States will spur use of smart IDs

Steven Humphreys has been chief executive officer of smart-card software vendor ActivCard Corp. since 2001. Before joining the Fremont, Calif., company he headed smart-card manufacturer SCM Microsystems Inc., also of Fremont, and was president of Caere Corp. before its acquisition by ScanSoft Inc. of Peabody, Mass.He also worked as an executive in several business units of General Electric Co., including GE Information Systems.Humphreys remains on the boards of SCM Microsystems and two other companies and advises venture capital firms on digital information security.He has a bachelor's degree in mechanical engineering from Yale University and holds master's degrees in business administration and industrial engineering from Stanford University.GCN associate editor Patricia Daukantas interviewed Humphreys by telephone.HUMPHREYS: It manages digital identities. For the Defense Department, the Defense Manpower Data Center has set up several hundred stations around the world. A service member can walk up to any station and be issued a badge with his or her picture on it.Our software crosschecks with all DOD databases to make sure the right person is getting the right capability. We're active in more than a dozen agencies with smart-card pilots and deployments.HUMPHREYS: A smart card is basically a credit card with a little metal square on it. Underneath the metal square is a processor designed for security.When you slide that into the slot in your PC, your PC talks to the processor on the card to make sure you're the right person. Our software makes a pop-up window that asks for a personal identification number.A $10 card has about 64K of memory, and the processor runs at less than 1-MHz clock speed. Smart cards are riding the same Moore's Law curve that applied to PCs. You're getting more capability, more storage, higher security and faster processing simply by virtue of technology.HUMPHREYS: They're already used in Global System for Mobile Communications cell phones. They each have a little chip that you can slide out and into another cell phone so that all the stored phone numbers are in the new phone.People have a low tolerance for things going wrong with their cell phones; this is very reliable technology. Government also has low tolerance for any sort of failure rate in assuring identities.HUMPHREYS: The biggest challenge is deciding what and how you want to use the cards. There are so many types of security'passwords, public-key infrastructure, biometrics or even wilder stuff.Across agencies, we have pretty much every permutation of the technologies I just mentioned. Our software supports all those types of authentication, so you can later decide if you want to add different types.HUMPHREYS: Certainly, the bigger philosophical questions are raised by privacy. In fact, smart cards give you a much better privacy answer than most of the solutions out there right now.We use what we call a federated architecture. You control your own information. In government, you often have multiple agencies interacting about your identity. Take a transportation service that issues identity information at the state and local level. But say the federal transportation authorities also want to see a little bit about a person. They might not want to see everything, and the people at the local level might not want to expose everything.Our architecture lets you set up identity files so that the government knows that so-and-so has been issued an ID card, and he's a truck driver based in New York. The fact that he was born on a certain date, that he belongs to a union or whatever else might be important on a local level'that's securely kept by the local issuing organization.You're specifically aware of what information is being released to the issuing organization and then perhaps to the federal level. That, in my view at least, is better privacy than we have today, where a lot of stuff just gets released willy-nilly into databases floating around out there.We do need to release information about ourselves in order to function, but we want to control that information. That's the definition of a free society. Not that nobody's going to know anything about you'that's anarchy'but that you're going to be able to control who knows what.There are copying controls built in. One of the basic needs in creating a fake identity is to get access to some database with the information that goes into that identity. So, for example, when our software manages the issuance of a DOD identity card, it goes back to databases managed by the Defense Manpower Data Center. You would have to crack our security and DOD's security to get information, and you'd need to know what that information looks like to put it on a fake card.It's never been demonstrated that you can crack one of these smart-card computers and get data out of it. The process of trying to crack it open makes it shut down and lock up. Under certain circumstances, it even melts part of its own circuitry.HUMPHREYS: The software is agnostic; we can use either, but it's a great enabler of both. In fact, we have implementations using PKI, biometrics and both.PKI is just a set of data. It's much better to carry that data around on a little card than to have an encryption key sitting on a PC because in theory someone can always hack into the PC and steal the key.The same thing can happen with biometrics. Your fingerprint is unique. But when you store your print data somewhere, what's to stop someone from hacking your PC and stealing that file with the digital information? Then they can fake being you anywhere.HUMPHREYS: I believe it will happen one state at a time. There are some initiatives in Virginia, Utah and a couple of other states. But exactly when it happens and what form it will take, I don't know.Once a couple of states adopt it, it's going to be pretty compelling. In the next year and a half, you'll see some of the leading states adopt it, and then in five to seven years you'll see most of the others coming on.HUMPHREYS: I think we will, and the way it'll happen is a little bit de facto. The DOD program is going out to 4 million users. Transportation is talking about up to 7 million port workers, dock workers and truckers.If the DOD program goes out to veterans and dependents, that would be almost 18 million more people. The other 60 or so programs in the government right now would represent another 20 million users. You're talking about 50 million or 60 million users already in programs. If you add in the motor vehicle departments, you're talking about another 100 million users.The government will drive process and policy, and we will ultimately have fairly consistent identity files that do a lot of things for us. On the commercial side, I think it is going to be a bit of a battle between consumer convenience versus what the big companies want to issue.It'll make us think about who gets access to what information about us. Right now we are just letting our identity information loose, letting lots of potentially irresponsible people take control of it and hoping that it's all OK.Certainly, there are important civil liberties issues, but we're addressing them right now by ignorance. If we talked about how you properly release information about yourself to function in a free society, it'd be much better than just ignoring the situation.