HOUSE GOVERNMENT REFORM SUBCOMMITTEE ON TECHNOLOGY, INFORMATION POLICY,
INTERGOVERNMENTAL RELATIONS AND THE CENSUS HEARING ON: ADVANCEMENTS IN
SMART CARD AND BIOMETRIC TECHNOLOGY

# SEPTEMBER 9, 2003

#### 

## INTRODUCTION

Subcommittee Chairman Adam Putnam conducted the July 9, 2003 hearing on
Advancements in Smart Card and Biometric Technology.

Witnesses were:

### [Panel 1]{.underline}

**Joel Willemssen**, Managing Director of IT Management, General
Accounting Office

**Sandy Bates**, Commissioner, Federal Technology Services, General
Services Administration

**Benjamin Wu**, Deputy Undersecretary of Commerce for Technology,
Department of Commerce

**Ken C. Scheflen**, Director, Defense Manpower Data Center, Department
of Defense

### [Panel 2]{.underline}

**Keith Rhodes**, Chief Technologist, General Accounting Office

**Christer Bergman**, Chief Executive Officer, Precise Biometrics

**Daniel Turissini**, President, Operational Research Consultants, Inc.

The hearing provided an overview of the current status of smart card and
biometric technology implementation in the Federal Government and key
issues that need to be addressed in planning for additional deployment
of this technology, which offers very significant benefits for helping
to secure access to information and to facilities.

**[HEARING HIGHLIGHTS]{.underline}**

Throughout the hearing, Chairman Putnam emphasized the continuing need
to identify and correct issues that may be causing delays in proceeding
with additional smart card programs.

There appeared to be general agreement during the hearing on:

-   Smart card technology is here but it would be difficult to
    standardize on a single approach throughout Government to meet the
    diverse requirements of the different agencies.

-   Important hurdles that need to be overcome include achieving top
    management buy-in, addressing cultural issues in agencies and
    funding support. All were identified as key issues.

During Questions/Answers, Sandy Bates suggested Smart Card
implementation could be taken incrementally by starting with an I.D.
card with common fields to access a building and get acceptance for
this. Then, other elements can be added against the same set of
standards. One set of people is involved for information and computer
security and the I.D for physical security involves another set. Ms.
Bates suggested the need to pull these together, and to have people
participating who can give authorization. She also suggested it is a
management and implementation issue.

Joel Willemssen stated that top management commitment is the largest
impediment. He said the July 3, 2003 memorandum [Streamlining
Authentication and Identity Management within the Federal Government,
from the OMB Administrator for E-Government and
Technology](http://www.estrategy.gov/omb.cfm#egov) is a very important
policy document.

The remainder of this report contains key points from witness
statements.

#### KEY POINTS FROM WITNESS STATEMENTS

**[Panel 1]{.underline}**

**Mr. Willemssen Statement**

-   Maintaining executive level commitment is essential to implementing
    a smart card system effectively. The Deputy Secretary of Defense
    issued a directive for the Defense Common Access Card (CAC)
    initiative and assigned roles and responsibilities within the
    Defense Department for the CAC, which is the largest smart card
    implementation to date.

-   Smart card implementation costs can be high, particularly if
    significant infrastructure modifications are required, or other
    technologies such as biometrics and PKI (public key infrastructure)
    are being implemented.

-   The ability of smart card systems to address both physical and
    logical (information systems) security means that unprecedented
    levels of cooperation may be required among internal organizations,
    especially physical security and information technology.

-   Interoperability is a key consideration. The value of a smart card
    is greatly enhanced if it can be used with multiple systems at
    different agencies, and GSA has reported that virtually all agencies
    agree that interoperability at some level is critical to widespread
    adoption of smart cards across the Government.

-   The security of smart card systems is not foolproof and must be
    addressed when agencies plan the implementation of a smart card
    system.

-   Actions have been taken to promote consistent smart card adoption
    across Government. GSA worked with the Navy to establish the Smart
    Card Technology Demonstration Center and also established a Smart
    Card Project Managers Group.

-   Reference was made to the July 3, 2003 memorandum from the OMB
    Administrator for E-Government and Information Technology. The
    memorandum briefly outlined OMB's plans to develop common policy for
    authentication and identity management including technical guidance
    to be developed by GSA and NIST. The new Federal Identity and
    Credentialing Committee is intended to collect agency input on
    policy requirements and coordinate this effort. Also, the memorandum
    said OMB is planning to execute Federal-wide acquisitions of
    authentication technology, including smart cards and digital
    certificates in the near term to achieve cost savings.

Ms. Bates Statement:

-   GSA acquired the lead role for promoting the benefits of smart card
    technology in the Federal Government at the request of OMB in 1996.

-   GSA's Smart Card Technology Center opened in 1998 and continues to
    provide demonstrations of key smart card applications.

-   GSA's Smart Card contract (known as the Smart Card Common Access ID
    contract) was awarded in May 2000 to five prime vendors. Development
    of contract requirements was a joint effort with the Departments of
    Defense, Treasury and State. A major feature is the establishment of
    technical specifications for smart card interoperability.

-   GSA's Smart Card Project Managers Group includes representatives
    from approximately 50 agencies and meets regularly to cover all
    major issues and programs in smart cards.

