DOCSLIB.ORG

Security of Loyalty Cards Used in Estonia

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Security of Loyalty Cards Used in Estonia TALLINN UNIVERSITY OF TECHNOLOGY School of Information Technologies Danielle Melissa Morgan 156334IVCM SECURITY OF LOYALTY CARDS USED IN ESTONIA Master’s thesis Supervisor: Rain Ottis PhD Co-Supervisor: Arnis Paršovs MSc Tallinn 2017 TALLINNA TEHNIKAÜLIKOOL Infotehnoloogia teaduskond Danielle Melissa Morgan 156334IVCM EESTIS KASUTATAVATE KLIENDIKAARTIDE TURVALISUS Magistritöö Juhendaja: Rain Ottis PhD Kassjuhendaja: Arnis Paršovs MSc Tallinn 2017 Author’s declaration of originality I hereby certify that I am the sole author of this thesis. All the used materials, references to the literature and the work of others have been referred to. This thesis has not been presented for examination anywhere else. Author: Danielle Melissa Morgan 18.05.2017 Tallinn 2017 Abstract This thesis identifies the card technologies used in loyalty programs across Estonia. These technologies include magnetic-stripe cards, contactless cards (in the form of MIFARE Classic, MIFARE Ultralight, MIFARE DESFire EV1 and low frequency RFID cards) and a smart card known as the Estonian electronic identification card (ID card). Each card type implements its own security features to prevent cloning and/or unauthorized access to the content stored on the card. The contents of each card was read and the method in which it was used in the system analysed. In the cases where possible a clone of the card was created and tested against the real system to verify that it passed the authentication procedures. In the case of the Estonian ID card, a clone of the card was created to log the protocol queries sent by merchant terminals to the card. The study finds that due to the lack of security mechanisms in the technology used, in the majority of cases the loyalty cards provide limited or no protection against card cloning attacks, which makes the loyalty schemes vulnerable to fraud. Keywords: RFID, NFC, EstEID, Estonian ID card, card technology, loyalty card This thesis is written in English and is 76 pages long, including 5 chapters, 41 figures and 22 tables. 4 Abstract Eestis Kasutatavate Kliendikaartide Turvalisus Magistritöö eesmärk on uurida erinevaid tehnoloogiaid, mida kasutatakse Eesti ettevõtete kliendikaartide puhul. Uuritud tehnoloogiate loetelu hõlmab järgnevaid kaaritüüpe: magnetribaga kaardid, NFC MIFARE Classic, Ultralight ja DESFire tüüpi kaardid, madalsagedusel RFID kaardid ning Eesti elektrooniline isikutunnistus (ID- kaart). Igal kaardil on oma turvaelemendid, mis peaksid takistama kaardi kopeerimist ja/või autoriseerimata ligipääsu kaardile salvestatud andmetele. Töö käigus loeti kaartidele salvestatud infot ning analüüsiti viise, kuidas seda infot boonus-süsteemis kasutatakse. Kloonimist võimaldavatest kaartidest tehti koopia ning testiti seda reaal- süsteemide vastu, et veenduda, kas kloonid läbivad autentimise protseduuri edukalt. Eesti ID-kaardi puhul loodi kloon, mis logiks teenusepakkuja terminali poolt saadetavaid protokolli päringuid. Magistritöö tulemusena tuvastati, et puudulike turvamehhanismide tõttu pole enamik kliendikaarte piisavalt kindlustatud kloonimisrünnakute vastu, mis tähendab, et püsikliendi boonus-programmid on petuskeemide poolt haavatavad. Märksõnad: RFID, NFC, EstEID, Eesti ID-kaart, kaarditehnoloogia, kliendikaart Lõputöö on kirjutatud inglise keeles ning sisaldab teksti 76 leheküljel, 5 peatükki, 41 joonist, 22 tabelit. 5 List of abbreviations and terms 3DES Triple Data Encryption Standard APDU Application Protocol Data Unit ATR Answer to Reset CBC Cipher-Block Chaining DoS Denial-of-service EEPROM Electrically Erasable Programmable Read-Only Memory ID Identification IEC International Electrotechnical Commission ISIC International Student Identity Card ISO International Organization for Standardization NDEF NFC Data Exchange Format NFC Near Field Communication PAN Primary Account Number QR Quick Response RFID Radio Frequency Identification RSA Rivest-Shamir-Adleman cryptosystem SHA-1 Secure Hash Algorithm 1 TTU Tallinn University of Technology UID Unique Identifier UT University of Tartu 6 Table of Contents 1 Introduction..................................................................................................................14 2 Magnetic-Stripe Cards..................................................................................................16 2.1 Methodology......................................................................................................18 2.2 Results................................................................................................................20 2.2.1 ABC Card.......................................................................................................20 2.2.2 Aitäh Card.......................................................................................................23 2.2.3 Club One Card................................................................................................24 2.2.4 Hesburger Card...............................................................................................28 2.2.5 ISIC Card........................................................................................................30 2.2.6 Koduekstra Card.............................................................................................31 2.2.7 Partner Card....................................................................................................33 2.2.8 PINS Card.......................................................................................................35 2.2.9 Rimi Card.......................................................................................................37 2.2.10 Säästu