Roughly 200 miles outside of Boston, near the Canadian border, is the CATcard Service Center—the 6-person team overseeing card services for the University of Vermont, as well as three additional higher education institutions, the city of Burlington, VT, and the city schools. In the fall of 2019, this small card office in the northeast corner of the country drew national attention from its peers. The reason? The University of Vermont’s new credential program.
Mark McKenna, director of the CATcard Service Center, recently shared his campus’s credential story during a webinar. Here’s a recap, or you can watch the conversation on-demand.
University of Vermont used magnetic stripe technology for its campus card, the CATcard, for many years. About five years ago, McKenna and his team knew it was time to look for something more secure. They had some “creative students” making cards for residence halls, he said. They needed a card that couldn’t be as easily duplicated to protect students and property on campus.
McKenna’s supervisor at the time was pushing the idea of proximity cards. Knowing that this technology wouldn’t get the level of security he was looking for, McKenna explained the differences between proximity and smart card technology to his supervisor. Like mag stripe, proximity technology is unencrypted and can be easily duplicated. Smart cards offer a superior experience with encryption to help protect against hacks and duplication. Plus smart cards are contactless, which was the real value the supervisor saw in proximity cards.
“Little did I know, he was planning on retiring and this was going to be his ‘swan song,’ converting to contactless technology,” said McKenna. “After that conversation, we began the transition away from mag stripe.”
“We were in the right place at the right time when the opportunity for mobile credentials came around,” said McKenna.
As his team was planning to say goodbye to mag stripe for contactless smart cards, CBORD approached him with a new opportunity—one that would improve security while also providing a superior student experience: Mobile student IDs in the Apple Wallet.
The digital solution uses the industry-leading global standard NXP DESFire EV1 security technology for the enablement of contactless student IDs for iPhone and Apple Watch. Using NFC, the user experience is seamless and secure. NFC is ideally suited for higher education campuses because it mimics the experience of a typical student ID—the smartphone is presented within a few inches of the reader for authentication. There’s no need to unlock the phone or use a mobile application.
“We were extremely excited when we heard about the availability to add the CATcard to the Apple wallet,” said McKenna. “Our department likes to be an innovator and keep our campus program current with whatever technologies that can make life on campus easier. The safety and convenience of having your CATcard on your iPhone or Apple watch was too hard to ignore.”
With the mobile student ID, UVM students, faculty and staff would enjoy the convenience of using their phones for everyday transactions and access on campus. And McKenna would have comfort knowing the technology was encrypted. Now, the only question was how they would get from their current state to mobile.
Originally, before the idea of mobile was realized, McKenna and his team had planned on a slow implementation of contactless technology on campus. “We were in the process of updating a couple of our residence halls that we wanted to immediately convert to contactless using multi-technology cards and readers.”
Then the mobile opportunity presented itself. To implement the mobile solution using the Apple Wallet, McKenna and his team had to develop a plan to achieve a 100 percent use case, which means that anywhere a student could use a physical student ID card, they need to be able to use their mobile credential.
“One thing to note about the 100 percent use case is that at first it can seem like a big challenge, or even a burden,” said McKenna. “But it’s actually a benefit to the school. When everything is converted, students can use their phone everywhere. Otherwise they would need to use their phone here, their card there. How would they remember? If they can use their card everywhere, but their phone only some places, they might end up preferencing the card over their devices because it’s guaranteed to work. That isn’t good for adoption or the user experience.”
The CATcard team shot for 100 percent but didn’t quite hit it. They couldn’t get the city to convert the buses to the new technology, which was understandable since the city and other local colleges were still using mag stripe when UVM prepared to launch this program.
Preparing campus for mobile was a big undertaking that would require upfront investment since the school didn’t have contactless hardware in place. McKenna and his team met with residential life and other larger departments to explain the opportunity and what was needed to make it happen, like the need for new readers across campus. Most were thrilled to move toward a more secure, touchless option for access control, and they agreed to share the costs for the new hardware.
Since access control was the main concern, they focused on that first.
“We replaced read heads on the older electronic locks and mag stripe readers around campus so that they would work with the contactless technology, and we updated firmware. It wasn’t bad at all. We have hundreds of locks around campus, which sounds intimidating, but it went really quick. We went around with Allegion reps and were able to do the firmware updates in a couple days. Swapping the Schlage® AD-300s and 400s was easy too.”
Today, UVM has Schlage AD-300 and AD-400 electronic locks and MT15 multi-technology readers on campus for access, all of which support contactless student IDs in Apple Wallet using CBORD’s CS Gold software.
Next up was point-of-sale locations, like laundry, vending and printing. After auditing the different applications around campus, they decided on an easy conversion using Schlage MT20 readers. According to McKenna, they just plugged in the readers and they were done. The MT20 readers were also used for pandemic protocols. They used an iPad with the readers for check-ins and contact tracing.
To provision the credentials, students use the CBORD GET mobile app. (Note from McKenna: It’s important to have multifactor authentication set up at this step for added security.) After that, students don’t need to open the app for access or credentials as it’s all stored in the Apple Wallet. Students use the credential in Express Mode, which lets them use the credential seamlessly. The phone or watch doesn’t need to be “woken up.” Just present the device near the reader and go.
You can see an example of this in action. In this video, a student is talking on the phone and can access her room without having to hang up or open any apps. Check it out, as well as some more behind-the-scenes footage.
The launch of the CATcard in the Apple Wallet was exactly one day from when McKenna began discussions about mobile with CBORD. They staged a big event around campus with advertising to encourage students to get the mobile student ID.
McKenna recalled, “I was putting a sign on a table at 8:10 a.m. on launch day and stopped to talk to a student about the mobile option. He already had it installed—we went live at 8 a.m. It was exciting to see how quickly people adopted it.”
After the first day, there were about 1,500-2,000 users of mobile student IDs. Today, that has grown to 6,500. Twenty-five percent of all transactions are done with the mobile credential on campus. McKenna expects to see this number increase in the coming year once the Android solution is available.
“We heard that most campuses have about 75 percent Apple users, but we think our campus is closer to a 50-50 split between that and Android,” he said. “Most of the people I talk to who aren’t using it today are Android users. Others just like to use a card. It’s nice to have flexibility for everyone. They can go anywhere with their phone or they can go anywhere with their card. It’s up to them.”
Want to learn more about the University of Vermont’s mobile credential journey? McKenna speaks about their past, present and future. Watch the recording.