This is why we need an agency that can multitask. Was this IRS thing a sudden spur-of-the-moment change that led Metro to abandon the upgrades or was it set for a while? Most people don't

Riders should start complaining over this. They've delayed it long enough, there needs to be some accountable force that will keep Metro to their deadlines or put some sort of punishment in its place.

Maybe it's time to abandon SmarTrip and start with a newer next generation farecard that has new stuff from the get-go.

by Jason on Oct 27, 2009 4:45 pm  

Jason, is there something about the Smarttip tech that's outdated?

I'm not defending the "change all at once" approach, however. It seems quite silly, and if justified by huge costs to do it piece by piece, then there's a problem that needs fixing too.

by ah on Oct 27, 2009 4:53 pm  

I think that Metro at some part would want to change from paper farecards to a "Smart Ticket" that would use the same targets that the Smartrips use. Such technology does exist and is in use at at least two agencies (PATCO and MARTA). If not that, I'd think that Metro would want to upgrade to the more modern paper ticket system that MBTA and MTA Maryland use.

At some point, it's going to be time for Metro to replace the 1970's technology for farecards with 21st century technology. Of course, this would probably require new faregates and fare machines which would just lead Metro to find more ways to waste more money they don't have.

by Jason on Oct 27, 2009 5:00 pm  

But what are the limitations of the SmarTrip card itself? The card doesn't need to do a lot. It's my understanding that the card basically just stores an identifier, the value on the card, the the last station you entered. When you add money to the card the farecard machine just resets the value. Values on cards are also stored on WMATA servers, indexed by SmarTrip identifiers. When you go through a gate, it checks the card to see if you have enough money, then deducts the money from the card by resetting the value, and (at some later point) tells the WMATA server the amount it deducted, and the current value of the card.

There are probably ways to cheat the system- there's probably nothing stopping people from resetting the value on their own cards. But, at some point the back-end system will notice that the value on a card isn't what it's supposed to be. Then I'm guessing they blacklist the card. So, while you can cheat once, there's probably (hopefully?) no good way to cheat multiple times.

At a very high level, the SmarTrip card is just used as a way of inputting an account number when you go through a gate. Most of the logic can be done on the back-end. I would think you'd be able to do pretty much whatever you wanted to do with the current SmarTrip cards, gates and fare machines, and only change the back-end servers. You would probably have to reprogram the gates and faremachines to some extent, but I doubt it would require replacing hardware.

I could be completely wrong. I have no inside information about how the SmarTrip system works. I'm just making inferences based on what I've read about other farecard systems.

by Andy R on Oct 27, 2009 5:33 pm  

Dont feel too bad. There was a 3 year delay between the promised launch and actual launch of all the good features of the MBTA charliecard. And theyre still not done yet.

by J on Oct 27, 2009 5:42 pm  

Metro customer service fail. Again.

by Gavin Baker on Oct 27, 2009 6:05 pm  

Usually the account value is stored on the card so that it can be read and changed by devices that aren't connected to the network all the time, such as bus fareboxes. This stored value is encrypted to prevent unauthorized access.

White hat hacker students from MIT managed to break into charlie card using a iso 14443 reader/writer and a brute force method. The weakness in Boston's system was that the encryption secret key was only six bits long, allowing them to make 64 cards and just test them all to see which one was encrypted using the correct key. Once they knew the correct key, they could write arbitrary values to the card, including values that exceeded the purchase limit at fare machines.

Boston has since fixed their system. The problem with smartrip is that the system predates ISO 14443 and is proprietary to Cubic. Metro has recently installed ISO 14443 faregate readers, allowing Metro to change over to standard farecards if they so choose.

by Michael Perkins on Oct 27, 2009 6:08 pm  

WMATA should be made to explain why they cant do things by dates that are set.

"They can't consider "all you can eat" pricing like New York's. They can't build the "invisible tunnel" to allow free transfers between Farragut North and West."

There needs to be an explanation on why those cant be done if they can trigger the cards to give refunds they can certainly do those things as well.