Card...................................................................................................39 2.3 Summary............................................................................................................41 3 Contactless Cards.........................................................................................................42 3.1 Contactless Technology.....................................................................................42 3.2 Contactless Tools...............................................................................................43 3.3 Low Frequency (LF) Cards................................................................................45 3.3.1 Methodology...................................................................................................46 3.3.2 Results............................................................................................................46 3.4 MIFARE DESFire EV1.....................................................................................47 3.4.1 Methodology...................................................................................................48 3.4.2 Results............................................................................................................49 3.5 MIFARE Classic 1K..........................................................................................51 3.5.1 Methodology...................................................................................................56 3.5.2 Results............................................................................................................56 3.6 MIFARE Ultralight C........................................................................................67 7 3.6.1 Methodology...................................................................................................70 3.6.2 Results............................................................................................................71 3.7 Summary............................................................................................................75 4 Estonian Identity Card (EstEID)...................................................................................76 4.1 Methodology......................................................................................................77 4.1.1 Design of Fake ID card...................................................................................78 4.2 Results................................................................................................................81 4.2.1 Forum Cinemas...............................................................................................81 4.2.2 Olerex.............................................................................................................83 4.2.3 Pilverprint.......................................................................................................84 4.2.4 Prisma.............................................................................................................85 4.2.5 TTU Library...................................................................................................86 4.3 Summary............................................................................................................86 5 Summary and Conclusions...........................................................................................88 References......................................................................................................................90 Appendix 1 – Communication between TTU gym reader and ISIC card......................92 Appendix 2 – Receipts of purchases using loyalty cards ..............................................94 Appendix 3 – Memory dumps of NFC cards.................................................................98 8 List of Figures Figure 1. Location
Load more

Recommended publications
  • Smart Card Readers 2021/S 093-245130 Contract Notice
    OJ/S S93 14/05/2021 1 / 4 245130-2021-EN This notice in TED website: https://ted.europa.eu/udl?uri=TED:NOTICE:245130-2021:TEXT:EN:HTML Finland-HSL: Smart card readers 2021/S 093-245130 Contract notice – utilities Supplies Legal Basis: Directive 2014/25/EU Section I: Contracting entity I.1) Name and addresses Official name: Helsingin Seudun Liikenne — kuntayhtymä National registration number: 2274586-3 Postal address: Opastinsilta 6A, PL 100 Town: HSL NUTS code: FI1B Helsinki-Uusimaa Postal code: 00077 Country: Finland E-mail: [email protected] Internet address(es): Main address: http://www.hsl.fi I.3) Communication The procurement documents are available for unrestricted and full direct access, free of charge, at: https:// tarjouspalvelu.fi/hsl?id=335313&tpk=3f2f9827-c11f-4bcc-b4f1-d3b63cdeef62 Additional information can be obtained from the abovementioned address Tenders or requests to participate must be submitted electronically via: https://tarjouspalvelu.fi/hsl? id=335313&tpk=3f2f9827-c11f-4bcc-b4f1-d3b63cdeef62 I.6) Main activity Urban railway, tramway, trolleybus or bus services Section II: Object II.1) Scope of the procurement II.1.1) Title: Contactless validator Reference number: 71/02.08.00/2021 II.1.2) Main CPV code 30233300 Smart card readers II.1.3) Type of contract Supplies II.1.4) Short description: Helsinki regional transport authority (HSL) is looking to procure contactless validators, which are capable of reading and updating ISO 14443 A/B contactless travel cards (such as currently used Mifare DESFire travel cards and Mifare Ultralight single charged cards), reading 1D/2D bar codes and QR codes from mobile applications and paper tickets, and reading contactless EMV cards and support pinless contactless payments 14/05/2021 S93 1 / 4 https://ted.europa.eu/TED OJ/S S93 14/05/2021 2 / 4 245130-2021-EN in transit (Visa and Mastercard MTT rules).
