Electronic Government
Smart Card Usage is Advancing Among Federal Agencies, Including the Department of Veterans Affairs Gao ID: GAO-05-84T October 6, 2004The federal government is interested in the use of smart cards--credit card-like devices that use integrated circuit chips to store and process data--for improving the security of its many physical and information assets. Besides providing better authentication of the identities of people accessing buildings and computer systems, smart cards offer a number of other potential benefits and uses, such as creating electronic passenger lists for deploying military personnel and tracking immunization and other medical records. Over the past 2 years, GAO has studied and reported on the uses of smart cards across the federal government. Congress requested that GAO testify on federal agencies' efforts in adopting smart card technology--based on the results of this prior work--and on the specific actions that the Department of Veterans Affairs is taking to implement smart card technology.
As the unique properties and capabilities of smart cards have become more apparent, federal agencies, including the Office of Management and Budget, the National Institute of Standards and Technology, and the General Services Administration, have acted to advance the governmentwide adoption of smart card technology. In turn, numerous smart card projects that offer a variety of uses and benefits have been launched. As of June 2004, 15 federal agencies reported 34 ongoing smart card projects. Further, agencies' actions toward the adoption of smart cards continue to evolve as understanding of the technology grows. Agencies are moving away from the small-scale, limited-duration demonstration projects of past years (involving as few as 100 cardholders and aiming mostly to show the value of using smart cards for identification) to larger, more integrated, agencywide initiatives involving many thousands (or even millions) of users and that are focused on physical access to facilities and logical (information systems) access to computer systems and networks. In pursuing smart card projects, federal agencies have had to contend with numerous management and technical challenges. However, these challenges may be less imposing in the future because of increased management concerns about securing federal facilities and because technical advances have improved the capabilities and cost effectiveness of smart card systems. The Department of Veterans Affairs (VA) is one of 9 federal agencies currently pursuing large-scale, agencywide smart card initiatives. VA's project, currently in limited deployment, involves using, among other technologies, the One-VA Identification smart card to provide an agencywide capability to authenticate users with certainty and grant them access to information systems essential to accomplishing the agency's business functions. VA estimates that this project will cost about $162 million between 2004 and 2009, and enable it to issue 500,000 smart cards to its employees and contractors.
GAO-05-84T, Electronic Government: Smart Card Usage is Advancing Among Federal Agencies, Including the Department of Veterans Affairs
This is the accessible text file for GAO report number GAO-05-84T
entitled 'Electronic Government: Smart Card Usage is Advancing Among
Federal Agencies, Including the Department of Veterans Affairs' which
was released on October 06, 2004.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
United States Government Accountability Office:
GAO:
Testimony before the Subcommittee on Oversight and Investigations,
Committee on Veterans' Affairs, House of Representatives:
For release on delivery
expected at 9:30 a.m. EDT Wednesday, October 6, 2004:
ELECTRONIC GOVERNMENT:
Smart Card Usage is Advancing Among Federal Agencies, Including the
Department of Veterans Affairs:
Statement of Linda D. Koontz:
Director, Information Management Issues:
GAO-05-84T:
GAO Highlights:
Highlights of GAO-05-84T, a testimony to the Subcommittee on Oversight
and Investigations, House Committee on Veterans' Affairs
Why GAO Did This Study:
The federal government is interested in the use of smart cards”credit
card-like devices that use integrated circuit chips to store and
process data”for improving the security of its many physical and
information assets. Besides providing better authentication of the
identities of people accessing buildings and computer systems, smart
cards offer a number of other potential benefits and uses, such as
creating electronic passenger lists for deploying military personnel
and tracking immunization and other medical records.
Over the past 2 years, GAO has studied and reported on the uses of
smart cards across the federal government. The Subcommittee requested
that GAO testify on federal agencies‘ efforts in adopting smart card
technology”based on the results of this prior work”and on the specific
actions that the Department of Veterans Affairs is taking to implement
smart card technology.
