Far away from the courtroom battle that has raised questions about Microsoft Corp.'s future in computer operating systems, the giant software company has established a solid beachhead in the smart card market.
A year since Microsoft laid out its strategy to extend the Windows operating system into smart cards, it has accomplished enough to declare at least a preliminary set of victories. Hundreds of programmers have been trained on the system. Several trial implementations are under way involving financial institutions or chip card vendors that work closely with them.
Beyond that, Microsoft has proved an influential supporter of the technology, using its standards-setting power to popularize the idea of making virtually every computer in the coming Windows 2000 generation compatible with smart cards.
What Microsoft has not done, in keeping with its competitors' expectations and perhaps to the relief of antitrust lawyers, is monopolize this still-emerging market. The two principal rivals in smart card operating systems - Java Card from Sun Microsystems Inc. and Multos from Maosco Ltd., a consortium that includes MasterCard International, its Mondex subsidiary, and American Express Co. - have apparently lost no momentum.
In fact, these powerful forces together, each seeking to claim leadership as a so-called open standard, have yet to eliminate a host of other proprietary operating systems developed and maintained by smart card producers such as Gemplus and Oberthur, a legacy of the industry's formative stages.
To observers such as Lutz Martiny, chairman of the European smart card trade association Eurosmart, this is still something of a mess, leaving the market in a state of immaturity that deters banks and others from investing in the technology as much as they might or should.
But the plethora of choices is a reality that others seem willing to accept. Most expect to see shakeouts and rationalizations, but nobody expects Microsoft or anyone else to achieve the kind of dominance that Windows has in personal computers.
"Whether we like it or not, these things are here and will stay the way they are," said Patrice Peyret, director in Sun Microsystems' consumer and embedded products division. Mr. Peyret is, of course, convinced of Java Card's superiority to what Microsoft calls Windows for Smart Cards (a semantic variation of what used to be Smart Card for Windows). But he conceded that "the presence of Microsoft gives credibility" to the technology, particularly in the U.S. market where it has been lacking.
Armand Linkens, who as managing director of Proton World International is partial to the Visa Open Platform specifications and the Java language at its core, said, "Microsoft has a maturing effect on the market."
The fact that "Windows 2000 will be chip-card-driven to some extent and new PCs will be delivered with chip card readers" should provide a general boost, Mr. Linkens said. The industry's "reader problem," the inability to take input from smart card chips in PCs let alone point of sale devices, is well on the way to being licked.
Mr. Linkens also praised Microsoft's endorsement - alongside Sun's - of the Visa Open Platform, overseen by an entity recently organized by Visa called GlobalPlatform Inc. Though Maosco and Multos remain outside that club, Mr. Linkens views the convergence on Open Platform as an encouraging step toward a single interoperable infrastructure approximating the one that enables older cards with magnetic-stripe encoding to be universally acceptable.
For the moment, according to Mr. Peyret, Java has the lead that counts, with 10 million cards in circulation on the third anniversary of that standard. In line with the way the smart card market has evolved, most Java Cards are for telephones that conform to the GSM - Global System for Mobile communications - standard, which requires a chip to authenticate the wireless subscriber.
Two and a half years since Mondex International formed Maosco and turned the Multos multiple-application operating system over to it, Maosco chief executive officer Nick Habgood said 2 to 3 million Multos cards will be out by yearend. Thirty million are projected by next year.
Microsoft is still at an earlier stage, but its progress was measurable last week at events on two continents. Microsoft not only made its presence felt at Cartes '99, the annual smart card conference in France where it unveiled the Windows card strategy last year, but also on the wider stage of the Comdex computer trade show in Las Vegas.
At the latter, Microsoft sent a strong message about the integration of smart cards with Windows 2000, the long-awaited new version of its business-strength operating platform.
The France-based card company Gemplus, among others, was with Microsoft in both locales. Introducing what it called "the first Windows-powered smart card," called GemShield, Gemplus issued one of the most ringing endorsements of its software partner.
Though a broad-based manufacturer of cards and systems for high-volume consumer markets such as telephony and mass transit, Gemplus has recently been in hot pursuit of business from corporations seeking to secure access to their data networks by issuing smart cards to authenticate customers and employees. The emphasis on what Gemplus calls IT security - information technology security - is in concert with Microsoft's expectation that the enterprise market will take off faster than banking or other potentially mainstream consumer uses.
"Windows-powered smart cards will become the de facto standard for network security and Internet applications," declared Michel Roux, Gemplus' vice president of strategic alliances.
The company's chairman, Marc Lassus, said, "Windows for Smart Cards will foster the broad-based acceptance of smart cards in the IT marketplace." Along with the introduction of GemShield, he said, "we have also begun deploying the Windows-powered technology within several key pilot programs and integrating it in associated solutions, such as GemSafe Enterprise, our network-security smart card solution."
Gemplus was far from alone in the Microsoft camp - though by the same token, there is nothing exclusive about the relationship. At the Cartes '99 exhibition in Paris, Gemplus occupied a conspicuous niche at the Sun Microsystems stand with a demonstration of its GemXpresso technology for Java systems, which had just been selected by seven major French banks for the first multi-application smart cards in Europe based on the Visa Open Platform specification.
Gemplus was also involved in a significant announcement in the third camp: a 400,000 card order from the Mondex Korea franchise - in which Gemplus took an ownership stake - with the Multos operating system.