    [Show full text]
  • Mobility Payment Integration: State-Of-The-Practice Scan
    Mobility Payment Integration: State-of-the-Practice Scan OCTOBER 2019 FTA Report No. 0143 Federal Transit Administration PREPARED BY Ingrid Bartinique and Joshua Hassol Volpe National Transportation Systems Center COVER PHOTO Courtesy of Edwin Adilson Rodriguez, Federal Transit Administration DISCLAIMER This document is disseminated under the sponsorship of the U.S. Department of Transportation in the interest of information exchange. The United States Government assumes no liability for its contents or use thereof. The United States Government does not endorse products or manufacturers. Trade or manufacturers’ names appear herein solely because they are considered essential to the objective of this report. Mobility Payment Integration: State-of-the- Practice Scan OCTOBER 2019 FTA Report No. 0143 PREPARED BY Ingrid Bartinique and Joshua Hassol Volpe National Transportation Systems Center 55 Broadway, Kendall Square Cambridge, MA 02142 SPONSORED BY Federal Transit Administration Office of Research, Demonstration and Innovation U.S. Department of Transportation 1200 New Jersey Avenue, SE Washington, DC 20590 AVAILABLE ONLINE https://www.transit.dot.gov/about/research-innovation FEDERAL TRANSIT ADMINISTRATION i FEDERAL TRANSIT ADMINISTRATION i Metric Conversion Table SYMBOL WHEN YOU KNOW MULTIPLY BY TO FIND SYMBOL LENGTH in inches 25.4 millimeters mm ft feet 0.305 meters m yd yards 0.914 meters m mi miles 1.61 kilometers km VOLUME fl oz fluid ounces 29.57 milliliters mL gal gallons 3.785 liter L ft3 cubic feet 0.028 cubic meters m3 yd3 cubic yards 0.765 cubic meters m3 NOTE: volumes greater than 1000 L shall be shown in m3 MASS oz ounces 28.35 grams g lb pounds 0.454 kilograms kg megagrams T short tons (2000 lb) 0.907 Mg (or “t”) (or “metric ton”) TEMPERATURE (exact degrees) o 5 (F-32)/9 o F Fahrenheit Celsius C or (F-32)/1.8 FEDERAL TRANSIT ADMINISTRATION i FEDERAL TRANSIT ADMINISTRATION ii REPORT DOCUMENTATION PAGE Form Approved OMB No.