What GAO Found:
As the unique properties and capabilities of smart cards have become
more apparent, federal agencies, including the Office of Management
and Budget, the National Institute of Standards and Technology, and
the General Services Administration, have acted to advance the
governmentwide adoption of smart card technology. In turn, numerous
smart card projects that offer a variety of uses and benefits have been
launched. As of June 2004, 15 federal agencies reported 34 ongoing
smart card projects. Further, agencies‘ actions toward the adoption of
smart cards continue to evolve as understanding of the technology
grows. Agencies are moving away from the small-scale, limited-duration
demonstration projects of past years (involving as few as 100
cardholders and aiming mostly to show the value of using smart cards
for identification) to larger, more integrated, agencywide initiatives
involving many thousands (or even millions) of users and that are
focused on physical access to facilities and logical (information
systems) access to computer systems and networks.
In pursuing smart card projects, federal agencies have had to contend
with numerous management and technical challenges. However, these
challenges may be less imposing in the future because of increased
management concerns about securing federal facilities and because
technical advances have improved the capabilities and cost
effectiveness of smart card systems.
The Department of Veterans Affairs (VA) is one of 9 federal agencies
currently pursuing large-scale, agencywide smart card initiatives.
VA‘s project, currently in limited deployment, involves using, among
other technologies, the One-VA Identification smart card to provide an
agencywide capability to authenticate users with certainty and grant
them access to information systems essential to accomplishing the
agency‘s business functions. VA estimates that this project will cost
about $162 million between 2004 and 2009, and enable it to issue
500,000 smart cards to its employees and contractors.
A Typical Smart Card (not to scale)
[See PDF for image]
Source: GSA
[End of figure]
www.gao.gov/cgi-bin/getrpt?GAO-05-84T.
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Linda D. Koontz at (202)
512-6240 or koontzl@gao.gov.
[End of section]
Mr. Chairman and Members of the Subcommittee:
Thank you for this opportunity to participate in the Subcommittee's
hearing regarding the adoption and use of smart card technology. Smart
cards are plastic devices--about the size of a credit card--that
generally use integrated circuit chips to store and process data, much
like a computer. This processing capability distinguishes these cards
from traditional magnetic stripe cards, which cannot process
information interactively with automated information systems.
Our prior work has found that smart cards offer a variety of benefits
to the federal government, such as better authentication of
cardholders' identities, increased security over buildings, more
effective safeguards of computer systems and data, and more accurate
and efficient financial and nonfinancial transactions.[Footnote 1] The
General Services Administration (GSA) has promoted the adoption of
smart card technology across government based on a goal of equipping
all federal employees with a standardized smart card for a wide range
of services. Nonetheless, the successful adoption of smart cards
throughout the federal government has been a challenging task, and
federal agencies' adoption of this technology continues to evolve.
At your request, my remarks today will summarize the federal
government's efforts toward adopting smart card technology and the
challenges that have been encountered. Also included in my discussion
is an overview of the actions that the Department of Veterans Affairs
(VA) is taking to implement smart cards. In addressing these objectives
and developing this testimony, we relied primarily on previously
reported information describing federal agencies' accomplishments and
planned activities to promote smart cards and the challenges to smart
card adoption identified across the federal government. We also
assessed available documentation and interviewed VA officials regarding
their specific actions to implement smart cards; however, we did not
verify the information that VA provided in support of its initiatives.
We performed our work in accordance with generally accepted government
auditing standards during September and October 2004.
Results In Brief:
The unique properties and capabilities of smart cards--plastic devices
that use integrated circuit chips to store and process data--offer the
potential to significantly improve the security of federal buildings,
systems, data, and transactions. With the potential uses and associated
benefits in mind, federal agencies, including the Office of Management
and Budget (OMB), the National Institute of Standards and Technology
(NIST), and GSA have taken actions to advance the adoption of smart
card technology governmentwide. In turn, numerous projects have been
launched that offer many capabilities and tangible and intangible
benefits. As of June 2004, 15 federal agencies had reported 34 ongoing
smart card projects. Further, as understanding of smart card technology
has increased, agencies have begun pursuing larger, integrated
agencywide smart card systems aimed at better securing both physical
access to facilities and logical access to computer systems and
networks. Nonetheless, agency managers have faced considerable
management and technical challenges in their efforts. These challenges
have become less formidable, however, as management concerns about
securing federal facilities and information systems have increased and
as technical advances have improved the capabilities and reduced the
cost of smart card systems.
