Comments on: ORCA Privacy

By: Jeff Welch

Jeff Welch — Thu, 07 Jan 2010 05:05:29 +0000

I seriously doubt that you’re getting “yelled at” by ST drivers, or being told to get off of their bus.

If it’s true – report it, but I call “BS”.

By: orca abuse

orca abuse — Thu, 07 Jan 2010 05:04:13 +0000

I can not get my Jan 2010 orca card to work. Evidently when electronic data sent to the Transit Authority it was corrupt. I have spent 3 days now getting yelled at by Sound Transit drivers and told to get off their bus ! Luv the technology !

By: Karl Koscher

Karl Koscher — Wed, 06 Jan 2010 09:02:24 +0000

I was the one who partially decoded the information.

We haven’t tried cloning the cards, both due to the fact that it’s likely illegal, and that looking at ORCA is a side-project for us, and we don’t have enough time to fully investigate everything.

That being said, the ERG contract states that ORCA supports two card types: the Mifare DESFire, and the Mifare Ultralight. The ultralight has NO encryption or authentication capabilities. If it’s possible to make an ORCA reader accept an ultralight card as a full DESFire card, then you should be able to clone them.

A couple of caveats: If they check the UID of the card, then you’d need to use a custom card to spoof the UID. Also, they might be able to detect discrepancies on the back end, particularly if it’s not a pass, so your card would likely get nuked after a day or two.

By: International SOF

International SOF — Mon, 28 Dec 2009 21:40:13 +0000

It is reported that employers provide these discount cards as a perk or an additional form of compensation. How do you make the connection then that they have the right to know how you use it. Should they be able to check your health care records and see your wife’s OB/GYN records because they pay part of your health insurance – which is a form of compensation. From that we can then argue that since they pay you they have the right to know how you spend that money and indeed dicate how it is spent. Our consitution used to protect us from government intrusion. But now we have corporate entities prying into every aspect of our private lives just becasue we work for them. This is nothing more than modern slavery. You are entitled to a certain number of sick days per year. It is your contractual right, you have every right to use them. Employers can not then turn around and cry “foul” if you happen to go to the store, or the museaum, or indeed even the beach on a day when you have called in sick. A corporations “desire” to make a profit and maximize productivity (notice I said desire not “right” because it is NOT a right) in no way trumps your right to privacy and self determination. It is not like you are using a company computer, a work tool, to do personal blogging with.

By: Sysman

Sysman — Mon, 28 Dec 2009 17:03:52 +0000

NEVER EVER EVER use any kind of RFID spy chip technology attached to your real name.

Pay cash, Buy a card under an assumed name, use your work spy card for WORK only or not at all. I don’t care HOW much more it costs me.

I have 4 of these cards under 4 different names, what do I have to hide? Nothing.. but I CRAVE my privacy and refuse to be spied on by ANY job, or any system.

By: Josh

Josh — Tue, 22 Dec 2009 05:35:00 +0000

There are no readers at many Sounder station entrances, either — in Auburn, for example, the north entrances to the platforms have no readers; if you use the north entrance, you have to walk south 2+ railcar lengths to get to the first reader. Not good for the last-minute commuter who’s there in time to catch the train but not to run south a couple of cards, tag in, and then catch the train.

By: Josh

Josh — Tue, 22 Dec 2009 05:26:30 +0000

Yes, but your cash transactions are still tied to your unique card ID, so your employer, the newspaper, or the police could still browse your travel history out of curiosity or worse.

The point of having two cards is presumably so that one of them isn’t registered and isn’t tied into your employer’s data access.

By: Josh

Josh — Tue, 22 Dec 2009 05:23:00 +0000

The latest revision to the ORCA mail-order form includes instructions for ordering a youth card by mail with proof of age. Haven’t gotten mine back yet, but haven’t had the order declined, either.

By: Mike Orr

Mike Orr — Mon, 21 Dec 2009 21:05:49 +0000

How much does an ORCA reader cost? Is that the reason there’s not more readers? You’d think they could afford some semi-portable readers on the platforms, and later keep them as spares (or for special services like the sports/festival buses).