    [Show full text]
  • The Reality of Free Movement for Young European Citizens Migrating In
    The reality of free movement for young European citizens migrating in times of crisis ESTONIA Author: Institute of Baltic Studies Year: 2017 The objective of the project “The reality of free movement for young European citizens migrating in times of crisis” is to look into the reality of free movement from the viewpoint of young Europe- ans (age 25-35) who exercise or plan to exercise this right. This publication is the country report for Estonia. ON-THE-MOVE –”The reality of free movement for young European citizens migrating in times of crisis” Grant Agreement JUST/2014/RCIT/AG/CITI/7269 CONTENTS Summary ................................................................................................................................4 I Situation of young people and migration patterns Migration patterns and trends for young people ..............................4 The ways young people are reacting to these challenges .... 11 Interim findings ..............................................................................................................17 II Experiences of young people on free movement Sample and method .................................................................................................19 Estonians who wish/plan to move ............................................................20 Estonians who moved and returned ........................................................23 EU citizens in Estonia .............................................................................................26 Views of representatives
    [Show full text]
  • Summary Future of Identity in the Information Society
    FIDIS Future of Identity in the Information Society Title: “D4.2: Set of requirements for interoperability of Identity Management Systems” Author: WP4 Editors: James Backhouse (LSE) Michael Vanfleteren (KU Leuven) Reviewers: Els Soenens (VUB, Belgium) Paolo Spagnoletti (Luiss University, Italy) Identifier: D4.2 Type: [Deliverable] Version: 1.1 Date: Tuesday, 20 December 2005 Status: [Final] Class: [Public] File: fidis-wp4-del4.2.Set_of_requirements.doc Summary This report highlights the spread of opinion amongst a group of European experts in application areas of identity management on the issue of interoperability of such systems. It builds from an earlier report that presented a literature review and an account of research in interoperability. It uses the three-part conceptual framework of technical, formal and informal dimensions through which to frame the questions posed and interpret the answers given. The 23 interviewees from 5 different European countries, while differing in detail, display a remarkable consensus on much of the issues. Application areas from which the experts are drawn cover egovernment, ehealth and ecommerce, and while, given their specific nature, there may be many points on which such areas diverge, the likelihood of interoperability is deemed to turn on a small number of key questions, mostly non-technical. Importance is given to building trust in the citizen and end-user through good communication, usability, compliance with data protection and privacy principles. Copyright © 2004-05 by the FIDIS consortium - EC Contract No. 507512 The FIDIS NoE receives research funding from the Community’s Sixth Framework Program FIDIS D4.2 Future of Identity in the Information Society (No.
    [Show full text]
  • ARNIS PARSOVS Estonian Electronic Identity Card and Its Security
    ARNIS PARSOVS ARNIS DISSERTATIONES INFORMATICAE UNIVERSITATIS TARTUENSIS 24 Estonian Electronic Card Identity and its Security Challenges ARNIS PARSOVS Estonian Electronic Identity Card and its Security Challenges Tartu 2021 1 ISSN 2613-5906 ISBN 978-9949-03-570-0 DISSERTATIONES INFORMATICAE UNIVERSITATIS TARTUENSIS 24 DISSERTATIONES INFORMATICAE UNIVERSITATIS TARTUENSIS 24 ARNIS PARSOVS Estonian Electronic Identity Card and its Security Challenges Institute of Computer Science, Faculty of Science and Technology, University of Tartu, Estonia. Dissertation has been accepted for the commencement of the degree of Doctor of Philosophy (PhD) in computer science on February 26, 2021 by the Council of the Institute of Computer Science, University of Tartu. Supervisors Dr. Jan Willemson Cybernetica AS Tartu, Estonia Prof. Dr. Dominique Unruh University of Tartu Tartu, Estonia Opponents Prof. Dr. George Danezis University College London London, United Kingdom Assoc. Prof. Dr. Petr Svenda Masaryk University Brno, Czech Republic The public defense will take place on April 9, 2021 at 14:15 via Zoom. The publication of this dissertation was financed by the Institute of Computer Science, University of Tartu. Copyright © 2021 by Arnis Parsovs ISSN 2613-5906 ISBN 978-9949-03-570-0i(print) ISBN 978-9949-03-571-7i(PDF) University of Tartu Press http://www:tyk:ee/ To Estonia – the world’s most advanced digital society ABSTRACT For more than 18 years, the Estonian electronic identity card (ID card) has provided a secure electronic identity for Estonian residents. The public-key cryptography and private keys stored on the card enable Estonian ID card holders to access e-services, give legally binding digital signatures and even cast an i-vote in national elections.
