Come 2003 and you can walk into the nearest PCO, flash your 32-kb chip and complete your banking transaction. Hold on, if you thought this was some new service that banks in India are going to launch. Thank the Department of Information Technology (DIT) and the Reserve Bank of India (RBI) instead who plan to roll out these services as part of their financial application-based pilot project for smart-card implementation in India. In fact, RBI has also decided to issue a special directive, thereby enabling 22,500 PCOs across the country to act as multifunctional service-delivery points (SDPs). As per the earlier RBI guidelines, only banks could function as SDPs. However, the decision to amend this rule was taken keeping in mind the high penetration and accessibility factors of PCOs, which is essential for the success of this roll out.

Also, in case you thought this would be some kind of a premier service for the have-alls, you are in for another surprise. The project is primarily aimed at benefiting the poorest of the poor—a bhaji walih for instance, can go to any of these PCOs authorized by the banks as an outlet and complete her banking transaction. She may choose to pay back her loan on a daily basis instead of the normal monthly EMI that usually is difficult to pay for most of the people below the poverty line.

According to Rajeev Ratna Shah, IT secretary, DIT, the pilot project is expected to be launched across 63 cities in the country, by early next year. The e-purse project is part of the multi-function smart-card project under active consideration by the ministry, wherein a single smart card can be used for a host of applications like driving licenses, electricity and water bills, or even taxes; and simultaneously can also be used as an e-purse. However, the pilot project will see only the e-purse function being activated, other utilities like driving license or payment of pensions using the same card will trigger off after the completion of the pilot project, circa 2004.

Sources at DIT also revealed that while a broad consensus has already emerged during the inter-departmental committee meeting held on 31 October 2002 on the guidelines that would determine smart card operation parameters, the Smart Card Initiative Committee (SCIC) is currently busy sorting out complicated issues like standards and specifications for smart cards and terminals. It is also working on cryptography issues, standards for interface, and issues related to interoperability. According to a senior official at DIT, the committee needs to address these issues in advance to ensure that once the project is rolled out, vendors do not start the shipment of products that are unable to talk to each other.

The inter-departmental committee, including RBI, Institute for Development and Research in Banking Technology (IDRBT), IBA, Election Commission of India, Ministry of Finance, Indian Railways, Ministry of Surface Transport, Bureau of Indian Standards and also representatives from the army, IT industry, smart-card forum, and IIT, also agreed that all banking and financial applications related to smart cards need to be secured using a PKI-based system. However, members of the committee also agreed to the need for setting up a key management for non-PKI multi-application smart cards. According to sources, SCIC has recommended that while PKI-enabled smart cards should be used during the initial period, the issue of setting up a key management agency for symmetric cards should be reviewed later.

The committee also discussed the ID number schema proposed by a sub-committee under the chairmanship of Dr Vivek K Agnihotri, additional secretary, DAR&PG. Based on the sub-committee’s report, SCIC also recommended that while the ID number should be non-significant, the issuing office number should definitely be a part of the ID number. Keeping a provision for 9,999 centers, SCIC also decided to have a 12-digit ID number with 4 digits for issuing office number, and 8 digits for person’s ID. This, according to a committee member, is also aimed at reducing the ID number size from 16 to 12 digits. Other information like place of birth, state or village code will be kept as fields of record. The committee also suggested that ID cards should be issued after authorization from a separate authorization center, which could be based on the place of birth.

According to VB Taneja, senior director, DIT, and director of the smart-card project, the pilot project proposes to upgrade 22,500 PCOs to act as multifunctional service-delivery points (SDPs) having a smart card based payment system and acting as franchises of various banks. Each PCO booth would be upgraded with a telephone terminal, an Internet appliance, and two pocket-sized e-purse-only terminals. The respective PCO owners will have accounts in the bank where they will deposit the cash thus collected, and will be paid a service charge in lieu. Industry sources reveal that while the price of a 32-kb smart card is around Rs 200, an offline card reader can cost around Rs 18,000, depending on the vendors and systems integrators. While the cost of upgradation and equipment will also have to be borne by the PCO owners, consumer would need to pay for the one-time cost of the card," Taneja said.

The committee has also suggested that the smart card reader should be offline. This will help bypass the capital investment that an online device would entail, explains Taneja. It would have two slots—one for the user’s smart card and the other for the owner’s smart card. The SCIC estimates that an average of 50 such cards would be issued per SDP—a total issuance of 1,125,000 cards during the pilot. SCIC has also recommended two types of interoperable cards with PKI—full-function debit (e-purse, direct debit, and ATM), and e-purse-only cards, to be deployed for the project.

Talking about backend requirements for such an implementation, Sanjeev Shriya, managing director, Smart Chip, and a member of SCIC, said, "It could be anything—from Oracle/DB2 or Unix, but they would be platform-agnostic. Ministry sources also inform that interoperable interfaces will be used for financial and multiple applications, EMV for debit, CEPS for e-purse, and global platform for post-issuance will be demonstrated in the project. The project also aims at using biometrics-based PKI and PSTN lines for dial-up access, DSL-based broadband Internet access, wireless Internet access using variants of GSM/CDMA and WLL, leased lines, ISDN and V-SAT links, among others.

However, neither the government of India nor DIT would be providing any financial support or subsidy for the pilot project. DIT is involved only to the extent of coordinating and handholding as far as the project is concerned. The nitty-gritty of usage, revenue, and RoI would rest exclusively on the respective state governments. Capital costs of smart card related technologies, central systems, and system management and operations would be borne by an operating industry consortium that would manage the project. Taneja, however, was optimistic that the project will generate enough revenue to make it a viable business case for the state governments and the banks involved. According to him, usage norms and specific services being offered by such cards may vary between the states and banks providing such services.

According to Shah, the total duration of the trial-run or the pilot would be 11 months—one month for the deployment of network and backend systems, three months for the proof-of-concept phase on smart card based payment systems, and the remaining seven months for the deployment phase. While the committee has recommended that the deployment phase should be completed by the end of FY 2002-03, sources in the ministry point out that a project of such magnitude may suffer several unforeseen snags and specific details like the roll out time may change drastically. Taneja agrees and suggests that the final shape of the project will be announced soon. "The outline of the project and the reports of the various smart-card committee meetings have been posted on the Ministry of Information Technology web site for suggestions from the smart-card industry and the masses. Let us evaluate these suggestions first—and if necessary incorporate them—only then will we be in a position to formally announce it," he adds.

Shubhendu Parth, Dataquest, and Sudarshana Banerjee, CNS