The Department of Veterans Affairs is among a number of federal
agencies currently pursuing large-scale, agencywide smart card
initiatives. VA's Authentication and Authorization Infrastructure
Project, begun in December 2002 and currently in a limited deployment
phase, is planned to employ a combination of smart card and other
technologies to achieve the capability to authenticate users with
certainty and grant them access to information systems necessary to
perform business functions. VA estimates that this project will cost
about $162 million between 2004 and 2009, and enable it to issue
500,000 smart cards to its employees and contractors.
Background:
As you are aware, technology plays an important role in helping the
federal government ensure the security of its many physical and
information assets. Today, federal employees are issued a wide variety
of identification (ID) cards that are used to access federal buildings
and facilities, sometimes solely on the basis of visual inspection by
security personnel. These cards often cannot be used for other
important identification purposes--such as gaining access to an
agency's computer systems--and many can be easily forged or stolen and
altered to permit access by unauthorized individuals. In general, the
ease with which traditional ID cards--including credit cards--can be
forged has contributed to an increase in identity theft and related
security and financial problems for both individuals and
organizations.[Footnote 2]
The unique advantage of smart cards--as opposed to cards with simpler
technology, such as magnetic stripes or bar codes--is that smart cards
can exchange data with other systems and process information rather
than simply serving as static data repositories. Smart cards can
readily be tailored to meet the varying needs of federal agencies or to
accommodate previously installed systems. For example, other media,
such as magnetic stripes, bar codes, and optical memory (laser-
readable) stripes can be added to smart cards to support interactions
with existing systems and services or to provide additional storage
capacity. An agency that has been using magnetic stripe cards for
access to certain facilities could migrate to smart cards that would
work with both its existing magnetic stripe readers as well as new
smart card readers. Of course, the functions provided by the card's
magnetic stripe, which cannot process transactions, would be much more
limited than those supported by the card's integrated circuit chip.
Optical memory stripes (which are similar to the technology used in
commercial compact discs) can be used to equip a card with a large
memory capacity for storing more extensive data--such as color photos,
multiple fingerprint images, or other digitized images--and for making
that card and its stored data very difficult to counterfeit.[Footnote
3] A typical example of a smart card is shown in figure 1.
Figure 1: A Typical Smart Card:
[See PDF for image]
[End of figure]
Smart cards can be used to significantly enhance the security of an
organization's computer systems by tightening controls over user
access. A user wishing to log on to a computer system or network with
controlled access must "prove" his or her identity to the system--a
process called authentication. Many systems authenticate users by
requiring them to enter secret passwords, which provide only modest
security because the passwords can be easily compromised. Substantially
better user authentication can be achieved by supplementing passwords
with smart cards.[Footnote 4]
Even stronger authentication can be achieved when smart cards are used
in conjunction with biometrics.[Footnote 5] Smart cards are one type of
media that can be configured to store biometric information--such as
fingerprints or iris scans--in electronic records that can be retrieved
and compared with an individual's live biometric scan to verify that
person's identity in a way that is difficult to circumvent. A system
requiring users to present a smart card, enter a password, and verify a
biometric scan provides what security experts call "three-factor"
authentication, with the three factors being (1) something you possess
(the smart card), (2) something you know (the password), and (3)
something you are (the biometric). Systems with three-factor
authentication are considered to provide a relatively high level of
security.
Additionally, smart cards can be used in conjunction with public key
infrastructure (PKI) technology to better secure electronic messages
and transactions. A PKI is a system of hardware, software, policies,
and people that, when fully and properly implemented, can provide a
suite of information security assurances that are important in
protecting sensitive communications and transactions.[Footnote 6] A
properly implemented and maintained PKI can offer several important
security services, including assurance that (1) the parties to an
electronic transaction are really who they claim to be, (2) the
information has not been altered or shared with any unauthorized
entity, and (3) the parties will not be able to deny taking part in the
transaction. Security experts generally agree that PKI technology is
most effective when deployed in conjunction with smart cards.