    [Show full text]
  • Tcrp Report 94
    TRANSIT COOPERATIVE RESEARCH TCRP PROGRAM REPORT 94 Sponsored by the Federal Transit Administration Fare Policies, Structures and Technologies: Update TCRP OVERSIGHT AND PROJECT TRANSPORTATION RESEARCH BOARD EXECUTIVE COMMITTEE 2003 (Membership as of March 2003) SELECTION COMMITTEE (as of October 2002) OFFICERS CHAIR Chair: Genevieve Giuliano, Director and Prof., School of Policy, Planning, and Development, USC, Los Angeles J. BARRY BARKER Vice Chair: Michael S. Townes, Exec. Dir., Transportation District Commission of Hampton Roads, Hampton, VA Transit Authority of River City Executive Director: Robert E. Skinner, Jr., Transportation Research Board MEMBERS DANNY ALVAREZ MEMBERS Miami-Dade Transit Agency KAREN ANTION MICHAEL W. BEHRENS, Executive Director, Texas DOT Karen Antion Consulting JOSEPH H. BOARDMAN, Commissioner, New York State DOT GORDON AOYAGI SARAH C. CAMPBELL, President, TransManagement, Inc., Washington, DC Montgomery County Government E. DEAN CARLSON, Secretary of Transportation, Kansas DOT JEAN PAUL BAILLY JOANNE F. CASEY, President, Intermodal Association of North America Union Internationale des Transports Publics JAMES C. CODELL III, Secretary, Kentucky Transportation Cabinet RONALD L. BARNES JOHN L. CRAIG, Director, Nebraska Department of Roads Central Ohio Transit Authority BERNARD S. GROSECLOSE, JR., President and CEO, South Carolina State Ports Authority LINDA J. BOHLINGER SUSAN HANSON, Landry University Prof. of Geography, Graduate School of Geography, Clark University HNTB Corp. LESTER A. HOEL, L. A. Lacy Distinguished Professor, Depart. of Civil Engineering, University of Virginia ANDREW BONDS, JR. HENRY L. HUNGERBEELER, Director, Missouri DOT Parsons Transportation Group, Inc. JENNIFER L. DORN ADIB K. KANAFANI, Cahill Prof. and Chair, Dept. of Civil and Environmental Engineering, University of FTA California at Berkeley NATHANIEL P.
    [Show full text]
  • NFC/RFID Token Security. Case Study: Estonian Public Transportation Cards
    NFC/RFID token security. Case study: Estonian public transportation cards Yauhen Yakimenka Supervised by Jan Willemson December 17, 2016 Abstract This report, prepared for the course Research Seminar in Cryptogra- phy, talks about security of NFC/RFID cards. It first describes the most widely-used type of cards, MIFARE Classic, and then considers a real-life application, namely Estonian public transportation cards. The commu- nication between a real card reader installed in Tartu bus and a Tallinn public transportation card is eavesdropped and analysed on high level. 1 Introduction Radio frequency identification (RFID) cards is a pervasive technology nowadays. More and more systems adopted this technology as replacement for barcodes, magnetic stripe cards and paper tickets for a variety of applications. Contactless cards consist of a small piece of memory that can be accessed wirelessly. Some of them can also have some computing capabilities. RFID cards are of two main classes, low-frequency and high-frequency. The former operates on 125kHz frequency range and do not any cryptographic ca- pabilities. In fact, they can be seen as radio-frequency analogue of bar codes: a card simply transmits pre-coded information. Cards operating on a 13.56GHz frequency range (also known as Near-Field Communication (NFC) cards) can be made to implement more sophisticated protocols. We further talk about one particular type of such cards, MIFARE Classic. 2 MIFARE Classic cards MIFARE Classic is perhaps the most widely used type of high-frequency cards. They were introduce in 1995 by NXP (formerly Philips). The logical structure of MIFARE Classic is shown in Figure 1.1 The card is in principle a memory card with few extra functionalities (read, write, increment and decrement).
    [Show full text]
  • Card-Only Attacks on Mifare Classic Or How to Steal Your Oyster Card and Break Into Buildings Worldwide
    Card-Only Attacks on MiFare Classic or How to Steal Your Oyster Card and Break into Buildings Worldwide Nicolas T. Courtois University College London , UK Better Card-only Attacks on Mifare Classic Slides I will cover only 50% and skip the technical parts. Full version: Google “UCL CS Courtois” These slides: www.nicolascourtois.com/papers/mifare_all.pdf My paper: SECRYPT 2009, see also eprint.iacr.org/2009/137/ Hack it at home: step by step instructions: http://www.nicolascourtois.com/MifareClassicHack.pdf 2 Nicolas T. Courtois, 2009 Better Card-only Attacks on Mifare Classic Outline 1. Security in the Smart Card world: • Traditional model vs. disruptive RFID technology • Open vs. Close source models 2. MiFare Crypto 1 cipher: waste of silicon x more than 1 billion copies sold. 3. Barriers to breach: • The need for hacking and reverse engineering • Hardware set-up 4. Early attacks 5. Card-only attacks [NEW] • My own • Dutch researchers from Nijmegen • Combined 6. Inside Oyster Cards + other countries… 7. Who is to blame? 3 Nicolas T. Courtois, 2009 **About Our Job Better Card-only Attacks on Mifare Classic **Key Question: Is actively researching serious security vulnerabilities socially desirable? - Of Course Yes! …will tell you every professional hacker and every academic code-breaker… 5 Nicolas T. Courtois, 2009 Better Card-only Attacks on Mifare Classic **Bruce Schneier [14 May 2008]: Problem: A hacker who discovers one [attack] can sell it on the black market, blackmail the vendor with disclosure, or simply publish it without regard to the consequences. Q: […] is it ethical to research new vulnerabilities? A: Unequivocally, yes.