All i would take is a few lines of code in there computers for the tunnel thing

For all you can eat pass there is no damn reason why they cant except for they don't want to; they could just get some of the student cards have them printed in a different color and jack up the price or add about a paragraph of new code into there system.

by Kk on Oct 27, 2009 6:09 pm  

A station manager asked me to pass this on: as of today, there is no way for a station manager to read how much is in each "account." In other words, they will only be able to tell you the total and not the breakdown unless WMATA upgrades software in the stations verrry soon.

by kreeggo on Oct 27, 2009 6:43 pm  

@J: At least CharlieCard launched with more advanced features than what SmarTrip will ever have. I'd take CharlieCard and its advanced features over SmarTrip in a heartbeat even if WMATA would have never taken away the A Line, E Line south of Heath, and the Washington Street El. You Bostonians don't know how good you have it...

Who runs the department that manages SmarTrip, who made the deadline, and who keeps delaying it? I think it's time for a letter writing/public shame campaign if anyone knows a name to publicly blame. If not that, I'll just forward this to the Examiner for front page shame.

by Jason on Oct 27, 2009 6:45 pm  

Can anyone help me with this question,debated a little bit over at DCist? I pay for my metro pre-tax and collect it each month has part of smartbenefits. The WMATA site says all money in that "account" will be forfeited back to my employer. I don't want my salary going back to my employer if it isn't all completely used. Is this what will happen? Will I lose money? Where will it go?

Also, when does this go into effect? January?

Thanks so much.

by Tom on Oct 27, 2009 7:05 pm  

Michael Perkins: I didn't think that the CharlieTicket vulnerabilities could be fixed without massive changes to the system. I don't think the MBTA had/has a back-end server that keeps track of information on cards. Most farecard systems fall to very simple cloning attacks. That is, you read the data off a farecard and save it on your machine. Then you use the farecard until you run out of money. Then you reset the farecard back to the data you saved earlier. If you started with $100 on the card, this should reset it back to $100.

The cloning attack was one of the attacks mentioned by the MIT students. But, the MIT students managed to do something marginally worse: forging arbitrary values on cards. But, from a practical perspective, the cloning attack is almost as bad.

I can't find a reference, but I think NYC gets around the problems by having a back-end server that double checks the values on cards. It doesn't do it in real-time, it just blacklists ones with problems. I think I read that on Bruce Schneier's blog back when the CharlieTicket hack came out. That can go a long way at blocking these attacks. Otherwise better crypto can go a long way too, but that involves changing hardware and cards, so it can be very expensive to do. I can't think of any good quick fixes for the CharlieTicket system.

by Andy R on Oct 27, 2009 7:56 pm  

Tom, pretty sure the employer "bucket" is only for benefits actually provided by your employer (i.e., they pay 'em, not you pretax).

by ah on Oct 27, 2009 8:03 pm  

IÂ’m glad someone is finally taking Metro to task for this. The last article (Jul, 21 GGW) that I read stated that the upgrades would start to roll out at the end of last month. Why the silence for so long, and why it is only a month later that Metro is finally admitting that they missed the deadline (while trying to be sly about it, claiming that the deadline was really the end of the year)? Not to mention that now with the new projection a year away, they must have seen this coming long ago. Yet in typical Metro fashion they refuse to admit there even is a problem until itÂ’s much too late. I would have felt much better about this if they didnÂ’t keep us in the dark and had announced 6 months ago that things were sliding. I agree that SmartBenifits should not have precluded other upgrades, and honestly I think Metro is just using this as an excuse. The IRS does not require Metro to keep the different pools of money separate, only that the individual do so. It seems that Metro has made quite a mess in helping us keep our pre-tax money straight. In the meantime, the other upgrades are equally important. My company provides commuter benefits, but does not participate in SmartBenifits (which I was disappointed about until last week). In order to get a reimbursement for money spent on fares, the IRS requires that I provide receipts, and track my SmarTrip card balance. Something that is almost unworkable with MetroÂ’s current system unless you take the same route everyday, use a separate card for personal use and never run into a broken fare box. Providing simple access to a usage statement online would be a tremendous benefit.

by James on Oct 27, 2009 8:58 pm  

I started hounding them about a week before the deadline. It was about that time that it became clear that the upgrades were not happening. I didn't really have a story other than that it was not happening. I didn't know about this other goofy IRS thing except thy Metro had to do something about it.