Smart cards are grouped into two major classes: contact cards and
"contactless" cards. Contact cards have gold-plated contacts that
connect directly with the read/write heads of a smart card reader when
the card is inserted into the device. Contactless cards contain an
embedded antenna and work when the card is waved within the magnetic
field of a card reader or terminal. Contactless cards are better suited
for environments where quick interaction between the card and reader is
required, such as high-volume physical access. For example, the
Washington Metropolitan Area Transit Authority has deployed an
automated fare collection system using contactless smart cards as a way
of speeding patrons' access to the Washington, D.C. subway system.
Smart cards can be configured to include both contact and contactless
capabilities; however, two separate interfaces are needed because
standards for the technologies are very different.
Federal Agencies' Pursuit of Smart Card Technology Is Evolving and
Involves Challenges:
Since the 1990s, the federal government has considered the use of smart
card technology as one option for electronically improving security
over buildings and computer systems. In 1996, OMB tasked GSA with
taking the lead in facilitating a coordinated interagency management
approach for the adoption of multi-application smart cards across
government. In this regard, GSA has taken important steps to promote
federal smart card use. For example, since 1998, it has worked with
several other federal agencies to promote broad adoption of smart cards
for authentication throughout the federal government. Specifically, GSA
worked with the Department of the Navy to establish a technology
demonstration center to showcase smart card technology and applications
and it established a smart card project managers' group and Government
Smart Card Interagency Advisory Board.[Footnote 7]
For many federal agencies, GSA's chief contribution toward promoting
smart card adoption was its effort in 2000 to develop a standard
contracting vehicle for use by federal agencies in procuring commercial
smart card products from vendors. Under the terms of the Smart Access
Common ID Card contract, GSA, NIST, and the contract's awardees worked
together to develop smart card interoperability guidelines--including
an architectural model, interface definitions, and standard data
elements--that were intended to guarantee that all the products made
available through the contract would be capable of working together.
Further, OMB has begun taking action to develop a framework of policy
guidance for governmentwide smart card adoption. Specifically, on July
3, 2003, OMB's Administrator for E-Government and Information
Technology issued a memorandum detailing specific actions the
administration was taking to streamline authentication and identity
management in the federal government.[Footnote 8] This included
establishing the Federal Identity and Credentialing Committee to
collect agency input on policy and requirements and coordinate the
development of a comprehensive policy for credentialing federal
employees.
Since 1998, multiple smart card projects have been launched in the
federal government addressing an array of capabilities and providing
many tangible and intangible benefits, including enhancing security
over buildings and other facilities, safeguarding computer systems and
data, and conducting financial and nonfinancial transactions more
accurately and efficiently. As of June 2004, 15 federal agencies
reported 34 ongoing smart card projects.
Initially, many of the smart card initiatives that were undertaken were
small-scale demonstration projects that involved as few as 100
cardholders and intended to show the value of using smart cards for
identification or to store cash value or other personal information.
However, federal efforts toward the adoption of smart cards have
continued to evolve as agencies have gained an increased understanding
of the technology and its potential uses and benefits. Our most recent
study of federal agencies' investments in smart card technology, which
we reported on last month,[Footnote 9] noted that agencies are
increasingly moving away from many of their earlier efforts--which
frequently involved small-scale, limited-duration pilot projects--
toward much larger, integrated, agencywide initiatives aimed at
providing smart cards as identity credentials that agency employees can
use to gain both physical access to facilities, such as buildings, and
logical access to computer systems and networks.[Footnote 10] In some
cases, additional functions, such as asset management and stored value,
are also being included.
To date, the largest smart card program to be implemented in the
federal government is the Common Access Card program of the Department
of Defense (DOD), which is intended to be used for identification by
about 3.5 million military and civilian personnel. Results from this
project have indicated that smart cards can offer many useful benefits,
such as significantly reducing the processing time required for
deploying military personnel, tracking immunization records of
dependent children, and verifying the identity of individuals accessing
buildings and computer systems.
