clm-ef8488b857c40785
quantitative
The MBTA issued its first CharlieCards on 4 December 2006
Permanent project revision
Revision 2026-08-20-source-dates · effective 2026-08-09
Current revision. This is the snapshot used by the live entity page.
Recorded sources[].date on every source that states one and an explicit null on the living pages that state none, so the entry can say how old its evidence is.
sha256:15c46b3ae5cc6dd3c447b9831a3c64653e1eee2124d87d9f6bb16dc03e713921
replace /snapshot/projectFingerprint — Updated projectFingerprint to the current sourced project record.replace /snapshot/sources — Updated sources to the current sourced project record.The text below is copied verbatim from the published record. Each claim names the source dossiers that carry it; caveats stay attached to the claim they qualify.
clm-ef8488b857c40785
quantitative
The MBTA issued its first CharlieCards on 4 December 2006
clm-f8682281eb1abc55
quantitative
still keeps the balance on the card — the weakness MIT students were sued for describing in 2008 and Medford high-schoolers cloned again in 2023, that time with the agency's help
clm-2f88fc003b7e9829
quantitative
Its replacement, awarded to Cubic for mid-2020, took bank cards in August 2024
clm-232abb715c42ed5c
descriptive
Commuter rail still cannot tap.
clm-f7f8fab29bfb81cf
quantitative
The MBTA awarded the Cubic-John Laing consortium about $723M in November 2017 for full implementation by mid-2020.
clm-f4a86e2575621ff2
quantitative
After the December 2019 reset, which scrapped the planned 'big bang' and added more than $200M
clm-8dfef294f76ce6c8
quantitative
the amended contract reached $935.4M and the project $960.2M
clm-a4a029088f362c8c
quantitative
in May 2024 the board moved full rollout from May 2024 to June 2026 and the contractual longstop from August 2025 to June 2027
clm-862cd9e4ce18f264
quantitative
The Massachusetts State Auditor reported on 16 January 2025 that the contract let deadlines be overridden without sufficient controls, and that the MBTA had not obtained the surety bond state law required, so it 'may not be able to recover money it paid for the $935.4 million contract in the event that the contract is not completed.'
clm-9f2c6e85238824da
quantitative
it was litigated in 2008 and demonstrated again in 2023 — and it persists because the value sits on the card rather than in a back office
clm-eba250c1ffc2f936
quantitative
the income-eligible fare launched in September 2024 reached 44,875 riders in its second year
clm-767ce35db899e7b4
quantitative
the second-generation card promised for spring 2025 was still listed as coming soon in July 2026
This layer records what is known about each source, what is still missing, and the exact snapshot this page is rendering. A missing date, archive or hash stays visible as missing.
Awaiting operator and domain-expert review; publication of this revision implies neither.
sha256:15c46b3ae5cc6dd3c447b9831a3c64653e1eee2124d87d9f6bb16dc03e713921
src-2b059d4c69c896b0The operator's own award release and the baseline every later figure is measured against: the board approved 'the consortium of Cubic-John Laing for the design, integration, and implementation' at 'approximately $723 million, which includes operating costs through 2031.' The promise, in the MBTA's words: 'The new system will also allow all-door boarding on the Green Line and on buses', customers 'will be able to pay fares by tapping debit and credit cards', and 'The ability to tap and board the same way on all buses, trains, commuter rail and ferries.' On timing: 'MBTA customers will begin to experience the first elements of the new system late in 2019. Full implementation will occur by mid-2020.'
src-a51296ca9f5362abThe reset, and the load-bearing source for what was postponed rather than cancelled. The original plan was for 'many of the features to come online in 2020 in a so-called big bang and for all-door boarding to begin in 2021'; after the board vote, all-door boarding 'now will not be piloted until three or four years in the future', and tapping a credit card at a fare gate was deferred with it. The revised plan carried 'more than $200 million in additional costs.' General Manager Steve Poftak: 'all three of those assumptions were off, and what we've done here is a course correction.'
