online.

    • For that amount, they could have failed at health care for most of the country. How does one city get that far lost?

      We don't really know what it costs to fail at a national health care IT project yet. They have even started to implement 40% of the functionality.

    • by Lumpy (12016)

      It's Chicago, they are so corrupt it makes DC look like the largest source of honest people on the planet. There is a reason why it is a common saying that "in Chicago, the dead vote twice" It is normal that contracts are kickbacks and given projects designed to make companies and people filthy rich while not delivering.

      • by dbitter1 (411864)

        "Twice" ?!

        Actually, the saying is "vote early, vote often". And yes, that applies to dead people too.

        (Yes, I am a Chicago resident) (And yes, Ventra could suck the chrome off a trailer hitch)

    • While I'm sure there's no small amount of Chicago corruption involved, that cost includes ruggedized public access hardware for card vending and reading. That will significantly increase the costs compared to the development costs of a website. Just be glad they didn't try to implement mall kiosks for healthcare.gov.

    • by citizenr (871508)

      They upgraded to the Gold package. It will work as soon as they upgrade to Platinum!

      or maybe Centurion.

  • by ScottCooperDotNet (929575) on Tuesday November 26, 2013 @05:59PM (#45532471)

    Why are all cities moving from easy-to-use tokens to these expensive, complicated systems?

    • by runeghost (2509522) on Tuesday November 26, 2013 @06:03PM (#45532525)
      Well-connected corporations don't get paid hundreds of millions for existing, functional systems.
    • by Mark19960 (539856)

      Tracking.
      Now they know who you are and where your going.

      • If that was used to improve service, it would be more palatable, but I've not heard of anyone caught because of their transit ticket.

        • by jonbryce (703250)

          The Metropolitan Police in London quite frequently use Oyster Card data to help them find suspects.

      • by aaronb1138 (2035478) on Tuesday November 26, 2013 @06:43PM (#45532989)
        Several people are trying to make this completely false point in the bullshitty post Snowden mass media... It requires an incredible amount of ignorance to believe. Facial recognition is plenty fast to track you throughout public transit with trivial difficulty. Cards can be swapped and purchased anonymously. Why would any nefarious government agency wishing to track citizens leave it up to chance like that?
        • Bonus with facial recognition, they also have clues as to your mood, disposition, and intentions.
        • by femtobyte (710429)

          Why stop at one mode of tracking when multiple systems allow far more reliable results? Any one tracking mode will deal with a lot of noise, including intentional obfuscation. You can swap around transit cards; wear a hoodie; leave your cellphone at home/work; etc. However, combine multiple systems and you get something far more robust --- match up a person's cell phone, transit card, and facial features, and you've got a far more reliable tool. You can even identify groups of people trying to subvert one s

        • by Lumpy (12016)

          You dont know much about this tech. firstly you have to be damn close for facial recognition to work, only very few systems use HD cameras to be able to work at a distance and then they get overwhelmed when there is more than 5 faces on the camera. Please stop mixing up SciFi with the stuff we really have. In reality, it doesnt work that well because the cops would have it deployed everywhere to have a low effort high capture rate on minor criminals. Even something as simple as the License plate cameras

        • Facial recognition is plenty fast to track you throughout public transit with trivial difficulty

          Citation required. I'd totally buy that they can track a rider on a single trip. But tracking everybody across every trip they make every day of the year. No way.

        • by Rockoon (1252108)

          Facial recognition is plenty fast to track you throughout public transit with trivial difficulty.

          If that were true, then they surely are using facial recognition instead of card readers for these transit services. Oh, they don't? yeah.

        • by cusco (717999)

          So pretty clearly you've never worked with the technology. It's a long, long way from being ready for prime time. It works under very limited circumstances. Consistent lighting, correct placement in the frame (such as walking through a doorway), and everyone facing at the correct angle. Think that's even vaguely achievable at a bus entrance?

    • by volstok (825649) on Tuesday November 26, 2013 @06:20PM (#45532711)

      Why are all cities moving from easy-to-use tokens to these expensive, complicated systems?

      Cities move away from tokens to fare cards so they can charge variable rates based on supply and demand. During peak usage, they can make the fee higher and during times of lower ridership, fares can be made cheaper to encourage more ridership. Also general rate hikes cannot be done as quickly with tokens because people can buy a mass of tokens just before the rate hike yet still ride with their pre-hike token after the hike goes into effect.

      • by Macgrrl (762836)

        In addition to the ability to 'easily' change the charges schedule, these complicated systems allow far more details usage tracking for capacity planning and forecasting. Unlike paper tickets, they can track time of travel and point to point destinations to see which services are being over or under utilised and where additional services may be required.