Another large agencywide initiative is the Department of Homeland
Security's (DHS) Identification and Credentialing project, an effort in
which the agency plans to issue 250,000 cards to employees and
contractors using PKI technology for logical access and proximity chips
for physical access. Authentication is to rely on biometrics with a
personal identification number as a backup. Further, GSA's Nationwide
Identification is a recently initiated agencywide smart card project in
which the agency plans to issue a single standard credential card for
identification, building access, property management, and other
applications to 61,000 federal employees, contractors, and tenant
agencies.
While smart card technology offers benefits, launching smart card
projects--whether large or small--has proved challenging to federal
agencies and efforts to sustain successful adoption of the technology
across government. Our prior work noted a number of management and
technical challenges that agency managers have faced. These challenges
include:
* Sustaining executive-level commitment. Maintaining executive-level
commitment is essential to implementing smart card technology
effectively. Without this support and clear direction, large-scale
smart card initiatives may encounter organizational resistance and cost
concerns that lead to delays and cancellations. DOD officials stated
that having a formal mandate from the Deputy Secretary of Defense to
implement a uniform, common access identification card across the
department was essential to getting a project as large as the Common
Access Card initiative launched and funded.[Footnote 11]
* Recognizing resource requirements. Smart card implementation costs
can be high, particularly if significant infrastructure modifications
are required, or other technologies, such as biometrics and PKI, are
being implemented in tandem with the cards. Key implementation
activities that can be costly include managing contractors and card
suppliers, developing systems and interfaces with existing personnel or
credentialing systems, installing equipment and systems to distribute
the cards, and training personnel to issue and use smart cards. As a
result, agency officials have found that obtaining adequate resources
is critical to implementing a major government smart card system.
* Integrating physical and logical security practices across
organizations. The ability of smart card systems to address both
physical and logical (information systems) security means that
unprecedented levels of cooperation may be required among internal
organizations that often had not previously collaborated, particularly
physical security organizations and information technology
organizations. In addition to the gap between physical and logical
security organizations, the sheer number of separate and incompatible
existing systems also adds to the challenge of establishing an
integrated agencywide smart card system.
* Achieving interoperability among smart card systems. Interoperability
is a key consideration in smart card deployment.[Footnote 12] The value
of a smart card is greatly enhanced if it can be used with multiple
systems at different agencies, and GSA has reported that virtually all
agencies agree that interoperability at some level is critical to
widespread adoption of smart cards across the government. However,
achieving interoperability has been difficult because smart card
products and systems developed in the past have generally been
incompatible in all but very rudimentary ways. With varying products
available from many vendors, there has been no obvious choice for an
interoperability standard. GSA considered the achievement of
interoperability across card systems to be one of its main priorities
in developing its Smart Access Common ID Card contract that I discussed
earlier.
* Maintaining security of smart card systems and privacy of personal
information. Although concerns about security are a key driver for the
adoption of smart card technology in the federal government, the
security of smart card systems themselves is not foolproof and must be
addressed when agencies plan the implementation of a smart card system.
Although smart card systems are generally much more difficult to attack
than traditional ID cards and password-protected systems, they are not
invulnerable. In order to obtain the improved security services that
smart cards offer, care must be taken to ensure that the cards and
their supporting systems do not pose unacceptable security risks. In
addition, protecting the privacy of personal information is a growing
concern and must be addressed with regard to the personal information
contained on the smart cards. Once in place, smart card-based systems
designed simply to control access to facilities and systems could also
be used to track the day-to-day activities of individuals, thus
potentially compromising the individual's privacy. Further, smart card-
based systems could be used to aggregate sensitive information about
individuals for purposes other than those prompting the initial
collection of the information, which could compromise privacy. The
Privacy Act of 1974[Footnote 13] requires the federal government to
restrict the disclosure of personally identifiable records maintained
by federal agencies while permitting individuals access to their own
records and the right to seek amendment of agency records that are
inaccurate, irrelevant, untimely, or incomplete. Further, the E-
Government Act of 2002[Footnote 14] requires agencies to conduct
privacy impact assessments before developing or procuring information
technology that collects, maintains, or disseminates personally
identifiable information. Accordingly, agency officials need to assess
and plan for appropriate privacy measures when implementing smart card-
based systems and ensure that privacy impact assessments are conducted
when required.
