PIV cards: the insider threat

Criminals have long known that one of the best ways to get fake identifications is to buy them from the people who issue the real things. In August 2005, several former Department of Motor Vehicles employees in Oakland, Calif., were implicated in a scheme to sell false identification cards to illegal aliens. So far, five former DMV workers and five outsiders have been charged with selling more than 200 fake IDs for $1,000 to $5,000 apiece. The investigation is ongoing.But the Oakland case is hardly an isolated incident. Last March, the New Jersey State Attorney General's office filed similar charges against two former Motor Vehicle Commission employees. Over the last two years, state employees in Arkansas, Maryland, Massachusetts, Nevada and elsewhere have been caught issuing fraudulent or unauthorized IDs.Homeland Security Presidential Directive 12 requires all federal agencies to have issued Personal Identity Verification cards following the guidelines outlined in Federal Information Processing Standard 201. But FIPS-201 is hardly a bulletproof solution against the insider threat.'There's currently a huge problem with [ID card] fraud,' said Robert Brandewie, former director of the Defense Manpower Data Center in Monterey, California. 'It's significant because today's technology allows you to create duplicate ID badges without a huge investment. It's possible to make a credible fake of any identity card if your only authentication of the card is a guard looking at it as someone walks by.'Following FIPS-201 will reduce the risk of insider fraud, said Neville Pattinson, director of technology and government for Gemalto, an Austin, Texas-based manufacturer of smart-card technology. For example, FIPS-201 requires the use of smart cards, which embed secure silicon chips with operating systems and encrypted data and 'are exponentially harder to fake,' he said.But contactless smart cards can be cloned cheaply and easily, said Dan Bailey, RFID Solutions Architect for RSA Laboratories in Boston. FIPS-201 requires contact or 'swipe' cards to be protected by an encrypted public/private key; agency employees have to provide a personal identification number or password to gain access to secure areas. But with contactless cards such protections are optional, in part because doing encryption wirelessly is expensive and time-consuming. And since contactless cards put out a radio signal that can be read from a distance, an identity thief could eavesdrop on an employee's card without ever being detected.Bailey recommends agencies using contactless cards implement a challenge-response mechanism'for example, a reader that sends a unique number to the card, which then performs a quick crypto operation on the number and sends it back. Since each number can only be used once, it would be useless to steal it, Bailey said.FIPS-201 also requires organizations to designate different individuals to perform the key steps in issuing identification, so a single person inside an agency can't create a valid ID. While not eliminating the prospect of insider fraud, it would make such schemes harder to pull off.'You can say it requires two people to approve any transaction, but if you've got two people colluding that's really difficult to control without the proper systems in place,' said Jason Hart, CEO of ActivIdentity, a Fremont, Calif.-based maker of identity assurance software.'There will always be a certain element of uncertainty that could lead to fraud. But if you've got a secure identity management solution in place, you have more accountability.'Another way to combat identity card fraud is to lock down the printers at the network level, so that 'extra' ID cards cannot be made during off hours or by unauthorized personnel, said Gary Klinefelter, vice president of technology at Fargo Electronics in Eden Prairie, Minn.Fargo makes networked identity card printers used by a variety of state and federal agencies, as well as printer management software that requires authorized users log in before accessing a printer on the network. Such software can send out alerts when printers are used at off hours or there are inexplicable spikes in printer activity'both indications that employees may be up to no good.Klinefelter advises agencies to keep a close watch on consumables, so employees can't take a batch of blank ID cards and have them printed elsewhere. Using RFID chips, consumables can be matched to a particular printer so they can't be used anywhere else.'When you have consumables that won't work for anybody but you, it's much harder for 'creative' employees to take advantage of a situation,' Klinefelter said. 'Even if they steal the consumables, they won't be able to use them.'But any truly secure identification solution must involve much more than just a card, said Brandewie, now senior VP for ActivIdentity's public-sector solutions group. Right now, DOD has some 3.4 million common access cards in circulation, which provide both access to secure areas and to networks. But they're only one part of a much broader identity management system involving multiple-factor authentication and biometrics such as digital fingerprints, he says.'The key to defense against fraud are digital authentication and multiple factors,' he said. 'It's not enough to just have a card; you need a PIN, or a picture or a biometric.'Along with that system, agencies must undergo a shift in how they think about identity and security, Brandewie said. 'We need to get people away from thinking that looking at a card is good enough for physical access, or that a user name and password are good enough for logical access.'