Defense, GSA and other agencies offer help with common ID cards

The Defense, Homeland Security, Interior and Veterans Affairs departments and NASA have one message to all other agencies that have not started planning or implementing smart-card programs: Stop whatever else you are doing now and begin preparing for the rollout of standard identification cards.Smart-card chiefs from these and other agencies pleaded with government officials at a recent smart-card conference to understand how much work must get done over the next two years to become compliant with Federal Information Processing Standard 201, which the Commerce Department made final late last month [, GCN.com/391].'Without an aggressive plan, agencies will not meet the standard,' said Bob Donelson, chairman of the Interagency Smart Card Advisory Board, which helped the National Institute of Standards and Technology create the specifications for governmentwide personal identity verification (PIV) cards.FIPS-201 was the chief topic this month at the fourth annual Smart Cards in eGovernment Conference in Washington. Many of the sessions focused on the new standard, and feds chatted extensively about it between sessions as well.The standard details a two-step plan for government use of interoperable smart cards. NIST also has released Special Publication 800-73, which outlines interface specifications for federal cards.Agencies have until June to submit a plan to the Office of Management and Budget describing how they will meet the FIPS-201 requirements. By Oct. 27, agencies must implement the first phase of FIPS-201. Called PIV I, the first phase includes setting up identity-proofing, registration and issuance processes.OMB then will determine the deadline for when all agencies' systems must be interoperable, which is the second phase, PIV II. Some in government have said this second deadline could be as early as October 2006. At minimum, federal officials said they ex- pect OMB will require that agencies begin implementing interoperable systems by October of next year.'Small agencies need to come to DOD, NASA or others for help in developing their transition to PIV,' suggested Bob Gilson, a management and program analyst with Defense's Common Access Card office. 'Without support from the more experienced agencies, meeting the dates will be a daunting task. This is an open invitation for these agencies to pick our brains.'The Interagency Smart Card Advisory Board also recommends that agencies that have not begun smart-card projects work with agencies that have programs.No matter when the final deadline falls, even the agencies with the most experience in using smart cards'from DOD to DHS and Interior'are starting work immediately to adapt their programs to meet the new specifications.'It is a fairly significant for us to go that far that fast,' said Gilson. Defense is exempt from FIPS-201, but it plans to voluntarily comply, making changes in the CAC program that supports 4 million cardholders.'Most agencies with programs comparable to DOD already have pieces in place that meet the Government Smart Card Interoperability Standards, and it is a huge leap to the new standards,' he said.Further complicating agencies' efforts, NIST, OMB and the General Services Administration still must publish a number of documents that will make implementing the new standard possible, Gilson said.'What we have now, you can't build from,' he said. 'We must get further down into the guts to understand how it all fits together. We will need at least 10 more documents.'Gilson added that DOD has created many documents that could be used as a baseline for the governmentwide publications.The Homeland Security Department and its Transportation Security Administration are close to meeting or have met PIV I, officials from DHS and TSA agencies said.OMB will issue guidance on FIPS-201 outlining what the Bush administration expects, said Judith Spencer, chairwoman of GSA's Federal ID Credentialing Committee.'It will explain to agencies what it means to be compliant by Oct. 27 and beyond,' Spencer said. 'It will also give a date when OMB expects agencies to begin to deploy PIV II-compliant cards.'GSA earlier this month issued a draft Identity Management Handbook to help agencies begin working on projects that comply with the new standards. Spencer said GSA will accept agency and industry comments on the 150-page guide through March 25.The final version of the handbook will include a FIPS-201 template, which will ask agencies to evaluate where they are in im- plementing the standard and what they will need to do to complete the first phase on time.'It is a road map for agencies,' Spencer said. 'It will be an online, fillable form that can be sent to OMB by e-mail.'Spencer suggested that NIST, OMB and the Interagency Smart Card Advisory Board might want to create a FIPS-201 implementation committee to help solve problems common at many agencies.But while the administration and the oversight agencies are coming up with the final documents and guide, Gilson said agencies should begin at least drafting smart-card plans.Even at DOD, which has full-fledged program, the smart-card team is setting short-term objectives, he said.The good news for Defense is that the data model for the new requirements matches up exactly to the current cards DOD and many other agencies use, he said.The bad news is DOD must make changes to its back-end validation systems, add fingerprint checking and move from contact to contactless cards. Contactless cards use wireless technology so that readers can capture their information without the cards being swiped through readers.Gilson said DOD is evaluating dual-chip and dual-interface contactless cards and plans to test them in two pilots this year. DOD also is installing contactless readers.