    [Show full text]
  • Security Analysis of Near-Field Communication (NFC) Payments
    Security Analysis of Near-Field Communication (NFC) Payments Dennis Giese, Kevin Liu, Michael Sun, Tahin Syed, Linda Zhang May 16, 2018 Abstract Near-Field Communication (NFC) is a modern technology for short range communication with a variety of applications ranging from physical access control to contactless payments. These applications are often heralded as being more secure, as they require close physical proximity and do not involve Wi-Fi or mobile networks. However, these systems are still vulnerable to security attacks at the time of transaction, as they require little to no additional authentication from the user’s end. In this paper, we propose a method to attack mobile-based NFC payment methods and make payments at locations far away from where the attack occurs. We evaluate our methods on our personal Apple and Google Pay accounts and demonstrate two successful attacks on these NFC payment systems. 1 Introduction Prior to the digital age, physical access control was managed by locks and keys and payments were only made via cash. Today, these are being phased out in favor of digital solutions. Physical access control is now often managed by magnetic, wireless ID cards or biometrics, such as fingerprints, while payments can be made by credit cards or contactless payment methods. The convenience of these new digital methods are making them increasingly popular. However, the greater prevalence of these technologies poses new security risks. Whereas in the past a key or cash might have to be stolen physically, they can now be stolen digitally. Furthermore, rather than just having a key or a few bills stolen, these virtual attacks can wreak havoc on a person’s life, leading to a severe invasion of privacy and identity theft.
    [Show full text]
  • Security Aspects of E-ID and Digital Signing
    Security aspects of e-ID and Digital Signing Guarantee to Trusted Electronic Procedures Raul Rikk Head of National Cyber Security Domain PRINCIPLE One way calculation (encryption) is easy, other way calculation is time consuming (decryption) Confidential LOCK OPEN Public Public Key Key Key Cryptography Digital signature solution Confidential OPEN LOCK Public Key Key Authentication solution Encryption solution Electronic Trust Services 1 2 3 4 5 6 WEBSITE CREATION e- USER e-TIME SECURE PRESER- AUTHENTI- OF THE SIGNATURE e-ID STAMP DELIVERY VATION CATION DOCUMENT / SEAL Health Document Population Vehicle Insurance Exchange Energy Telecom Banks Register Register Centre Register X - GIS Adapter Server Adapter Server Adapter Server Adapter Server Adapter Server Adapter Server Adapter Server Adapter Server Security Server Security Server Security Server Security Server Security Server Security Server Security Server Security Server Internet Network Security Server Security Server Security Server Central Central Adapter Server PORTALS TRUST Server 1 Server 2 e-Health, e-Police, e-Tax Board, SERVICES Admin e-School, m-Parking, etc. Central Monitoring System of Certification State Public Citizen Enterpriser OCSP Information e-ID servant view view Timestamping Help Desk System view Check if the Proof of Secure Secure website Authenticate Signing or submission storage of delivery with really yourself sealing the of the the confirmation belongs to using an e-ID document document in documen- of receipt the owner due time tation How hard is to break cryptosystem RSA 2048 Parameter Classical computer Quantum Computer Working time 10 years 24 hours Hardware size Server farm 60% of 1 room Europe Price $1017 … $1018 $1011 Is the technology available? Yes Not yet U.S.