    • by Solandri (704621) on Tuesday November 26, 2013 @06:27PM (#45532789)
      The Chicago Transit Authority provided 620 million rides [wikipedia.org] in 2011. A $454 million system thus represents a cost of just 7 cents per ride over 10 years, compared to the typical $2-$5 fare per ride. I think the vast majority of public transport riders would say an extra 7 cents per ride is worth it for the convenience of a card which they can buy/refill online vs tokens they have to stand in line to buy. Even if the average rider has to fumble around just 10 seconds per trip to buy a token, that represents over two hours per person in lost time each year, and a staggering 196 man-years lost each year for the entire city.
      • Why couldn't tokens be purchased online? Under the electronic systems, the average rider would still have to 'fumble around' for their ticket anyway. Leaving them visible exposes them to theft.

        • Re: (Score:2, Informative)

          by Anonymous Coward

          > Why couldn't tokens be purchased online

          Authentication is one huge problem. In the Seattle area, we have the Orca disaster:

          https://www.orcacard.com/

          You typically have to call every time you need to login to add more money through the web site. The automated account creation is still broken, and the receptionist at work spends a full day each month refilling our cards(company pays as a benefit). It's a huge hassle. Even more annoying is that there is so much credit card fraud with Orca that certain b

          • by cusco (717999)

            This appears to be the same AC as above with an unknown grudge against Sound Transit. Essentially nothing that they say is true.

      • How's your productivity when the system is down?

      • by gargeug (1712454)
        Except they already had it. It was called the Chicago Card Plus and it worked perfectly for years (source: Chicagoan who used the CTA for many years every day). The question is, why did they have to change it?
      • It's worth noting that Ventra is having problems at the turnstile. It's common for each swipe to take on the order of two seconds, which delays the person behind you. This at least partially mitigates the benefit in terms of man hours. The RFID is still probably faster than tokens or putting a card into a slot though.
    • by djlemma (1053860)
      Well, everybody else is saying tracking.. but there are legitimate reasons to use fare cards. One is that you gain the ability to have unlimited ride passes- pay a flat fee and ride the train for free all month. Hard to do that with tokens. Also, many cities charge variable amounts depending on how far you go on the train. You swipe your card to go in, and swipe again when you leave, and it charges based on distance. That way, short trips can be cheaper. It's also possible to have different prices for
    • You can ask the same thing about voting machines. It's like some people are in a race to find more and more ways to fuck up a perfectly simple task.

    • by Lumpy (12016)

      You cant give your buddies multi billion dollar contracts with coins. Plus the damn things keep working decade after decade, and we can not allow that.

    • Re: (Score:2, Insightful)

      by camperdave (969942)
      Tokens are not easy to use. Not for the passenger, and not for the transit company. Passengers are forced to dig through pockets, or change purses to try to find a token. You have to go to special stores to get them, If you drop them they get lost easily, especially in the snow or mud. Transit companies have to have an entire network of collection boxes, personnel, and special vehicles to transport the tokens to a central facility, where the are counted, cleaned, filtered for damaged tokens and counter
    • Chicago hasn't used tokens for ten years. They use a card system.

      Ventra is not a Chicago system. It is a Chicago-area system. Chicago and it's suburbs are serviced by the RTA of which the CTA (Chicago Transit Authority ) is only a part, yes a big part but still a part. There were the transit version of impedance mismatches between subsystem. Ventra was supposed to fuse all that.

    • by xaxa (988988)

      London's system was introduced over 10 years ago.
      - It reduced fare evasion, which existed due to limitations of the previous paper ticket system,
      - It made working out the fare system optional -- they guaranteed it charged the optimal fare
      - It made boarding buses in particular much faster, as it significantly reduced the number of people paying by cash (which was made expensive)
      - It gives much better detail on demand for routes, how long journeys take, etc, so it helps transport planning
      - It's reduced the nu

  • you get what you pay for.

  • London Oyster (Score:5, Informative)

    by sugar and acid (88555) on Tuesday November 26, 2013 @06:24PM (#45532751)

    The reason that everybody is trying to move to this type of things is the success of the London oyster card system. Not perfect, but good enough, and is widely adopted.

    The key with the London system was the transit fare system was very well integrated to start with. If you bought a zone 1-4 weekly pass, you could take buses tube and trains everywhere within zone 1-4.

    The trick to getting adoption was the cash "penalty" fare. For instance a cash bus fare is nearly twice the price of an oyster card fare. And if you buy a season ticket it gets loaded onto an oyster card. So anybody in London needs an oyster card, and so has one.

