By the end of 2005, all Malaysian citizens over the age of 12 will be carrying a dual interface contact/ contactless smart card as their national ID. With a population of 23 million, the Malaysian program is both one of the world’s first national ID card programs and one of the largest issuances of dual interface technology. The multi-purpose MyKad cards incorporate both government and private sector applications onto a single card.

The US$71 million project is called “MyKad.” The word My shows up in Malaysia’s Internet address as well as meaning personal ownership, while Kad is a dual acronym of “Kad Akuan Diri,” which, translated, means personal identification card and “Kad Aplikasi Digital,” meaning digital application card. The primary integrator for MyKad is Unisys Corp., a worldwide systems integrator specializing in information technology services and solutions.

MyKad began in 1999 when the Malaysian government awarded the project to the Government Multi-Purpose Card Consortium (GMPC), a consortium of five international technology suppliers, including Unisys. Several government agencies in Malaysia also collaborated on the project, with the National Registration Department (NRD) named the lead government agency. The main objectives of the MyKad project, according to Unisys, were to provide a one-stop service center for enhanced customer service and convenience and to provide a secure, single, common platform for present and future government and private sector applications.

A Unisys case study quoted Datuk Azizan Ayob, Director General of the NRD, as to the motive behind MyKad: “In Malaysia, by law, everyone must carry a national identification card once they reach the age of 12. Then there are driver’s licenses, passports and bankcards, so people have too many cards to carry. We wanted one card that could perform multiple government and private sector applications, improving service to citizens and ensuring security of the information on the card.”

There were two challenges that had to be met, he added: “The first one was technology, and the second was changing the mind set of the people to accept the new card. We addressed the technology challenge by evaluating leading edge technologies in the world and choosing the best suited for our needs. Regarding citizen acceptance, the government has the advantage of issuing MyKad to any citizens who reach the age of 12 and to any who have lost their old national identification cards. For the rest, we used media outreach to educate people on the benefits of the multipurpose card, conveying the convenience it offers…People seem to be very happy, especially with the toll and ATM features. People are always in a hurry, and MyKad helps them get service faster.”

The project is launched

“Initially our job was for the design and implementation of the initial pilot and the rollout of the full implementation system,” said Unisys’ Jay Cornish, solutions director for the global public sector.

The pilot got underway in 2002, said Mr. Cornish, but the ambitious goal, which is on target, is to have 15 million Malaysians carded by 2005, added Jacob Kremer. In fact, “we’re ahead of schedule with about 20,000 applications each day,” said Mr. Kremer. Helping meet that goal is the fact that the card is free through the end of 2004. And while MyKad is only available to those over 12, those younger haven’t been forgotten. They have access to “MyKid.” There is even a web page just for them.

What does MyKad do?

“It may not be the first (National ID card program) but it is certainly among the largest,” said Mr. Cornish. “The thing that makes Malaysia unique is that it (MyKad) is a truly multi-purpose card. It replaced the paper card; the driver license and national ID card were both paper-based. The issuance of cards and the infrastructure has gone well in the Kuala Lampur area, (the country’s largest city and its capital) but there have been more challenges in the remote areas of Malaysia.”

With just that one piece of plastic, Malaysians have their national ID, their driver license, immigration and health care records, as well as the ability to pay for transportation (through an e-purse) and utilize banking services.

The MyKad card contains a 64K dual interface chip card, meaning that the same chip can be accessed via both a contact and a contactless interface. It also utilizes biometrics. “With two kinds of fingerprint technology used,” said Mr. Cornish, “MyKad is the world’s first large-scale multi-application smart card using biometrics for security.”

The first technology involves one-to-many searching, continues Mr. Cornish. “For new enrollees or new applicants, their fingerprints are searched against all the other applicants to ensure they don’t already have a MyKad using an alias. It ensures one citizen, one card, as opposed to one citizen, multiple cards.”

“Second,” he adds, “there is also a fingerprint biometric stored on the card that is machine readable. Each time the card is used, the card owner’s live finger can be compared against the template stored in the card to verify that he or she is the owner of the card.”

Each card also includes the user’s photograph, “so there’s visual verification as well,” Mr. Cornish explained.

