The ID Two Step

Officials have stopped dancing around identity verification and have take steps to implement credentialing programs

• By Paul Brisgone
• Dec 01, 2006

AS federal and state governments look for ways to ensure workers' identity, identification cards have come to be a hot topic. In addition to protecting physical assets -- buildings, infrastructure and other facilities -- government officials also are interested in maintaining the integrity of their computer networks.

There are two identification cards that have garnered most of the publicity in recent months -- a personal identification verification card based on FIPS 201 and the transportation workers identification credential.

There are two identification cards that have garnered most of the publicity in recent months -- a personal identification verification card based on FIPS 201 and the transportation workers identification credential.

FIPS 201 cards will affect all federal employees, up to 5 million people and an additional 2 million federal contractors. The complexity and the sheer number of cards involved will make this one of the largest security projects ever undertaken by the federal government.

The effort is the result of HSPD-12. HSPD-12 requires all federal agencies to deploy an interoperable solution for access to federal buildings and IT networks. The directive mandates that agencies must now begin to issue FIPS 201-compliant credentials. The FIPS 201 standards were set by the National Institute for Standards and Technology to address the process, use and interoperability of the PIV cards. These standards represent a major change in how the federal government will manage access control for both physical and logical assets. A common system to verify the identity of individuals has become critically important as a means to enhance security, increase government efficiency and reduce identity fraud.

The Credentialing Process
The system that the government has put into action to enhance identity verification is a process fragmented into three parts -- finding a sponsor, then a registrar and, lastly, an issuer. This process is designed to make it more difficult for any one person to falsify information, alter a card or create a credential for an inappropriate person.

Before receiving a card, every federal employee or contractor must have a sponsor. Usually, this will be a supervisor who can confirm employment and provide information regarding the employee's need for physical and logical access to federal assets. This can include restrictions on days, times or specific sites.

Next in the process is the registrar. A registrar can be an individual or group within an agency or an outside vendor approved by the government to provide the required services. It is the job of the registrar to gather pertinent data about the registrants, including information from the sponsor and from the agency's human resources department. A digital picture of the applicant will be taken, and the registrar also will digitally collect a scan of the employee's 10 fingerprints. The fingerprints will be submitted to the federal Office of Personnel Management or to the FBI to conduct a criminal background check.

Once the background check is successfully completed, the issuer will complete the process. Again, the issuer can be an internal agency group or an outside vendor. The first step is to verify, via fingerprints, the identity of the intended card recipient. The issuer then will add a Java applet to a card, as well as a bar code and employee photo. At this point, the card is ready to print. The cards are layered with designs, hidden text, holograms and other information to discourage duplication or counterfeiting.

Once issued a PIV card, employees are required to swipe the card through a reader to access their office, and then swipe the card again, while placing a finger on a biometric reader to authenticate their identity and gain access to the agency computer system.

A Government-Wide Installment
As people leave government employment, human resources departments can immediately deactivate identity cards, rendering them useless. Also, as new employees are hired, human resources can notify a sponsor to begin the registration process.

A number of vendors, including systems integrators, plan to offer partial or end-to-end solutions for card registration on an agency or office-by-office basis. In order to qualify for the job, a vendor must submit its solution or products to NIST for testing and review. The General Services Administration has said it attempts to promote interagency cooperation. For example, two or more agencies sharing the same building will be encouraged to share the same registration solution to potentially save paperwork, time and money.

While plans for the new identification card have recently gained widespread attention in the media, a survey released in mid-June by a consulting firm for government procurement and contracting found nearly half of federal IT security executives did not have a plan in place to meet the deadline. One reason is the lack of funds in the federal budget earmarked to pay for this ambitious program.

However, HSPD-12 addresses a serious issue. Some agencies have already begun pilot programs to implement HSPD-12. And it is anticipated that most agencies used discretionary funds to begin pilot projects prior to the Oct. 27 deadline.

The nation's ports also are looking to enhance security procedures through the proposed TWIC card, which will be issued to each of the 750,000 truck drivers, longshoremen and railway employees who access docks and shipyards on a regular basis. In late 2002, Congress ordered the administration to develop a tamper-proof photo identification card for port and other transportation workers. All individuals with unescorted access to secure areas of port facilities would be required to carry this identification card. The first cards were expected to be issued in August 2004. According to Congressional investigators, however, bureaucratic delays and poor planning slowed development of the card.

The Right Direction
The first cards, costing workers $149 each and valid for five years, are just now being issued. Companies may agree to cover the cost to their workers and the cost of card readers. Installation and maintenance costs will be taken on by the companies and ports employing the credentialing products.

Before TWIC cards are issued, the government will conduct a background check of each worker that will include a review of criminal records, terrorist watch lists, immigration status and warrants. Shipyards and terminals will be expected to update their criminal lists from the FBI on a daily or weekly basis, depending upon the facility's rated threat level. In addition, much like PIV cards, employees will have their fingerprints digitally embedded into the TWIC.

Once a shipyard or port worker receives a card, he or she will walk or drive up to an access gate, swipe his or her card through a reader and place a finger on a biometric reader. The readers will verify that the fingerprint matches that embedded in the TWIC. A similar procedure will be required each time that a worker passes through a gate.

While FIPS 201 and TWIC may not yet be perfect, the two are a start in the right direction. Government-conducted background checks and biometrically-embedded smart cards will help ensure that the person seeking access to a port terminal, federal office building or network computer is the person he or she claims to be.