    The other effective thing that was done was to only have oyster top up and ticket sales at stations and offered exclusively to local independent corner stores. The advantage to the store holder is 2 fold, it gave a small financial return to the store owner, but more importantly for the store owner it got people in the store. Topping up oyster cards and at the same time getting a drink or chocolate bar etc. So very quickly every store had one, and in London there are a lot of them so it was widely accessible with very little staffing costs.

    • The Oyster Card really makes a huge difference to the transport experience in London, so much so that you find many many people wondering why it hasn't been rolled out nationally

    • by gnoshi (314933)

      The funny thing is that everybody seems to want to roll out an oyster card system, but many places want to roll out their own oyster card system, and that leads to cost blowouts because (it seems) many organisations can't manage to do an IT project without falling on their face.
      e.g. Auckland Transport [stuff.co.nz] with their AT HOP card [wikipedia.org].
      myki in Melbourne, Australia [theage.com.au] which blew out by about $1 billion (on an original ~$0.5 billion cost). To quote from a report discussed in this article [smh.com.au]: ''Keane [who won the contract to ma

    • What made it more attractive than traditional paper tickets for my last weekend trip to London was the fact that you don't have to know in advance if you'll need a day pass for that day. Per day fares are capped at the price for a day pass, so you basically don't need to worry about all those fare plans.

      And then we have Washington DC that adds a penalty of $1 PER TRIP for the atrocity of using paper tickets instead of buying a $10 plastic card (non refundable). Nothing better to radiate that warm welcome to

      • by shilly (142940)

        Another advantage:
        The gates for Oyster cards work faster than the gates for mechanical cards, because the ticket doesn't need to be fed through a small hole and picked up after it's been read. A gain of 2 or 3 seconds per commuter is a big deal in a crowded city.

  • by Okian Warrior (537106) on Tuesday November 26, 2013 @06:34PM (#45532889) Homepage Journal

    I just now hopped over to the CTA website and checked out their budget [transitchicago.com].

    In broad terms, they take in about $650 million from fares, $650 million in public funding (from taxes), and an operating budget of $1.3 billion.

    Hypothetically speaking, what would the budget be if they eliminated fares? The budget doesn't break out the expenses in a way to examine this (at least - I couldn't find it), but it would eliminate a big chunk of the expenses. Not only are there turnstyles and fare sellers, but collection and counting of the money, maintenance on the styles and ticket machines, and so on. Even the financial cost of maintaining a bank account and driving the money to the bank for deposit could be eliminated.

    On the flip side, a person making $15/hr delayed by waiting in line at the turnstyle or purchasing tokens/tickets loses $0.25 worth of time for each minute of delay. A commuter would lose this much twice a day, and the loss would be more valuable if the commuter made more money.

    And this change would benefit poor people the most. It's an efficient way to preferentially give them the benefit of a public service.

    It seems like a more efficient method might be to eliminate the fares and increase public support to cover the difference. The net gain in customer time plus eliminating the fare network might be more than the increase in taxes. Just eliminating the fare mechanisms alone might reduce expenses enough to cover the loss of revenue.

    Has anyone looked into this?

    • by scamper_22 (1073470) on Tuesday November 26, 2013 @07:07PM (#45533211)

      What's interesting is the question on why public transit is viewed so differently than other public functions.

      I'm in Canada. Land of public healthcare. We cannot charge people to see a doctor or anything like that.

      Ditto for public education.

      Yet, even in Canada, transit remains that elusive thing that while it is publicly run and subsidized, it is 'unthinkable' that people shouldn't pay for it.
      This is even true of roads, with increasing calls for more tolls to make drivers pay...

      For the life of me, I cannot fathom why we treat public infrastructure (like roads and mass transit) so much differently than we do healthcare and education.

      Yes, there are various nuances. Things like making sure people don't overuse or congest the system. Of course you could just as easily make that argument for healthcare :P But I think the overwhelming argument is simply that transit is not viewed on the same social level as healthcare or education despite the fact that transit is something we used every single day in and out... and quite frankly relative to the size of government budgets, transit itself is fairly inexpensive.

      I laugh with despair when my home province of Ontario spends like 40% of its budget on healthcare, throws billions and billions into education... then people fight and squabble over a hundred million here or there with transit.

      It's ridiculous quite frankly.

      • by femtobyte (710429)

        I agree it's ridiculous. I suspect it's the residue of so many people being indoctrinated into Capitalist ideals: the very phrase "free rider" encapsulates all the negative connotations drilled into people's heads from birth about the horrors of letting fellow humans benefit without paying. Healthcare and education are obviously too expensive, and too beneficial, for individuals to be charged the full cost up front --- they highlight how ridiculous a pure Capitalist system would be; and, how great benefits

      • by NIK282000 (737852)

        Shhh! Keep it down, our healthcare is already in shambles and our education system is laughable, don't take the roads away from me too!

