Category Archives: Security

SA 3812 and the Open Letter to Senator Harkin

Senator Harkin has proposed an ATM cap fee of $0.50. This of course has upset banking industry insiders such as Gary Faulkner, an executive who has worked for Cardtronics and Diebold.

Mr. Faulkner wrote an open letter to Senator Harkin that claims a cap on ATM fees would be unfair to his industry.

I will skip an analysis of Cardtronics and Diebold ATM security for this post, although it is a tempting and juicy topic. One could argue that fees for a secure system would be justified. Nevermind that, Mr. Faulkner sadly does not once mention security and safety for consumers in his letter. Instead he compares fees for ATM transactions to the beer industry, and argues that fees are “the American way”:

But what if the Congress passed a law forcing Carl to sell his beer for just 50 cents more than he paid for it? Carl, along with many others, would get out of the beer joint business. Soon there wouldn’t be any beer joints. The beer cooler industry would evaporate. The refrigeration man would sign up for food stamps. The college kid would have to dropout of school. That result would be an economic disaster. Nobody wants that – certainly not you and the citizens of Iowa. Senator, you might even like going to Carl’s’ from time to time.

Sounds like a Chicken Little story to me.

Here is the first problem with this letter. There are services that cost money and then there are services that save money. Some may remember the original justification for ATMs was the latter:

When banks first introduced ATM service, there were no ATM fees. The ATM bank was pioneered as a cheaper alternative to a bank teller. In fact, instead of ATM fees, some banks charged “human teller fees” to encourage customers to use the new ATM service.

Thus banks eliminated tellers (jobs) and saved money by introducing automation. It is fair to say the ATM systems cost more than expected, and the jobs were shifted from low-tech to high-tech. Both of these would be true. That does not support the false correlation by Mr. Faulkner — ATMs were meant to give the same service for less, not cost more. The whole idea of the ATM was to reduce the cost, and risk, of hiring and training a teller. This is completely different from selling a glass of beer.

The ATM industry expanded, however, past its original money-saving teller-replacement model. It allowed sharing ATMs across different banks and into foreign exchanges. This brings me to the second problem with the story by Faulkner. He makes a case for beer consumption (pun not intended) as an analogue to pulling your own money out of a bank. Philosophically, these two do not wash.

With money, you own it and you put it in a bank. When you want to get your money, the bank may have to cover fees. It makes sense for a bank to pass fees forward. This is similar to a moving service, rather than purchasing a beer. Another example would be the postal service, where you pay a rate to move your belongings. You expect to pay an amount that is relative to the distance or load.

In the case of interchange rates ATM operators and banks tend to overcharge their users by a significant rate. The average markup for an ATM, for example, is 25%! Here is a typical scenario for an ATM operator:

That is a 304% return on your $1,200 / yr. (after expenses). Even if you put $3,000 in the ATM to assure that the machine does not run low, it is 121% return. Again, this is an example of a location that does 10 transactions a day.

A three hundred percent return based on fees alone. That is for just 10 transactions a day, which is below average. Everyone knows that whether they try to withdraw $20 or $200 the ATM is going to charge them a flat fee. A $3 fee on $20?

Mr. Faulkner tries to argue that this level of profit is essential:

Sen. Harkin, like you I’m in favor of protecting our citizens from the ruthless deceit of a cadre of bad actors that would squander the collective wealth of America for their personal gain. I just don’t believe that eliminating the livelihoods of thousands of guileless individuals working in the ATM industry is a path to that result.

The US Treasury Department Office of Thrift Supervision says the average ATM transaction costs 27 cents. This exposes the weakness in Faulkner’s argument about the need to cover costs. The fees also serve as a reverse fee on those who have the least money. That is hardly defensible with an “American way” stance. The reality is fees are charged by ATM operators based on perceived demand:

ATM fees are also higher in locations such as sports arenas, airports and hotels, locations where you may need to access money quickly and can’t afford to waste time looking for your own bank’s ATM service.

I suppose Mr. Faulkner would say this is true of beer also. Imagine paying a 100% markup on mail delivered on holidays or special events. This is why he should simply admit his industry has had a good run charging high fees and enjoying large profit margins due to consumer demand. They charge high fees because they can, not because they need to. His argument that the fees for moving money are essential to the economy or the market ring entirely hollow.

Personally, I estimate that either through regulation or competition (direct by mobile ATM or indirect by other mobile payment options) fees for ATM will have to face a decline to less dramatic levels. I also know that ATMs need increasingly sophisticated security measures, which I estimate will reduce costs again (less fraud), but I’ll leave that for another post.

