{"id":35,"date":"2008-01-11T12:13:18","date_gmt":"2008-01-11T20:13:18","guid":{"rendered":"http:\/\/cubist.cs.washington.edu\/Security\/2008\/01\/11\/access-control-on-king-county-metro-transit\/"},"modified":"2008-01-11T12:14:02","modified_gmt":"2008-01-11T20:14:02","slug":"access-control-on-king-county-metro-transit","status":"publish","type":"post","link":"https:\/\/secblog.cs.washington.edu\/Security\/2008\/01\/11\/access-control-on-king-county-metro-transit\/","title":{"rendered":"Access Control on King County Metro Transit"},"content":{"rendered":"<p>Buses are vital for college students looking to get out of the university district and explore the greater Seattle area.  The King County Metro transit service is partially funded by local and federal government but depends on riders&#8217; tolls to break even.  Fares are either collected when the rider boards a bus if the route is inter-city or heading toward downtown, while routes heading out from downtown collect fares when the passenger disembark.  Fares can be in one of four forms, with a fifth (RFID) currently being developed.  <!--more-->A rider can either:<\/p>\n<ul>\n<li> Pay in cash with bills or coins (exact amount only),<\/li>\n<li>Use a transfer obtained from another recent bus ride,<\/li>\n<li>Slide a transit pass with the appropriate fare amount on it, or<\/li>\n<li>Flash a university or senior citizen exemption sticker.<\/li>\n<\/ul>\n<p>The driver of the bus verifies that each form of payment is valid; there are several components of control that help the driver.  The cash box has an electronic LCD display with the current amount of money in it, which resets after no money is inserted for 15 seconds, the transfers are color- and letter-coded (corresponding to the current day) and cut to a length (corresponding to the time of day that the transfer is valid), the magnetic stripe on fare cards are encoded with the months and fares that correspond to the value of the card, and fare stickers are color-coded for easy identification.  In addition, the bus driver opens only the front door when the route is &#8216;pay as you leave&#8217; as opposed to opening all doors when the route is &#8216;pay as you enter&#8217; if people are exiting the bus as well at any stop.<br \/>\nBuses in the Seattle area have these access control mechanisms in order to protect the transit vehicle&#8217;s assets.  The two main assets of a bus are practical, effective transportation of people and security (safety from weather, traffic conditions).  In order for the bus system to be practical, individual buses ensure that all riders are paying for the public service so that the bus system can balance its budget and finance the purchase and maintenance of these large vehicles.  Two potential adversaries to this access control mechanism could be either the riders looking to circumvent the fare or a lax bus driver choosing not to check fares.<\/p>\n<p>To circumvent the access control mechanism, there are several key weaknesses in the current system.  During rush hour, buses handle an exceptional amount of riders boarding and unloading at any given stop, making it difficult for the driver to accurately determine that every passenger has adequately paid their fare.  Drivers may therefore, skip checking individual fares as passengers board the bus quickly and in larger volumes.  Another weakness is inherent in the fourth form of payment, the stickers on identification cards.  Since these payment stickers are not in any way electronic and the cards that the stickers are adhered to come in many different types (UW ID, WA ID, Microsoft\/Google\/IBM\/etc.. ID), there is no automatic way to check them.  The driver must verify the type of sticker and the time period to which the color corresponds.<\/p>\n<p>To defend against the sticker weakness, Metro has already started beta testing a regional transportation card to be used for many transportation options around the greater Seattle area.  This would replace the ambiguous sticker and enforce that all users swipe this RFID-enabled card near a reader.  To defend against quick boarding, some drivers attempt to engage in quick chatter with the boarding passengers, asking to clearly see their fare identification.  By doing this, the line of people boarding the bus moves slower, and fare checking becomes much more accurate.  Since the transit agency is a government-delegated organization, it receives a substantial chunk of funding from local government and a smaller percentage from single fares and transit passes.  The risk of missing a couple passengers fares out of the entire bus load while attaining swift loading and unloading times is mitigated by the alternate forms of funding &#8211; it isn&#8217;t worth the extra cost of addition layers of control to ensure that all passengers have paid.<\/p>\n<p>Given the semi-primitive nature of the King County Metro&#8217;s access control system, it makes sense why additional funds aren&#8217;t allocated to beefing up the fare checking process &#8211; it&#8217;s not worth the extra trouble!  The additional money to strengthen the security system would most likely be more than the amount of unpaid fares recollected.  The weaknesses in the sticker system are now being resolved with an RFID solution which may, in turn bring additional hidden weaknesses in this transit access control process.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Buses are vital for college students looking to get out of the university district and explore the greater Seattle area. The King County Metro transit service is partially funded by local and federal government but depends on riders&#8217; tolls to &hellip; <a href=\"https:\/\/secblog.cs.washington.edu\/Security\/2008\/01\/11\/access-control-on-king-county-metro-transit\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,5],"tags":[24,23,22],"class_list":["post-35","post","type-post","status-publish","format-standard","hentry","category-physicalsecurity","category-security-reviews","tag-non-tech","tag-seattle","tag-transit"],"_links":{"self":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/35","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/comments?post=35"}],"version-history":[{"count":0,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/35\/revisions"}],"wp:attachment":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/media?parent=35"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/categories?post=35"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/tags?post=35"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}