Considering this upgrade was one of the three things I started with Metro advocacy for (others were Google Transit and more frequent off-peak trains) I'm pretty disappointed.

by Michael Perkins on Oct 27, 2009 9:31 pm  

@ah and @Tom

The way I understand the SmartTrip cards new bins is that the first bin will hold your SmartBenefits transit dollars (be they employer supplied or pre-tax), the 2nd bin will hold your SmartBenefits parking dollars (be they employer supplied or pre-tax), and the 3rd bin will be general cash.

When riding transit the higher priority bin will be debited. Bin 1 is higher priority than Bin 3.

When parking then Bin 2 will be debited.

I think there is definitely confusion among people because the different ways SmartBenefits are funded for people. Personally it is my pre-tax earnings going into SmartBenefits, my company doesn't supply any money or any matching money. For people who's companies fund their SmartBenefits this probably isn't a big deal. For me I need to know how Metro and my company are going to handle that.

I don't believe this is a requirement by the IRS. Are other transit agencies around the country doing the same thing?

by James on Oct 27, 2009 10:13 pm  

James, it is a requirement from the IRS, as outlined in the powerpoint Dave linked to before.

http://www.wmata.com/pdfs/business/SmartBenefits_IRS_October_2009.pdf
http://www.irs.gov/irb/2006-47_IRB/ar05.html (IRS ruling)
http://www.irs.gov/irb/2008-38_IRB/ar09.html (effective date changed)

The issue the IRS has is that if your employer puts fares on your smarttrip it can't be used "like cash"--it has to be used only for transit. If WMATA wants to allow Smartrip to be used for anything else, it has to offer this for employers to be able to use the direct deposit system and still have it be tax free to the employee.

Yes, I realize money is money (i.e., if you get $100 tax free because you will spend $100 on transit, it doesn't matter what "bucket" it comes from), but the IRS wants more assurance the money you are actually paid will go to transit.

by ah on Oct 27, 2009 11:17 pm  

I really don't see what would take some of these changes so long. The above ground tunnel is like three lines of code, applied only at two stations. It shouldn't be that hard.

if: this station is Farragut North
and: the last station exited is Farragut West
and: current time - exit time < 10 minutes
then: cost=$0.00

by Doug on Oct 28, 2009 2:05 am  

Doug, is it that easy? The code would really need to say "reverse payment", then "reset entry station to last station entered". Because say someone started in Vienna, switched lines, and ended up in Bethesda? They should not get a free ride from Farragut North to Bethesda. The charge should be the difference between (Vienna->Bethesda and Vienna->Farragut West).

by ah on Oct 28, 2009 8:06 am  

@ah: I disagree. Nowhere in the IRS ruling does it say that parking and fare need to be separately accounted for by the smartcard. Only that the tax exempt limits are different for each category, and that the smartcard must be restricted to prevent the purchase of other than fare or parking. Someone must ensure that the fare pool of money gets spent only on fares and that the parking pool of money gets spent only on parking. Ultimately that responsibility lies with the employee. Regardless of the meaning of the IRS ruling, the ruling was issued just shy of three years ago. This is even more of a disgrace to Metro. They had three years to solve this problem, and just a few months before the (already extended) deadline they release a half baked solution, and use the ruling as an excuse to miss delivery of other promised upgrades. The timelines just donÂ’t make sense to me. Metro must have known a long time ago that they were going to miss the September delivery date. I wish that we could somehow make MetroÂ’s leadership elected officials so that we could hold them accountable for these shenanigans.

@Doug: When dealing with proprietary legacy systems such as this, I would avoid making assumptions about how long it will take to complete any change. Sure the logic is easy. Making it mesh with the rest of a system that was designed before smartcards were even imagined may not be. Regardless, Metro and Cubic both knew what they were up against when they announced the delivery dates. There is little excuse for slipping this often and this much.

by James on Oct 28, 2009 9:34 pm  

@Doug @ah
Ah is right. There are various combinations of stations. However, back when I wrote the invisible tunnel posts, I had a conversation with someone at Metro who said it could be done even without the need for the SmartCard upgrades. In other words, we could have had the invisible tunnel for years by now.
I also sent a note to Chris Zimmerman when he was WMATA Chair asking him to check around and perhaps do some pushing. I got a some lip service, but little else.
Yes, it's simple: not three lines of code, but just a lookup table. That's all.
You'd think Metro would want to do something like this just to have some good news to give riders. Finally show a little competence and foresightedness.

by Steve O on Oct 28, 2009 10:57 pm