In considering these challenges, it is important to note that, while
they served to slow the adoption of smart card technology in past
years, they may be less difficult in the future because of increased
management concerns about securing federal facilities and information
systems and because technical advances have improved the capabilities
and reduced the cost of smart card systems. Nonetheless, sustained
diligence in responding to such challenges is essential in light of the
growing emphasis on the use of smart card technology.
Recognizing the critical role that GSA, OMB, and NIST play in
furthering the successful adoption of smart card technology, we made
recommendations in January 2003 to these agencies that were aimed at
advancing the adoption of smart card technology governmentwide.
Specifically, we recommended that:
* the Director, OMB, issue governmentwide policy guidance regarding
adoption of smart cards for secure access to physical and logical
assets;
* the Director, NIST, continue to improve and update the government
smart card interoperability specification by addressing governmentwide
standards for additional technologies--such as contactless cards,
biometrics, and optical stripe media--as well as integration with PKI;
and:
* the Administrator, GSA, improve the effectiveness of GSA's promotion
of smart card technologies within the federal government by (1)
developing an internal implementation strategy with specific goals and
milestones to ensure that GSA's internal organizations support and
implement smart card systems consistently; (2) updating its
governmentwide implementation strategy and administrative guidance on
implementing smart card systems to address current security priorities;
(3) establishing guidelines for federal building security that address
the role of smart card technology; and (4) developing a process for
conducting ongoing evaluations of the implementation of smart card-
based systems by federal agencies to ensure that lessons learned and
best practices are shared across government.
As of last month, all three agencies had taken actions to address the
recommendations made to them. Specifically, in response to our
recommendations, OMB issued its July 3, 2003, memorandum to major
departments and agencies directing them to coordinate and consolidate
investments related to authentication and identity management,
including the implementation of smart card technology.[Footnote 15]
NIST responded by improving and updating the government smart card
interoperability specification to address additional technologies,
including contactless cards and biometrics.[Footnote 16] GSA responded
to our recommendations by updating its "Smart Card Policy and
Administrative Guidance" to better address security priorities,
including minimum-security standards for federal facilities, computer
systems, and data across the government.
However, three of our four recommendations to GSA remained outstanding.
GSA officials stated that they were working to address the
recommendations to develop an internal GSA smart card implementation
strategy, develop a process for conducting evaluations of smart card
implementations, and share lessons learned and best practices across
government. The responsibility for one recommendation--establishing
guidelines for federal building security that address the role of smart
card technology--was transferred to DHS.
Recent federal direction contained in Homeland Security Presidential
Directive 12[Footnote 17] could further facilitate smart card adoption
across the federal government. This directive, signed in late August,
seeks to establish a common identification standard for federal
employees and contractors to protect against a litany of threats,
including terrorism and identity theft. The directive instructs the
Departments of Commerce, State, Defense, Justice, and Homeland Security
to work with OMB and the Office of Science and Technology Policy to
institute the new standards and policies. With federal agencies'
increasing pursuit of smart cards, directives from central management
such as this one could be an important vehicle for ensuring that more
comprehensive guidance is available to support and sustain the broader
implementation of agencywide smart card initiatives.
VA Is Pursuing Agencywide Use of Smart Cards:
Mr. Chairman, beyond the governmentwide assessment presented, you
requested that we specifically address actions of the Department of
Veterans Affairs in adopting smart card technology. Our report last
month discussing agencies' investments in smart card technology
identified VA as being among 9 federal agencies that currently have
large-scale, agencywide smart card projects underway.[Footnote 18]
VA's effort--the Authentication and Authorization Infrastructure
Project (AAIP)--was begun in December 2002 as an attempt to provide
agencywide capability to authenticate users with certainty and grant
them access to information systems necessary to perform business
functions. The initiative, currently in a limited deployment phase,
involves three core components: (1) a One-VA ID smart card; (2) an
enterprise PKI solution;[Footnote 19] and (3) an identity and access
management infrastructure that addresses internal and external access
requirements for VA users. VA currently estimates that, between fiscal
years 2004 and 2009, this initiative will cost about $162 million.