Other security precautions, said Mr. Kremer, include “the Malaysian Certification Agency (CA) authorized Public Key Infrastructure (PKI) which allows for computer access using a digital certificate issued by CA.” That means it can be used “for e-commerce in Malaysia and with any party supporting PKI,” he added.

“All cards have access key security. Access to protected data on the card and updating data can only be performed by an authenticated Card Access Device (CAD) that is authenticated with a central host using HSM (Host Security Module) devices. It also requires a secure access module being present in the CAD which does authentication between the card and the card access device,” he said.

In addition to logical security, the card also supports physical access. “It is being used by many government and commercial parties for access control, time attendance management, and immigration exit and re-entry,” added Mr. Kremer. “With biometrics on the card, provided by fingerprint and face recognition and the contactless antenna, implementation options are almost endless.”

Expansion plans, he said, include electronic voting, linkage with the social security scheme in Malaysia, and expanding usage of the travel card between all Asian countries.

The card, says Unisys, is designed to allow any combination of government and private sector applications to be loaded on the chip, which conforms to the Multi Purpose Card (MPC) platform.

And payment applications are also enabled …

As to credit card support, “It (MyKad) currently holds the Proton World e-purse, provided by the local banking organization called MEPS. And the card also has complete ATM functionality supporting most of the top-ranked banks in Malaysia,” said Mr. Kremer.

In the transportation arena, “the Touch-N-Go contactless function is used on buses and trains,” he added, as well as for toll roads.

How have merchants taken to the card? Said Mr. Kremer: “Merchants are accepting the e-purse application of the card and the government is making serious efforts to further promote payment acceptance of the MEPS’ e-purse.”

Citizens reacting positively

In the Unisys case study, Datuk Azizan Ayob provided examples of how the GMPC has improved government service to citizens. “The smart card makes it easier to deal with any government department. For example, getting a passport from the immigration department is much easier, because the department can now positively verify the person’s identity using the finger print biometric feature in the card instead of relying on the time-consuming verification against databases of different agencies. Not only do the citizens get faster service, government employees are more productive. The GMPC is also increasing economic activity for the country, expediting the process of verification that is involved when individuals take out loans to finance large projects, thereby reducing the time to complete these projects.”

Some of the MyKad devices associated with the program include the Mobile Card Acceptance Device, a handheld used by enforcement officers from various government agencies to bring up card information and provide fingerprint verification; a Key Ring Reader, which allows card holders to access information stored on the chip; and the Autogate, used by immigration to facilitate entry and exit into or out of Malaysia. There are also desktop CADs with credit card readers.

Mobile CADs can also used to read/update MyKad cards, conduct online blacklist checks via radio frequency and download identity verification of cardholders using biometrics. Mobile CADs can issue summons, accept summons payments via MEPS cash or credit/debit cards, and upload and download blacklist and summons data.

The Immigration Autogate is set up at busy immigration entry/exit points. The functions of the Immigration Autogate are to verify passport information in the MyKad card, to conduct suspect list checks for identity verification using biometrics, and for capture of travel and cardholder information and upload of information to the legacy system.

From conception to reality

Pulling a national ID project like MyKad together did not come easy. “These large scale government ID systems, require a knowledgeable systems integrator,” says Mr. Cornish, “because they tend to be complex; there is potential risk during implementation, risks of interoperability, making sure everything works together.”

“A lot of times stand-alone systems can scale to a couple thousand records, but Malaysia has to scale to a couple of million; from the size of the database to throughput (transaction level). Then there’s the privacy, user friendliness, all these intangibles that the integrator can make sure are in place to insure that the system runs smoothly,” he added. “Of all the global system integrators, we’re arguably the most experienced with implementing large scale government ID systems. We’ve done quite a few ID systems in the U.S. and internationally, such as the Costa Rica voter ID system, the South Africa national ID system, and Spain’s social security ID system.”

The MyKad project has received numerous award and recognition from organizations such as the International Smart Card Association, Asia Multi-Media Conference, and the Chivas Regal Award for Technology Leadership.

Unisys itself sums up best what this small Asian country has accomplished. “The country of Malaysia has recently proven itself to be a technological innovator, implementing a national credentialing program that has improved government service to citizens and increased economic activity for the entire nation.”