      • For the life of me, I cannot fathom why we treat public infrastructure (like roads and mass transit) so much differently than we do healthcare and education.

        Road funding is the single largest piece of pork dished out to big motor manufacturers and big oil. Without the roads, people wouldn't buy cars, and wouldn't live 60 miles from where they work. They would have to use, oh I don't know, trains to get around. Heaven forbid!

      • by Firethorn (177587)

        What's interesting is the question on why public transit is viewed so differently than other public functions.

        You want to know what's really odd? I'm a moderate libertarian/practical minarchist and thus approach it from a substantially different angle, but come to more or less the same conclusion. I approach it from the point that a city is a economic complex. Consider theme parks - most of them have substantial free transport within them, because that makes it more attractive. Same deal with airports, even some malls.

        Now that we're considering a city in the context that it's sort of like a mega-mall, we then h

      • "All well-informed transit professionals that were contacted for their opinions spoke strongly against the concept of free fares for large systems, suggesting some minimal fare needs to be in place to discourage vagrancy, rowdiness and a degradation of service. "

        For a full discussion of both sides of the argument:
        http://nextcity.org/daily/entry/as-u.s.-transit-fares-increase-europe-starts-to-make-it-free [nextcity.org]

      • I'd guess it's because there are many powerful buisiness interests in getting you to drive your own car. The fuel industry, the auto industry are the big ones obviously, but also law enforcement (tickets), construction (roads are probably more lucrative than a few tunnels). Public transit systems are rarely lucrative, they seem to always end up being government run. I've heard that even in subway crazy Tokyo where they manage to have privatized subways, most of those lines are run at a loss, it's only vi
  • by mythosaz (572040) on Tuesday November 26, 2013 @06:35PM (#45532909)

    [...also, sky blue, water wet.]

    I kept waiting for the article that said, "So we went down to a transit terminal armed with as many different RFID and NFC cards as we could find, trying to see which ones worked and which didn't." Then we used our easily purchasable RFID/NFC card reader to see what information the cards we tried had in common with the Federal IDs and the transit cards -- and here's our findings.

    Now, I understood *that* sort of journalism would have taken a hundred bucks and a couple of hours, but... ...sheesh, people.

  • "Please be advised that intentional misuse of federal credentials is prohibited"

    That's sort of pushing it, isn't it? I don't think the machine is letting them in on basis of the card being a federal credential. It probably lets them in on bases of the one system being confused by a different system's raw data. It could easily be interpreted as fraud but unless the system actually understands on some level that this is a government ID card, it's hardly comparable to pulling a scary-looking badge on a live person or something.

    • by NIK282000 (737852)

      Tricked by raw data? The reader is looking for something very specific, a number linked to an account from which it can deduct a fare. Is it more likely that a string of numbers not in the the expected format satisfies all the conditions that the machine it looking for by accident or is it more likely that this is purpose built in and Mrs Garypie just stumbled onto someone elses scam? It would be trivial to include code that accepts ranges of values that just happen to match the format of federal IDs (would

      • by cusco (717999)

        This can't be by accident, "tricked by raw data" isn't even a possibility. This is essentially the same technology that access control systems us. The bit structure is laid out in a particular way, and if any portion of it is incorrect the read is rejected. On a typical 26-bit access control card (don't know what the structure of these ones are) the bits 0-7 are the Facility Code. The firmware on the reader scans them, says "This card belongs in our system" and passes bits 8-25 to the controller, which

    • by u38cg (607297)
      There are two seperate issues - one is the fraud of getting unauthorised access with a non-standard access card. The other is the use of a federal ID, which is probably governed under its own law and I'd guess written loosely enough to cover use in this kind of way.

      In any case, doing so is stupid, because presumably transactions are logged and ultimately traceable back to the ID holder.

  • and the metra rail system is still on the hole punch system

  • IIRC, their RFID card just broadcast a number, and the government cards broadcast valid numbers as well. This suggests that government cards do not allow free ride, but ride on someone else's account.

    What I do not get is that TFA says the cards have a smart chip. Why then just use a number, where they can do better?

  • A Ventra card is basically a Debit card. So one would expect simple best security practices.

    Imagine my surprise when I hit the forgot Name and Password button and after entering in my Debit card number and email, I was sent the original password I used (not a reset). As with Adobe, this is asking for a massive breach.

    $454 Mil apparently can't buy programmers/designer familiar with password hashing, salt and slow algorithms. Or a basic security audit.

Between infinite and short there is a big difference. -- G.H. Gonnet

Working...