The project is currently focusing on development of the One-VA ID card,
which is to employ a combination of smart card and PKI technologies to
store a user's credentials digitally.[Footnote 20] According to project
documentation, the One-VA ID card is intended to replace the several
hundred methods for issuing identification cards that are currently in
place across the department,[Footnote 21] and improve physical and
information security by strengthening the ability to authenticate users
and grant access to information systems that employees and contractors
rely on to perform VA's business functions.[Footnote 22] As an official
source of government identification credentialing, the card is expected
to be compliant with Homeland Security Presidential Directive 12.
VA is using a phased approach to develop and implement the One-VA ID
card. This approach involves prototype testing followed by limited
production testing at the department's facilities in the United States,
and by 2006, the issuance of 500,000 cards with PKI credentials to its
personnel. VA reported that it has already begun an initial limited
deployment of the cards to about 15,000 to 25,000 users. The AAIP
project manager anticipated that the results from this limited
deployment would provide lessons learned for ensuring successful
implementation, support, and training once full deployment of the One-
VA ID card begins in early 2005. Further, the department has indicated
that it plans to use information gathered from the limited deployment
to create agency-wide policies and procedures for the full deployment
of smart cards across all VA business units. As of late September, VA
reported that fiscal year 2004 spending on the One-VA ID card totaled
approximately $27 million for activities such as the acquisition of
smart cards, card readers, and hardware support.
We have not yet had an opportunity to fully assess the outcomes of the
department's One-VA ID card initiative or its actions to develop the
enterprise PKI solution and identity and access management
infrastructure that are also key components of this initiative.
However, VA officials believe that the department is sufficiently
positioned to successfully implement the smart card technology on an
agencywide level. The AAIP project manager noted the chief information
officer's involvement, as chair of the department's Enterprise
Information Board, in monitoring progress of the project.
Further, as a participant in a number of governmentwide initiatives
supporting the adoption of smart card technology, VA should be
effectively positioned to carry out such an undertaking. Among its
collaborations, VA is one of five agencies[Footnote 23] using GSA's
Smart Card Access Common ID contracting vehicle and plans to purchase
smart cards for AAIP through the GSA contract. It is also a member of
the Federal Identity Credentialing Committee, which provides guidance
to federal agencies on the use of smart card technology that supports
interoperable identity and authentication to enable an individual's
identity to be verified within an agency and across the federal
enterprise for both physical and logical networks. Collectively, the
department's experiences and collaborations should lend strength to its
own and overall federal efforts toward making smart cards a key means
of securing critical information and assets.
In summary, the federal government is continuing to make progress in
promoting and implementing smart card technology, which offers clear
benefits for enhancing security over access to buildings and other
facilities, as well as computer systems and networks. The adoption of
such technology is continuing to evolve, with a number of large-scale,
agencywide projects having been undertaken by federal agencies over the
past several years. As agencies have sought greater use of smart cards,
they have had to contend with a number of significant management and
technical challenges, including sustaining executive-level commitment,
recognizing resource requirements, integrating physical and logical
security practices, achieving interoperability, and maintaining system
security and privacy of personal information. These challenges become
less difficult to address, however, as managers place greater emphasis
on enhancing the security of federal facilities and information systems
and technical advances improve the capabilities and reduce the costs of
smart card systems. The challenges are also tempered as increased
federal guidance brings direction to agencies' handlings of their smart
card initiatives.
VA is among a number of agencies currently undertaking large-scale,
agencywide projects to implement smart cards. While its project is
still under development, VA has gained experience as a participant on
governmentwide initiatives to further smart card adoption that should
facilitate the increasing movement toward the use of smart cards as an
essential means of securing critical information and assets.
Mr. Chairman, this concludes my statement. I would be pleased to
respond to any questions that you or other members of the subcommittee
may have.
Contacts and Acknowledgements:
If you should have any questions about this testimony, please contact
me at (202) 512-6240 or via e-mail at koontzl@gao.gov. Other major
contributors to this testimony included Michael A. Alexander, John de
Ferrari, Nancy Glover, Steven Law, Valerie C. Melvin, J. Michael
Resser, and Eric L. Trout.