In conclusion, Mr. Faulkner has made an analogy to beer in order to explain the fairness of uncapped ATM fees to cover the cost of delivering money to its owner. However, ATMs were created by banks as a cost-savings and job-cutting mechanism. Also ATM fees are far greater than any real interchange or operational cost often delivering profit margins far greater than 100%. The bottom line becomes a question of why fees are a necessity, rather than whether people are willing to pay them, for access to money. With that in mind I do not see any argument posed by Mr. Faulkner that holds any water…or should I say beer?

Mobile Device Economics and Security

I often wonder about the changes as a result of mobile technology in so called rural and under-developed areas. The cost of infrastructure can be prohibitive compared to deployment of wireless technologies. My first introduction to this was when Brazil announced cell phones were being sold within 24 hours at a time when a phone line there could take as long as a year to install. That was over ten years ago. Brazil went from extremely low telephony penetration (sorry I don’t remember exact stats) to over 50% by 2006. The Ukraine in 2010 reported 115% penetration for 54 million users. Just one mobile provider in India (e.g. Bharti Airtel) can report over 2 million new subscribers in a single month! Imagine trying that with this system:

Now I see companies racing to deploy ATMs with the same mobile technology. A point of sale (POS) device and/or a cash dispenser can be placed anywhere you have power. It became clear that the switch from land lines to wireless could significantly reduce the cost of creating and expanding capital for a market. This trend towards micro-capital on a giant scale is why I was excited when asked to help draft a security standard for ANSI that will ensure ATM and POS wireless implementations can be done securely.

A friend in Asia just pointed out a recent paper that is extremely helpful to me for this project. It is a detailed study of the economic impact of information technology in India that confirms the theory above. Wireless technology significantly assists the growth of markets in under-developed areas at a fraction of the overhead and cost of traditional IT. This paper from 2007 called “The Digital Provide: Information (Technology), Market Performance, and Welfare in the South Indian Fisheries Sector” provides the following synopsis:

Between 1997 and 2001, mobile phone service was introduced throughout Kerala, a state in India with a large fishing industry. Using microlevel survey data, we show that the adoption of mobile phones by fishermen and wholesalers was associated with a dramatic reduction in price dispersion, the complete elimination of waste, and near-perfect adherence to the Law of One Price. Both consumer and producer welfare increased.

This begs the question of information resilience in terms of confidentiality, integrity and availability. It is truly exciting to think of the benefits described in the paper, but as a security professional my job is usually to focus on the risks. That is why I have dedicated a chapter in the new ANSI draft to the problem of security in mobile technology for finance. We need to plan and create more dynamic controls for distributed commerce — decentralized or federated markets. This is only possible once business managers can see how and why risks from wireless really are different from wired, especially in terms of new business models.

Animal Biometric Door

The Flo Control Project, named after the feline Flo, has posted a promising update on their animal access control door. They added a facial-recognition system to try and deny Flo access if she has something in her mouth. Technically they are basing recognition on a shadow profile, rather than on Flo’s actual face.

The database of images for access success and failure is probably the best part of the entire story. The key weakness (pun not intended) of physical access systems is usually related to monitoring. A building with only ten doors and half that many cameras can easily find an operations center overwhelmed or soon uninterested in the data. One way to avoid this is to create an analysis and alarm system. Another is just to run tests that are interesting or even amusing. Flo gives a perfect example of the latter:

Flo was allowed in in all of these instances, appropriately so. The vast majority of captured images are like these, just Flo by herself. She goes in and out 5-10 times a day, so we get a lot of these. Cases when the latch does not open are much more rare, especially now, when there are not many animals for Flo to catch. Still, she tries to bring something in occasionally, and we also get other unauthorized visitors: skunks and even birds. Below are some of the cases when the latch did not open.

This brings to mind the story of Little Red Riding Hood. It certainly has shades of “what a big nose you have!”

It also brings to mind the purpose of a cat bringing its catch home. Perhaps a better setup would be a cat-trap (e.g. man-trap for cats) where Flo could deposit her catch to secure it and receive praise. A similar model could be a DCZ (De-Catch-ified Zone) that would exist as a segment between outside and inside.

Personally, I have been thinking about another control I would add to an animal control system, which I’ve mentioned before on this blog. Perhaps if I have time I’ll give it a go and test it on my own animal(s). Right now, however, my pet(s) are not violating any policies and I do not have unauthorized animal access issues.