-   GSA's Interagency Advisory Board (IAB) was established after
    publication of the initial version of the Smart Card
    interoperability specifications and includes representatives from
    NIST, the Departments of Homeland Security, Defense, State, and
    Treasury and representatives of the prime Smart Card contractors.
    The IAB was established to refine and update the Interoperability
    specifications that are key to the Smart Card contract.

-   GSA has been working with other agencies and key non-governmental
    organizations in developing worldwide biometric standards.

-   GSA's Office of Governmentwide Policy (OGP) has lead responsibility
    for conducting ongoing evaluation of the implementation of Smart
    Card based systems by Federal agencies to ensure that lessons
    learned and best practices are shared across Government. The OGP is
    working closely with the IAB to document guidance for conducting and
    communicating ongoing evaluations and lessons learned.

-   The Federal Identity Credentialing Committee, which GSA is leading,
    will define the policies for issuance and management of identity
    credentials for Federal personnel, contractors and other authorized
    users that encompass both physical access to buildings and logical
    access to systems. By implementing standardized credentials across
    Government, individual access control can be streamlined across
    multiple organizations and systems.

-   At the August 2003 IAB meeting, it was decided to begin developing
    several models of smart card requirements that can be used to make a
    consolidated purchase for interested agencies. This will be done
    with the Federal Identity Credentialing Committee.

**Mr. Wu Statement**

-   The National Institute of Standards (NIST) released the second
    version of the Government Smart-Card Interoperability Specification,
    Version 2.1 (Interagency Report 6887), in July 2003. Version 2.1
    provides support for biometrics, contactless smart card technology,
    and Public Key Infrastructure.

-   NIST is working with the American National Standards Institute
    (ANSI) and the International Organization for Standardization (ISO)
    to standardize Version 2.1 (or evolved) specification. ANSI formally
    submitted Version 2.1 to ISO in August 2003.

-   There is considerable interest in the convergence of biometrics and
    smart cards. NIST included "hooks" for biometric authentication
    modules in Version 2.1

.**Mr. Scheflen Statement**

-   The Defense Common Access Card (CAC) is a multi-technology
    chip-based card or "Smart Card" for all uniformed service personnel,
    Defense civilian employees, Selected Reserve and contractors who
    require physical access to Defense facilities or logical access to
    Defense systems. The CAC will be issued to approximately 4 million
    people.

-   The CAC is one of the few major programs doing local rather than
    centralized card production and issuance. Installers visited 945
    locations in twenty-seven countries to install hardware and software
    and train operators how to use the system. To date, over 3 million
    cards have been issued at a rate of over 10,000 per day.

#### Panel 2

**Mr. Rhodes Statement**

-   Biometric technologies are available today that can be used in
    security systems to help protect assets. However, it is important to
    bear in mind that effective security cannot be achieved by relying
    on technology alone. Technology and people must work together as
    part of an overall security process.

-   Three considerations need to be addressed before a decision is made
    to design, develop, and implement biometrics into a security
    system: (1) Decisions must be made on how the technology will be
    used, (2)A detailed cost-benefit analysis must be conducted to
    determine that the benefits gained from a system outweigh the
    costs, (3) A trade-off analysis must be conducted between the
    increased security, which the use of biometrics would provide, and
    the effect on areas such as privacy and convenience.

-   Security concerns need to be balanced with practical cost and
    operational considerations as well as political and economic
    interests. A risk management approach can help Federal agencies
    identify and address security concerns.

-   As Federal agencies consider the development of security systems
    with biometrics, they need to define what the high-level goals of
    the system would be and develop the concept of operations that will
    embody the people, process and technologies required to achieve the
    goals. With these answers, the proper role of biometric technologies
    in security can be determined. If these details are not resolved,
    the estimated costs and performance of the resulting system will be
    at risk.

#### 

#### Mr. Bergman Statement

-   The combination of Smart card and biometrics can provide a very
    secure and convenient ID Credential. Not only can you present
    something you have (the Smart Card), you can also present who you
    are (biometrics) and combined with a password something you know),
    the secure ID credential then represents a very secure 3-factor
    authentication system. However, more often the preferred solution
    contains a 2-factor authentication: What you have (Smart Card) and
    who your are (biometrics) because of the difficulty of maintaining
    PIN code/passwords.

-   His conclusion is that the biometric enabled Smart Card is not only
    a concept; it is very much a proven reality. It should lower the
    overall cost of a system implementation by virtue of removing the
    heavy support costs of PIN management, it can minimize privacy
    concerns by avoiding storing the biometric information in a central
    data base and the potential exposure of the biometric information
    when using the system. It will also optimize the usability of the
    overall system with respect to security and the convenience of using
    the biometrics for both physical as well as logical access control.

#### Mr. Turissini Statement

-   The past several years have seen significant advancements in the
    development and production of smart card technology and biometrics
    has seen significant progress. Further, the integration of these
    technologies into legacy and current generation environments has
    grown correspondingly. Unfortunately, the policies and acceptance of
    these technologies have progressed at a much slower pace.

-   The technologies necessary to attain digital security in our open
    society are available. Asymmetric credential fully support
    non-repudiation and ensure user privacy coupled with multiple levels
    of credential protection based on the requisite security need.
    Providing each citizen the means by which they can authenticate
    themselves using something they know (password), something they have
    (Smart Card) and something they are (biometric) can begin today.
    Further, this does not have to be done at the expense of anyone's
    civil liberties.

> If there are questions, please contact John Ray (202) 501-3473
> john.ray@gsa.gov