FOOTNOTES
[1] GAO, Electronic Government: Progress in Promoting Adoption of Smart
Card Technology, GAO-03-144 (Washington, D.C.: Jan. 3, 2003);
Electronic Government: Challenges to the Adoption of Smart Card
Technology, GAO-03-1108T (Washington, D.C.: Sept. 9, 2003); and
Electronic Government: Federal Agencies Continue to Invest in Smart
Card Technology, GAO-04-948 (Washington, D.C.: Sept. 8, 2004).
[2] See GAO, Identity Theft: Available Data Indicate Growth in
Prevalence and Cost, GAO-02-424T (Washington, D.C.: Feb. 14, 2002).
[3] Cards with an optical memory stripe are known as laser cards or
optical memory cards. For more information, see GAO, Technology
Assessment: Using Biometrics for Border Security, GAO-03-174,
(Washington, D.C.: Nov. 15, 2002).
[4] To gain access under this scenario, a user is prompted to insert a
smart card into a reader to provide identifying information to the
computer as well as type in a password. This authentication process is
significantly more difficult to circumvent because an intruder would
need to not only guess a user's password, but also to possess the same
user's smart card.
[5] For more information about biometrics, see GAO, Information
Security: Challenges in Using Biometrics, GAO-03-1137T (Washington,
D.C.: Sept. 9, 2003) and Technology Assessment: Using Biometrics for
Border Security, GAO-03-174 (Washington, D.C.: Nov. 15, 2002).
[6] For more information about PKI technology, see GAO, Information
Security: Advances and Remaining Challenges to Adoption of Public Key
Infrastructure Technology, GAO-01-277 (Washington, D.C.: Feb. 26,
2001).
[7] In 2000, GSA established the Government Smart Card Interagency
Advisory Board to address government smart card issues, standards, and
practices, as well as to help resolve interoperability problems among
agencies.
[8] Office of Management and Budget, Memorandum for Chief Information
Officers of Departments and Agencies on Streamlining Authentication and
Identity Management within the Federal Government (Washington, D.C.:
July 3, 2003).
[9] GAO-04-948.
[10] As of June 2004, agencies reported that more than half of the
smart card projects previously identified as ongoing (28 of 52) had
been discontinued because they were absorbed into other smart card
projects or were deemed no longer feasible.
[11] Deputy Secretary of Defense, Memorandum on Smart Card Adoption and
Implementation (Washington, D.C.: Nov. 10, 1999).
[12] Interoperability is the ability of two or more systems or
components to exchange information and to use the information
exchanged.
[13] 5 U.S.C. section 552a.
[14] E-Government Act of 2002, P.L. 107-347, sec. 208 (Dec. 17, 2002).
[15] OMB, Memorandum for the Chief Information Officers of Departments
and Agencies, July 3, 2003.
[16] NIST, Government Smart Card Interoperability Specification,
version 2.1, Interagency Report 6887 (July 2003).
[17] Homeland Security Presidential Directive 12/Hspd-12, August 27,
2004.
[18] GAO-04-948.
[19] VA plans to contract out a key component of the PKI known as a
certification authority. For more information on contracting out
certification authorities, see GAO-04-1023R.
[20] A PKI is a system of computers, software, and data that relies on
certain cryptographic techniques for some aspects of security. A
properly implemented and maintained PKI can offer several important
security services, including assurance that (1) the parties to an
electronic transaction are really who they claim to be, (2) the
information has not been altered or shared with any unauthorized
entity, and (3) neither party will be able to wrongfully deny taking
part in the transaction. For more information, see GAO, Information
Security: Advances and Remaining Challenges to Adoption of Public Key
Infrastructure Technology, GAO-01-277 (Washington, D.C.: Feb. 26,
2001).
[21] VA's facilities include 57 regional offices, 158 hospitals, 133
nursing homes, 7 centralized mail out pharmacies, and 9 regional loan
centers.
[22] The One-VA ID card will not be issued to veterans or other VA
beneficiaries.
[23] The other agencies are the National Aeronautics and Space
Administration and the departments of Defense, Homeland Security, and
Interior.
