CWHK: Do you consider the Octopus card an RFID device?
Sammy Kam: RFID and contactless smart cards share the same basic technology--you have a small chip with an antenna that serves two purposes: one is to communicate with the reader using radio frequency, and the other is to create just enough power to power the chip for processing. RFID is basically for identification: the reader will check the ID of the chip and send that info to a backend system for processing. But contactless smart cards have more functions: you can write information into the chip, and you have built-in security functions.
CWHK: The Octopus was introduced in 1997, and you went with Sony card-reader technology. Was there any other technology you considered?
Kam: There was Philips, and Sony Felica [at that time]. We did a detailed comparison using multiple criteria and went with Sony--it's still one of the best in the industry.
CWHK:: Why should Hong Kong businesses adopt the Octopus as a payment option?
Kam: Two reasons: cost-savings, and customer service. There's costs associated with handling and transporting cash, both administrative and security.
As for customer service, one of our bigger strengths is that people love to use the card. If you link your card to AAVS [Automatic Add-Value Service, which links to a credit card and "tops up" the card when necessary], you don't need to feed notes into a machine, and you never need to worry about coins.
It's getting more difficult to get rid of coins in Hong Kong. In the past, you could use them on buses, or keep them at home in a jar. But now they're becoming useless. If you use the Octopus, you don't have to deal with them.
But another customer-service feature is the chance to win customers from your competitors. Customer relationship management is better.
CWHK: How many of your users have signed up for AAVS?
Kam: Over 600 thousand. Currently, 19 Hong Kong banks offer the service.
We have two types of cards: one is a personalized card which has the customer's name and information printed on the card, the other one is an anonymous card. But either of these cards can be linked to both AAVS and the rewards scheme, and we encourage people to do so no matter what kind of card they have.
We do have some cards--like student cards--that need to be personalized. The way we collect and manage information must follow the Hong Kong Privacy Ordinance.
CWHK: Do you have any conflicts between your cards and other cards, like office access-control cards?
Kam: Yes, sometimes that happens--my own building access-control card conflicts with the Octopus. We use the ISO 14443 standard, but even so, we can have problems if other cards use similar types of technology.
My solution: I put the two cards on different sides of my wallet and open it to use whichever card is needed. If the radio frequencies [used] are close to each other, you can have a conflict. But fortunately, not many cards have this problem. Our suggestion to users experiencing this problem is to physically separate the two cards for use.
Of course, if your building has adopted Octopus access-control service, the best solution is to use one single Octopus card for both payment and access control.
Another possible solution is to have the Octopus transponder located elsewhere, like in a mobile phone housing or a wristwatch. We do offer these products.
One technology currently under development is near field communication, or NFC--it's a joint venture between Sony and Philips. It links two electronic devices like a card with a mobile phone--it's like Bluetooth but requires closer proximity, about 10 centimeters. The standard is compatible with contactless smart cards, and will allow users--in the near future--to use a compatible phone and SIM card like an Octopus card. It's being used now in Japan.
Our evolution into the retail space was planned. When we drafted our original specifications to build the system, we included these retail applications, as well as access control. People had already been talking about different uses of smart cards for some time, so we designed the system to accommodate future capabilities. And right now Hong Kong is one of the more successful locations using smartcard technologies.
CWHK: How do you, as a CIO, align IT with business goals?
Kam: For an IT investment, we have to do a business case and justify the cost advantages in dollar terms. To justify these efforts we must have a [business] framework. We need to show that IT investment will increase the value of the service to the customers--to give them more reason to keep the Octopus card in their wallet and increase the use of our service. We must continually invest to improve our infrastructure and make ourselves more efficient. If we don't, sooner or later there will be new entrants, new competitors.
CWHK: Who are your competitors?
Kam: Number one? Cash. It's still the dominant form of payment and has been around for centuries. We need to continually improve and give more incentive to our customers to use our services. We need to offer tangible benefits.
CWHK: What have you learned in the last eight years of field operations?
Kam: Quite a bit, mostly in terms of customer behavior. With some contactless transactions, the user only places the card on the reader for a short period of time--there's no one to monitor how long they keep it there until the transaction is completed. So in our technology design we must cater to this situation. We have to provide not only the technology but the operational experience to handle these different scenarios.
CWHK: What have you learned about typical transaction times?
Kam: For transport transactions--like going through an MTR gate--our standard is 0.3 seconds. For retail, we can allow a bit more time: one second.
Right now, our card-readers are based on Sony technology and we have about 50,000 throughout Hong Kong. But we have been working on a new model for the last two years that will eventually replace all the readers in the field.
The new reader is developed by Octopus engineers in Hong Kong, and runs on an embedded Linux OS. It can accept one or more SIM cards, which will allow it to read cards issued in China, Shenzhen, etc. All the security and encryption keys will be embedded in the [reader's] SIM cards, so we don't have to worry about disclosing sensitive information to other parties.
This design comes from our experience on both the technology side and the business side--it's based on our forecasts for doing business both in Hong Kong and around the world.
CWHK: Why did you use an embedded Linux OS?
Kam: This is an OS we developed ourselves, based on open-source from the Linux consortium and other sources. There were a number of challenges, but the reason we chose Linux is that we have to customize the OS down to a very low level--we have to screen millisecond by millisecond to improve the performance.
When you need a transaction time of 0.3 seconds, you really have to get into the code and get your hands very dirty, so to speak--to tune the performance.
Security was also an issue. In order to guarantee security, I think you have to get ahold of the source code. Embedded Linux is the trend for custom electronics.
Also, there's very high-speed communication between the main processor and the SIM card [in the new reader], about 600 kilobits-per-second. It's all because of the transaction time. The Linux OS gives us greater control, but also you have to overclock the SIM card if you want to maintain high speed and security simultaneously, because of the encryption and authentication routines. And because it's open-source, if you have a problem, you can troubleshoot by yourself, you don't have to rely on any vendor.
Cost is also an issue because of the number of card-readers. If you have to pay a license fee for every device, it adds up quickly.
CWHK: Did you have trouble finding suitable Linux programmers?
Kam: Firstly, all of our development team is based in Hong Kong. And yes, I think it is difficult to find the right skill-set: we're dealing with security, wireless communication and smartcards. It's not easy to find these specialized skills in Hong Kong, but I think we did quite well.
We were able to achieve some improvements. At first, the startup time per reader was about ten seconds, but some of our applications needed a faster time. Our engineers were able to cut it down to four or five seconds. And we have limited flash memory on the readers, and they were able to cut the size of the Linux kernel from 1MB to 512KB, a 50 percent reduction. These are the types of things that we are only able to do if we have the source code and the [Linux] drivers.
Another advantage of the new readers is that we can use standardized PC peripherals, like USB devices. We can leverage mass-produced, inexpensive devices. So if we want to turn a reader into a terminal or kiosk, we can buy off-the-shelf peripherals and lower the [overall] cost. This makes it easier to expand and cover other businesses.
This device represents skillful development by our engineers. We're quite proud of it and look forward to deploying it in the field.