A Farewell to Unsecured Access

Coast Guard rapidly tightens security with access control system

• By Wayne Truax
• Jun 01, 2006

THE U.S. Coast Guard is a military, multi-mission, maritime service within the Department of Homeland Security and one of the nation's five armed services. Its core roles are to protect the public, the environment and U.S. economic and security interests in any maritime region, including international waters and America's coasts, ports and inland waterways. This places the Coast Guard headquarters on the front lines of national security.

Like all federal departments and agencies, the Coast Guard depends upon the private sector for providing many of the goods and services it needs to operate its facilities. Many commercial employees access the Washington, D.C., headquarters every day to perform tasks ranging from maintenance and package delivery to construction and project management. While important to operations, these workers present a potential risk to facility security.

Are they who they say they are? Do their companies have business on the facility? Do they have any disqualifying events in their backgrounds, such as felonies or warrants, that would disqualify them from receiving authorization for unescorted access to CGHQ?

This risk has serious implications for facility access control procedures. Security officers must check every person for an authorization to enter the headquarters. Yet stopping, questioning and searching every vendor or contractor employee each day impedes the efficiencies of both Coast Guard personnel and the many civilian workers who need access to the facility. To solve this, headquarters has instituted a number of new entry protocols for its vendors, contractors and service providers that increase the level of security without impacting its ability to efficiency complete daily tasks.

Inconsistent Screening is a Threat
By modernizing entry control and protocols, the Coast Guard knew that vendor screening was inconsistent and represented a potential security threat. Some vendors would provide background checks from online services that only did local checks or provided inaccurate national background check information. For example, several times, employees failed the sex offender check. Each time an employee challenged those results, it was discovered that the employee had been erroneously identified. It was at that point headquarters began questioning the accuracy of these services. If these services are identifying innocent people as criminals, they were probably failing to identify real criminals.

To address this security threat, the headquarters Support Command Security and Safety Division evaluated a number of programs for vendor access and background screening.

Eid Passport Inc. brought the RAPIDGate program to the attention of Coast Guard officials. The program had been in operation at Ft. Lewis, Wash., since 2004 and met the full requirements the Coast Guard was seeking.

Since the program was a complete access control solution, headquarters officials wanted to see it in operation and talk to the people who used it everyday. It was soon realized that this system was needed at headquarters to solve the contractor access control issues. A request for proposal was written and submitted for bids. Several companies replied to the request, but only RAPIDGate met the full requirements. One of the other advantages the system offered was full responsibility for all support services and equipment maintenance at Coast Guard headquarters.

Integrated Screening, Credentialing and Enforcement
Among the many factors taken into consideration was the ability to integrate products and services covering registration, background screening, credential manufacturing, credential issuance and access management. Each step provides an additional layer of security that gives the Coast Guard a higher confidence in the level of risk and worker quality without heavily taxing the Security and Safety Division staff, as had been the problem with past programs.

The first step in the process is enrollment of the vendor companies that regularly conduct business at CGHQ. RAPIDGate expedites enrollment via a toll-free number for assistance. Existing vendors and contractors who had valid unclassified Coast Guard security badges from previous checks were required to enroll in the program once the current security badge expires. Contractors who choose to not enroll in the program are not issued a badge and must be escorted, no exceptions.

The second step after the company has been approved as an authorized contractor is for the company to send its employees to register with the program using the RAPIDGate registration station. Registration, which has an English or Spanish option, captures the applicant's personal information, electronic fingerprints and a photo in less than 15 minutes. Upon completion of all required information, the data is sent automatically and securely to Eid Passport for processing.

The third step -- background screening -- makes a number of checks based on the applicant's information. First, it validates the applicant's Social Security number. This step, combined with identification shown in the issuance step, helps make sure each vendor company employee is a U.S. citizens or a foreign national legally eligible to work on the facility. The program also runs a 10-year felony background screen and other criminal screens, including terrorist and sexual offender watch lists. This helps prevent access privileges for known threats. If an employee does not pass any of the background screens, the program offers a confidential adjudication process for the employee to clear up errors in the background screening databases.

For applicants who pass the background screening, RAPIDGate badges are printed according to Coast Guard specifications and design. Eid Passport sends the completed badges to the security office for issuance. To pick up their badges and become badgeholders, qualified applicants present specific forms of identification to headquarters security officers. The list of acceptable ID is similar to the list of I-9 documents used for issuance of other government ID cards.

Badgeholders are then able to use their badges for rapid electronic authentication when accessing headquarters transpoint building. Headquarters already uses turnstiles with card readers to facilitate access for employees and authorized contractors to enter the three lobby entrances and surface-mounted readers at the loading dock entrance. To eliminate the problem of multiple access badges, headquarters worked with the project team to integrate a database with the access control system.

Strides Towards HSPD-12 Compliance
One of the reasons the Coast Guard chose RAPIDGate was its ability to help tighten security and begin the processes required to comply with Homeland Security Presidential Directive 12. HSPD-12, "Policy for a Common Identification Standard for Federal Employees and Contractors," specifies identification that:

• is issued based on sound criteria for verifying an individual employee's identity.

• is strongly resistant to identity fraud, tampering, counterfeiting and terrorist exploitation.

• can be rapidly authenticated electronically; and

• is issued only by providers whose reliability has been established by an official accreditation process.

The program process mirrors the credentialing process outlined in the Federal Information Processing Standard 201 for HSPD-12.

While efficiency is important, security is paramount. The program has become an important component of overall facility security. By making facilities safer and more secure, headquarters can deliver on its mission to protect the public, the environment and U.S. economic and security interests.