HSPD-12's final stretch

Federal agency working groups over the next six to 12 months will work on the final steps toward full implementation of Homeland Security Presidential Directive-12.And those last challenges, about 20 percent of the total job, will determine whether the smart identification cards will be more than expensive flash passes or if they will be what the administration envisioned when it issued the mandate in August 2004'interoperable cards used for physical and logical access.'The smallest issues are hardest to solve,' said Chris Niedermayer, chairman of the Office of Management and Budget's HSPD-12 Executive Steering Committee and the Agriculture Department's associate CIO. 'Those kinds of things are starting to become more visible. We have been working to create an environment where trust can be established and maintained.'While agencies were scrambling to meet the Oct. 27 deadline to begin issuing smart identification cards, OMB tabled many of these issues, but now the ESC and the Government Smart Card Interagency Advisory Board (IAB) will start addressing them, a government official said.Officials say OMB has been doing a good job bringing people together to begin looking at issues such as whether the National Agency Check with Inquiries (NACI) belongs on the HSPD-12 card; whether the cardholder user identifier (CHUID) is good enough to cover all federal employees, contractors, military service members, and possible state and local officials and first responders; and whether the government can agree on a fingerprint capture standard.Mike Butler, chairman of the IAB and chief of smart-card programs for the Defense Department's Access Card Program Office, said some of these issues will work themselves out over time, and the IAB and other private-sector organizations will address the others together.While momentum for HSPD-12 has waned since last fall, observers in and out of government disagree over whether agency energy behind the entire initiative still is measurable. Agencies have issued fewer than 1,000 cards since October, and the General Services Administration, through its Managed Service Office, has stopped issuing cards except in Washington, D.C.GSA plans to re-award its MSO contract this month, and officials believe that will help reinvigorate agencies to meet HSPD-12.'We will be moving forward with good momentum,' said Steve Kempf, GSA acting deputy assistant commissioner for integrated services in the Federal Acquisition Service. 'Once the procurement is completed, we will work with customers to determine the exact locations for the nationwide infrastructure and then move forward with credentialing.'An OMB spokeswoman said that many agencies are planning to ramp up with nationwide deployments between April and June.'Agencies are continuing to make progress on HSPD-12,' the spokeswoman said. 'In September 2006, agencies submitted updated HSPD-12 plans, and OMB is continuing to work with agencies to refine their plans.'Another drag on agency momentum is that agencies must complete background checks on all federal and contract employees with fewer than 15 years of experience by Oct. 27. This has been a daunting task for some, while others have been working on it since 2005.One agency CIO, who requested anonymity, said that agency has been updating background checks throughout the year and now has a manageable number to get done by the deadline.'The clearance issue varies by agency,' Niedermayer said. 'Agencies that operate in a more high-risk environment have been consistently updating these background checks and have little to catch up. Others have more catching up to do.'The background checks deadline is the last major milestone before the Oct. 27, 2008, date when agencies have to issue cards to about 1.8 million federal employees and an estimated 4 million to 5 million contractors.While background investigations are the short-term challenge, experts say OMB and the interagency groups will need more time to tackle the NACI indicator and CHUID issues.'The ESC is having a lot of dialogue about whether we should change what we put on the card, such as the NACI indicator,' Niedermayer said. 'We are debating, as with any kind of evolution, new questions. We are seeing opportunities where new and good questions come to the table. It is not unnatural or wrong; it is good thing.'Another federal official said part of the issue is whether an employee's clearance information should be read whenever the card is used.For the CHUID, the debate revolves around whether the specification is broad enough to cover all the possible users of HSPD-12, Butler said.While the assorted interagency groups attempt to address these issues, at least 40 agencies await GSA's decision on which vendor will run its shared-services office to set up and manage the enrollment centers, card issuance, and production and activation stations.The agencies using the shared-services provider include the Agriculture, Commerce, Energy, Housing and Urban Development, Justice and Labor departments, as well as the National Archives and Records Administration and the Office of Personnel Management.David Temoshok, GSA's director of identity policy and management in the Office of Governmentwide Policy, said 12 agencies, including DOD and the Homeland Security, State and Treasury departments, chose to go on their own and not use a shared-services provider.The OMB spokeswoman said agencies still are in the beginning stages of issuing HSPD-12 credentials, and as they deploy logical-access control systems to use with their cards, OMB expects security improvements.Under the new contract, GSA will require the vendor, among other things, to offer a biometric alternative to fingerprints, and to certify and accredit the entire identification management system, GSA's Kempf said.GSA originally awarded BearingPoint Inc. of McLean, Va., a $104 million contract in August to provide the services, but officials decided to cancel the deal in November to get a better, lower price.Kempf said one of the biggest challenges will be getting the CIOs, human resources managers and physical security folks to work together. Having a standard set of business processes and technologies will make physical and logical integration easier, he added.'We want to make sure we get the highest-priority enrollment stations opened first,' Kempf said. 'We want to get the maximum number of people credentialed as soon as possible.'