    [Show full text]
  • NRTA Year Round Bus Service Study-Phase 2
    ,.. _, i ’f“l* I _:: : P,,_, /___ ____":% iiiiiiit ' <-‘Q ;\~__\\"‘,v'-"* -1‘ é 7 _ -' 2:-.*:! _____ _ iii, L ' _2' _ -—- *“§l E ?:7 55,- _ ,_ L L k ¢_ '___._,.i,;,, 1 _;,_; 1 II ‘ Photo by Susan Richards, SR Concepts 94% 1; K / W1 ' u<'§ -7." Q 1!“ '2 '~ ~ W, " \, 1/1 / ‘-\é‘ i 1 ‘ V J if -=) ‘ __ .-. 1; _" _. ‘ ' , ,_ rs. V\_ ‘ \ . \' " £2~.@in _ , H: I ... I 7“ - K ‘ - 5' ‘ <’ _ {ii} __.4;..* ~22” ‘TiIt K ' I \.1\>\ i? gii -Photo by Susan Richards, SR Concepts I . - Photo by SusanK‘ Richards," SR Concepts Photo by Susan Richards, SR Concepts 4 Q , § =\__§__ \ V ‘ I-1‘ 1 llflllilifilfil HODIOMI U888“fllllflfifill NRTA Year-Round Bus Service Study Phase II Report: Fare Policy Review and Development of Innovative Funding Options Nantucket Regional Transit Authority December 2016 NRTA Year-Round Bus Service Study Phase II Report TABLE OF CONTENTS Executive Summary ................................................................................................................ ES-1 Local Outreach ................................................................................................................... ES-1 Innovative Funding Options ................................................................................................ ES-1 Fare Policy Analysis ............................................................................................................. ES-2 Fare Collection Technology Analysis.................................................................................... ES-2 Next Steps .........................................................................................................................
    [Show full text]
  • Commercial Code1
    Issuer: Riigikogu Type: act In force from: 01.08.2016 In force until: 31.12.2019 Translation published: 13.07.2016 Commercial Code1 Passed 15.02.1995 RT I 1995, 26, 355 Entry into force 01.09.1995 Amended by the following acts Passed Published Entry into force 28.05.1996 RT I 1996, 40, 773 08.06.1996 26.06.1996 RT I 1996, 51, 967 29.07.1996 consolidated text on paper RT RT I 1996, 52, 993 11.02.1997 RT I 1997, 16, 258 16.03.1997 05.06.1997 RT I 1997, 48, 774 10.07.1997 21.10.1997 RT I 1997, 77, 1313 12.11.1997 17.12.1997 RT I 1998, 2, 48 09.01.1998 17.02.1998 RT I 1998, 23, 322 22.03.1998 11.03.1998 RT I 1998, 30, 410 01.10.1998 25.03.1998 RT I 1998, 36, 552 01.05.1998 17.06.1998 RT I 1998, 59, 941 10.07.1998 consolidated text on paper RT RT I 1998, 91, 1500 20.01.1999 RT I 1999, 10, 155 01.01.2000 17.02.1999 RT I 1999, 23, 355 19.03.1999 10.02.1999 RT I 1999, 24, 360 01.07.1999 16.06.1999 RT I 1999, 57, 596 17.07.1999 15.12.1999 RT I 1999, 102, 907 10.01.2000 22.03.2000 RT I 2000, 29, 172 17.04.2000 06.06.2000 RT I 2000, 49, 303 08.07.2000 14.06.2000 RT I 2000, 57, 373 01.01.2001 20.06.2000 RT I 2000, 55, 365 12.07.2000 13.03.2001 RT I 2001, 34, 185 10.04.2001 05.06.2001 RT I 2001, 56, 332 01.10.2001 06.06.2001 RT I 2001, 56, 336 07.07.2001 17.10.2001 RT I 2001, 89, 532 01.01.2002 14.11.2001 RT I 2001, 93, 565 01.02.2002, partially14.12.2001 19.12.2001 RT I 2002, 3, 6 01.02.2002 27.03.2002 RT I 2002, 35, 214 01.06.2002 05.06.2002 RT I 2002, 53, 336 01.07.2002 19.06.2002 RT I 2002, 61, 375 01.08.2002 19.06.2002 RT I 2002, 63, 387 01.09.2002
    [Show full text]