Partnerships Emphasized
In fact, all three platform advocates flaunted their working partnerships, some of them overlapping. Microsoft made joint product announcements with ActivCard, a French-American security technology company; British Telecommunications, which is preparing a 35,000-employee test of remote network access with card authentication; Banque Populaire in France, which will be using Gemplus cards in business-to-business electronic commerce; and more.
Carrying the Microsoft flag at Cartes '99, smart card group director Philippe Goetschel said more than 50 independent software vendors had joined its Smart Card Associates program and committed to shipping Windows products in the coming weeks. Microsoft was demonstrating some of those in its booth from ICL, a Fujitsu Ltd. smart card subsidiary, the French card vendor SAGEM and Utimaco Software of Germany.
Mr. Goetschel also used the occasion to introduce a new Windows Smart Card Tool Kit, which can be ordered off the Internet and should streamline system development tasks with a set of familiar Visual Basic and other programming tools. Mr. Goetschel left the impression that Windows for Smart Cards is only now getting up to speed.
"We have worked with key players in the smart card industry to transform our operating system from a potentially intriguing technology to a credible and powerful solution that is already being implemented around the world," Mr. Goestchel said. "We are especially happy to see that companies have embraced Windows for Smart Cards in a wide variety of applications, whether it be support for GSM (subscriber identity) cards, log-on for Windows 2000, Web authentication, medical record storage, or debit, credit, and cash transactions."
Other Contenders
Not to be outdone, Sun Microsystems' exhibit included, besides Gemplus' GemXpresso 211, GSM-related technologies from Giesecke & Devrient, Oberthur Card Systems, and Bull Group. There was also a platform management architecture demonstration from Platform 7, a London company that came out of the same development department at National Westminster Bank as did Mondex. Indeed, Platform 7 was also prominently placed at the Multos display.
Mr. Peyret expressed confidence that Java Card, which is closely related to Visa's Open Platform and described as "platform independent," will prevail in the end. Sun's entry certainly seems to be well-placed for any broadening of the telecommunications-oriented business base. Mr. Peyret contended that telephone companies will tend to be wary of Microsoft and Windows for competitive and political reasons. He said he doubted that Multos could gain any traction in telecommunications. And with both Microsoft and the Mondex-Multos axis focusing on data security and public key infrastructure, or PKI, encryption technology, Peter Cattaneo, another Sun consumer and embedded products executive, pointed out: "We've been shipping PKI cards for some time now. With the year-2000 problem coming to an end, it looks like that will be a focus for the enterprise market.
"Our licensees typically have two or three applications [on their cards], and one tends to be PKI," Mr. Cattaneo said. "After GSM, that will probably be the No. 2 market."
But in this market of neither absolutes nor monopolies, Microsoft took a little air out of Mr. Peyret's assumption about telecommunications companies by signing British Telecom, a company that has also worked with Mondex. And the most recent member of Maosco Ltd. is Telstra, an Australian telephone company that has more smart card experience than most as a licensee of the Dutch electronic purse system Chipper International.
Chipper, which his shared by both banks and telecommunications entities, was another major presence at Cartes '99 - in an agnostic way. Its Service Box software, a tool for making card applications "platform independent," supports or has been licensed to Sun for Java Card, Maosco for Multos, and Microsoft for Windows.
"We will support the industry's standard platforms as they emerge," said Cees Keetman, president of Chipper International. "Chipper's experience can be used to distribute the same application over different platforms in different countries. And we preserve our customers' investment should they decide to transfer their services to other platforms."
Meanwhile, enough was happening under the Multos banner for Maosco officials to be doing some tactical positioning of their own.
Maosco marketing vice president Hugh Kingdon said 43 applications are being developed on Multos or ported to it. Of those, 13 are PKI and 11 financial. They are included in a 120-page product directory with entries from 50 companies.
The borders between operating platforms may also prove a bit porous. Maosco reported that Secure Network Solutions Ltd. of Australia is making available in Multos smart card format digital certificates compatible with several Microsoft software products.
Maosco also said that Swiftcard Technology Inc. of Manhattan Beach, Calif., which just released a series of Multos application development tools for the C programming language, also intends to provide Java language support by the second quarter of next year. This means that Java program files will be translatable into MEL, the Mondex Executable Language, which Mondex wrote in the early 1990s when there were no alternatives.
"Our developers have used the [Swiftcard] tools and found them easy to use and highly efficient," said Nick Habgood, chief executive officer of Maosco. "Historically, developers have been wary of using new languages for smart cards. Swiftcard brings smart card capability to millions of C and Java programmers."
In the end, Mr. Peyret said, the market will be influenced not so much by operating system technicalities and approaches, but by "the applications that sit on top of these." At a Cartes '99 session with Mr. Peyret, Mr. Goetschel said, "We share a vision of this industry, but our design points are very different. . . . At this point, we both have the most to gain from seeing the overall size of the market grow."
One way Microsoft intends to prove its concept is in a program for employees at the corporate campus in Redmond, Wash. Log-ons to Windows 2000 desktops will require smart cards. E-mail users will use them on the road for network access. Electronic cash will be loaded in the chip for on-campus purchases.
"We call it dog food," Mr. Goetschel said, as in, "we eat our own."
"We will try to incorporate smart cards into everything we do at Microsoft," he said, "because we really believe it's the wave of the future."
