Liberals were warned about Compass security flaw before launch
The B.C. Liberal government was warned that Compass tickets could be hacked for free fares years before a CTV News investigation uncovered the problem.
NDP MLA Harry Bains wrote then-minister of transportation and infrastructure Mary Polak in 2012, saying the system was vulnerable and that the fix could be expensive.
“I have heard concerns that the new cards that will be used with fare gates have a history of being tampered with by hackers,” Bains wrote.
“It has been said that the hackers are able to reload the fare cards using a cell phone without paying and that fixing the problem could potentially cost millions of dollars,” he wrote.
Bains wrote to the minister on Nov. 30, 2012, as fare gates were being built around the system, with expected launch just months away.
In the end, because of problems with the new tap-in, tap-out system and concerns that those fare gates were keeping out people with disabilities, the system only launched last week.
The idea of the Compass system was that its closed fare gates would bring an end to fare evasion, a problem that was estimated to cost some $7 million a year. But CTV News was alerted to a problem, and confirmed it on camera: It is possible to reset a paper ticket using a cell phone and two free apps to trick the gates.
TransLink has said that it is aware of the method and is monitoring for it, saying that the hack has been used only 20 times since December. It also says that using the method means the card can be deactivated, and if caught, the user can be given a fare evasion ticket or charged with fraud.
The blue plastic Compass Card does not have the same vulnerability, though Bains hints in the letter that it is vulnerable in a different way.
The Compass system was originally said to cost $171 million; the most recent estimate of the cost was $194 million.
Reached at the legislature, the B.C. minister responsible for TransLink said he had not seen the letter.
“I don’t know the answer,” Peter Fassbender said. “I never saw the letter that we are referring to. Hackers try everything they can to beat a whole host of systems, not least of which might be the transit system.”
But NDP Transit Critic Dave Eby said he expected a better answer.
“The minister is totally missing in action,” he said. “He needs to step in, earn his pay, and hold this corporation accountable to British Columbians.”
The Compass Card system was built by San Diego-based Cubic Transportation Systems, under then-transportation minister Kevin Falcon.
Cubic Transportation Systems donated about $3,200 to the BC Liberals in 2015.