src-d04425868141338fThe amendment itself: it 'incorporates improvements to the original AFC 2.0 contract based on feedback from customers, advocates, and policy makers', gives 'more time for both testing and installation of the new system and for customer migration with a more phased approach', and adds 'agreed-upon schedule milestones and incentives for milestone achievement.' Term: '10 years of operations and maintenance with options for 2 additional 5-year terms.' Also dates the one commuter-rail exception the card ever got: CharlieCard payment at all Zone 1A stations on the Fairmount Line from Monday 22 June 2020. The release gives no dollar figure, which is why the cost is carried from FHWA and the State Auditor instead.
src-48ca129fd7d2fb43Federal authority source for the money and the structure: 'The amended contract totals $935.4 million, including both the full capital cost of the system and a ten-year stream of operations and maintenance payments.' Delivery is a 'Design-Build-Finance-Operate-Maintain P3 procurement model; 13-year Availability Payment concession' by Boston AFC 2.0 OpCo LLC, funded through an availability payment drawn on dedicated sales tax and a dedicated local assessment. Financing: $27.00M equity (John Laing $24.3M, Cubic $2.7M) and a $437.42M senior security facility. Also the source for the correction to a common assumption about this programme: the project was 'subsequently expanded in scope in the first half of 2020' — it was stretched and enlarged, not cut back.
src-e0d0e8d9b3c78aabThe independent evaluation, covering 1 January 2018 to 30 September 2023. It puts the project at an estimated $960.2 million, 'which includes an approximately $935.4 million contract', and finds the agreement allowed deadlines to be overridden without sufficient controls, risking 'significant delays related to contract delivery' and 'overspending of public funds because of change orders, price escalation because of inflation.' The sharpest finding is the surety bond the MBTA did not obtain as state law required: without it 'the MBTA may not be able to recover money it paid for the $935.4 million contract in the event that the contract is not completed.' Two further findings — a $349,523 payroll variance between HR/CMS and FMIS, and incomplete cybersecurity awareness training — are recorded here but not carried in the entry.
src-6f0748ffbc5baf4cEstablished press for the 2024 resequencing and the arithmetic of the delay: 'The original $723 million contract called for most features to launch in 2020, but the MBTA amended its agreement in a 2020 reset that pushed the total cost to $967 million', with officials then expecting about $926 million. The board approved a change that 'pushes the complete rollout deadline from May 2024 to June 2026' and the 'longstop date' 'from August 2025 to June 2027.' Phasing as planned at that point: contactless on subway, bus and Green Line in summer 2024; new CharlieCard, app and vending machines in spring 2025; commuter rail and ferries in spring 2026; Mattapan validators later because of a power availability issue. The $967M press figure and the auditor's $960.2M project estimate are close but not identical; the entry uses the auditor's.
src-ffc80e4f7398f0b3Operator source for the date open-loop payment actually arrived: contactless debit and credit cards, phones and watches were accepted onboard buses, Green Line trolleys and Mattapan Line trolleys, and at all gated subway stations, from Thursday 1 August 2024 — four years after the mid-2020 date promised at award.
src-b50eb3e046c768e9The currency check, in the operator's own words in July 2026: 'Contactless payment is available on bus, subway, and ferry', while riders of the commuter rail 'should keep using your typical payment method.' Commuter rail — named in the 2017 award release as part of the promise — is still the mode that cannot tap. Also the source for what open loop does and does not carry: 'Existing transfer rules apply to travel between bus and/or subway with contactless payment.'
src-d131f969a129911fThe second currency check. In July 2026 the page lists the new Charlie Card and Charlie fare vending machines under 'Coming Soon', not as available — the components the May 2024 plan put in spring 2025. The MBTA's framing: 'We're introducing the system in phases so we can test new features.' The page describes signing up for a Charlie Account 'to manage the cards and devices you use to pay your fare' but does not state that the new system is account-based, which is why the entry does not claim it.