By: Boondog

Boondog — Mon, 21 Dec 2009 18:55:14 +0000

This story was amazing! The real issue is not that employers will have access the information related to the cards they purchase for their employees…but rather that the “news media” does!! The Seattle Times does an article expressing concern about privacy, and they were the organization down in Olympia fighting to successfully insert language allowing the “news media” access to YOUR personal information. On top of that, the language is so vague it appears any blogger sitting in his basement can consider himself part of the “news media” and request this information.

THAT is the issue here! Not that your employer might take the time to see that you boarded the bus on Wednesday at 2nd and Marion with your employee ORCA card, but that anyone associated with the “news media” can pull your card data at anytime.

By: Gary

Gary — Mon, 21 Dec 2009 17:10:23 +0000

The international station is like that. The Pioneer Sq station is not. And I agree it sucks.

By: Sue M

Sue M — Mon, 21 Dec 2009 15:34:15 +0000

@Mike Orr, you don’t need 2 different orca cards to do cash and pass – I have a firm-subsidized monthly pass on my Orca, but when I registered it I can add cash to it as well (the call it the “e-purse”). It always takes my pass amount first, and the one time I took a $2.50 trip with my $2 pass, it said “Pass + $0.50″ on the display. Worked just fine.

By: Oran Viriyincy

Oran Viriyincy — Mon, 21 Dec 2009 07:18:04 +0000

Is it possible to “clone” the cards by skimming them?

By: Brian Ferris

Brian Ferris — Mon, 21 Dec 2009 07:16:11 +0000

I worked on this with another student at UW. He read the data from the cards and I helped decode the data block into the appropriate fields (trip, time, fare, etc).

By: Ian Albert

Ian Albert — Mon, 21 Dec 2009 03:20:34 +0000

What they need to do in the Downtown Seattle tunnel is move the readers from the mezzanine level to the platform level since it’s being used by both the Link and by busses. There have been times when going from station to station in the tunnel that I have preemptively “tapped” my card (I have a pass) before going down to the platform because I didn’t know whether the Link or one of the busses will show up first.

By: Chris Osburn

Chris Osburn — Sun, 20 Dec 2009 21:23:16 +0000

Do you have a source on this?

By: D100

D100 — Sun, 20 Dec 2009 17:39:49 +0000

More readers – when you enter the University Station bus tunnell, there is ONE card reader on the left side at the bottom of the escalator. You have to walk out of the direction of desired travel and cross in front of people going up the esc. to the street to “tap” the card. There isn’t another card reader at the elevator or at the stairs going down to the platform, and there are no readers on the platforms. The reader being on the left side means that a right-handed person has to cross over – it just isn’t designed very well at all.

By: Mark Dublin

Mark Dublin — Sun, 20 Dec 2009 01:44:32 +0000

Very good idea. In Vancouver BC, you can also get all-day transit passes at local equivalent of 7-11′s. ORCA day passes would be excellent.

To me, what you suggest would cure the worst unfairness about Orca introduction: creating one more hardship for the very people who deserve it least, poor working people with no credit cards.

Please contact your county councilmember, and your ST board member, and urge them to be sure ORCA service is widely and easily available before they start to essentially punish people for not having it.

By: Lloyd

Lloyd — Sat, 19 Dec 2009 21:42:31 +0000

Since the 1980s, and certainly since the enactment of the so-called “Patriot Act”, anyone with a driving license, passport, checking account, retail loyalty card or ATM card has almost certainly lost any control over who has what information about themselves. This is a Seattle Times generated Tempest in a Teapot – had they chosen to do a thorough investigation on privacy issues, the focus of the story would NOT have been on ORCA.

By: MikeBoyScout

MikeBoyScout — Sat, 19 Dec 2009 17:32:56 +0000

Another thing… many employers subsidize at rates less than 100%, but appear to be entitled to 100% of the information of the card.