src-73f8858502496d8aOperator source for what the card costs and what it covers: 'You can get a free, blank CharlieCard at these locations', distributed through fare vending machines, city halls, libraries, Boys and Girls Clubs, retailers and the Charlie Service Center. Cards do expire — 'CharlieCard expiration dates are located on the lower right-hand corner, across from the serial number' — but there is no purchase fee and no forfeited deposit, unlike Manila's beep. Coverage: 'Not valid on Commuter Rail or ferry, except for the Fairmount Line.'
src-589819686b5e6cb3Establishes the absence that the comparison needs. In July 2026 the MBTA still sells a 1-Day Pass at $11.00, a 7-Day Pass at $22.50 and a monthly LinkPass at $90.00, and no fare-capping product appears anywhere in its fare material. Boston therefore sits with Chicago rather than with Los Angeles, which abolished passes for automatic caps in July 2023. Single fares as listed: subway $2.40, local bus $1.70, commuter rail $2.40-$13.25 by zone, ferry $2.40-$9.75 by route.
src-14103980fbb79b7dHow the 2008 case ended, from counsel to the students: 'EFF represented the students in this matter and effectively settled the case', linking a 22 December 2008 release recording that the parties 'agreed to work together to identify and help improve security in the MBTA's Automated Fare Collection System' following dismissal of the federal lawsuit. Flagged conflict: the Wikipedia article states no settlement or formal dismissal is documented and that the restraining order simply expired. The entry follows EFF, which was a party.
src-57d9b7b0af0c9399Tertiary, used for the procedural spine only. The MBTA sued Zack Anderson, Russell J. Ryan and Alessandro Chiesa on 8 August 2008, alleging under the Computer Fraud and Abuse Act that they 'transmitted programs to cause damage to (or attempted to transmit and damage) MBTA computers in an amount in excess of $5,000.' Judge Douglas P. Woodlock granted a temporary restraining order on 9 August barring the DEF CON 16 presentation; Judge George A. O'Toole Jr. declined to extend it on 19 August 2008. The order was also self-defeating: the slides had already gone to conference organisers and appeared on the court's own public docket.
src-f90a784b6876a9f4The load-bearing source for the claim that the underlying weakness survived the lawsuit. Matty Harris, Scott Campbell, Noah Gibson and Zack Bertocchi found the cards still 'store monetary value directly on the card itself rather than in a central database.' Harris on the state of it fifteen years on: 'it's kind of exactly the same way it was 15 years ago.' Campbell on the exploit, after cracking the checksum at the end of each data line: 'we were able to exploit that and actually edit the values... change the variable that contains the money so we can have a card with any amount of money we want up to like $300.' The institutional change is the other half of the story: the students went to MBTA chief information security officer Scott Margolis in January 2023, and the DEF CON talk went ahead with the agency's cooperation rather than a court order.
src-48fabdf97e1c6554Conference-archive listing confirming the talk, its title and its four speakers. The title is itself the comparison with 2008. Archive listing only, not a technical source; the vulnerability description in this entry comes from GBH.
src-f5e2a54e46827bccIndependent corroboration of the 2023 episode from the city's paper of record. Paywalled; headline, date and subject confirmed at search level, body not read. Carried only as a second outlet on a story whose facts come from GBH.
src-32d4e61754f32255Operator source for the entry's only rider-facing number, and the freshest source in the file. Enrolment reached 44,875 riders in FY26 (1 July 2025 to 30 June 2026), about 6% above the MBTA's own forecast, with roughly 95% of participants enrolling online. The programme launched on 4 September 2024 for riders aged 18-64 enrolled in an approved state assistance programme, with discounts of roughly 50% to 67% across bus, subway, commuter rail, ferry and The RIDE — a wider footprint than the CharlieCard itself has. Self-reported, so graded official, not independent.
src-a8197b5a55af9b5fTertiary, and used only where no operator page carries the fact: 'The card was introduced on December 4, 2006', and the original system runs on MIFARE Classic contactless chips. Also records that early cards expired three to five years after activation and later versions run ten years, which the MBTA's own page corroborates in principle by printing an expiry date on the card. The launch date should be replaced if an MBTA or MassDOT primary source is found.