Background

Today, federal employees are issued a wide variety of identification (ID)  cards, which are used to access federal buildings and facilities, sometimes  solely on the basis of visual inspection by security personnel. These cards  often cannot be used for other important identification purposes—such as  gaining access to an agency’s computer systems—and many can be easily  forged or stolen and altered to permit access by unauthorized individuals.  In general, the ease with which traditional ID cards—including credit  cards—can be forged has contributed to increases in identity theft and  related security and financial problems for both individuals and  organizations. One means to address such problems is offered by the use of  smart cards.
Smart cards are plastic devices about the size of a credit card that contain  an embedded integrated circuit chip capable of both storing and processing  data. Figure 1 shows a typical example of a smart card. The unique  advantage of smart cards—as opposed to cards with simpler technology,  such as magnetic stripes or bar codes—is that smart cards can exchange  data with other systems and process information rather than simply serving  as static data repositories. By securely exchanging information, a smart  card can help authenticate the identity of the individual possessing the card  in a far more rigorous way than is possible with simpler traditional ID  cards. A smart card’s processing power also allows it to exchange and  update many other kinds of information with a variety of external systems,  which can facilitate applications such as financial transactions or other  services that involve electronic record-keeping.
Smart cards can also be used to significantly enhance the security of an  organization’s computer systems by tightening controls over user access. A  user wishing to log on to a computer system or network with controlled  access must “prove” his or her identity to the system—a process called  authentication. Many systems authenticate users by merely requiring them  to enter secret passwords, which provide only modest security because  they can be easily compromised. Substantially better user authentication  can be achieved by supplementing passwords with smart cards. To gain  access under this scenario, a user is prompted to insert a smart card into a  reader attached to the computer as well as type in a password. This  authentication process is significantly harder to circumvent because an  intruder would need not only to guess a user’s password but also to possess  the same user’s smart card.
Even stronger authentication can be achieved by using smart cards in  conjunction with biometrics. Smart cards can be configured to store  biometric information (such as fingerprint templates or iris scans) in  electronic records that can be retrieved and compared with an individual’s  live biometric scan as a means of verifying that person’s identity in a way  that is difficult to circumvent. A system requiring users to present a smart  card, enter a password, and verify a biometric scan provides what security  experts call “three-factor” authentication, the three factors being  “something you possess” (the smart card), “something you know” (the  password), and “something you are” (the biometric). Systems employing  three-factor authentication are considered to provide a relatively high level  of security. The combination of smart cards and biometrics can provide  equally strong authentication for controlling access to physical facilities.
Smart cards can also be used in conjunction with public key infrastructure  (PKI) technology to better secure electronic messages and transactions. A  properly implemented and maintained PKI can offer several important  security services, including assurance that (1) the parties to an electronic  transaction are really who they claim to be, (2) the information has not  been altered or shared with any unauthorized entity, and (3) neither party  will be able to wrongfully deny taking part in the transaction. Security  experts generally agree that PKI technology is most effective when  deployed in conjunction with smart cards.
In addition to enhancing security, smart cards have the flexibility to  support a wide variety of uses not related to security. A typical smart card  in use today can store and process 16 to 32 kilobytes of data, while newer  cards can accommodate 64 kilobytes. The larger the card’s electronic  memory, the more functions can be supported, such as tracking itineraries  for travelers, linking to immunization or other medical records, or storing  cash value for electronic purchases.
Smart cards are grouped into two major classes: contact cards and  “contactless” cards. Contact cards have gold-plated contacts that connect  directly with the read/write heads of a smart card reader when the card is  inserted into the device. Contactless cards contain an embedded antenna  and work when the card is waved within the magnetic field of a card reader  or terminal. Contactless cards are better suited for environments where  quick interaction between the card and the reader is required, such as high- volume physical access. For example, the Washington Metropolitan Area  Transit Authority has deployed an automated fare collection system using  contactless smart cards as a way of speeding patrons’ access to the  Washington, D.C., subway system. Smart cards can be configured to  include both contact and contactless capabilities, but two separate  interfaces are needed because standards for the technologies are very  different.
Since the 1990s, the federal government has considered the use of smart  card technology as one option for electronically improving security over  buildings and computer systems. In 1996, GSA was tasked with taking the  lead in facilitating a coordinated interagency management approach for the  adoption of multiapplication smart cards across government. The tasking  came from OMB, which has statutory responsibility to develop and oversee  policies, principles, standards, and guidelines used by agencies for  ensuring the security of federal information and systems. To make it easier  for federal agencies to acquire commercial smart card products, GSA  developed the governmentwide Smart Card Access Common ID  contracting vehicle, which also specified adherence to the government  smart card interoperability specification that NIST developed in  collaboration with smart card vendors.
In 2003, OMB, in accordance with the President’s vision of creating a more  responsive and cost-effective government, issued a memorandum to  federal chief information officers outlining details of the E-Authentication  E-Government initiative on authentication and identity management. OMB  also created the Federal Identity Credentialing Committee (FICC) to make  policy recommendations and develop the Federal Identity Credentialing  component of the Federal Enterprise Architecture, to include services such  as identity proofing and credential management for the federal  government. In February 2004, FICC issued policy guidance on the use of  smart card–based systems in badge, identification, and credentialing  systems with the objective of helping agencies plan, budget, establish, and  implement credentialing and identification systems for government  employees and their agents.
In our January 2003 report on smart cards, we made recommendations to  OMB, NIST, and GSA. Specifically, we recommended that  the Director, OMB, issue governmentwide policy guidance regarding  adoption of smart cards for secure access to physical and logical assets;   the Director, NIST, continue to improve and update the government  smart card interoperability specification by addressing governmentwide  standards for additional technologies—such as contactless cards,  biometrics, and optical stripe media—as well as integration with PKI;  and   the Administrator, GSA, improve the effectiveness of its promotion of  smart card technologies within the federal government by  (1) developing an internal implementation strategy with specific goals  and milestones to ensure that GSA’s internal organizations support and  implement smart card systems consistently; (2) updating its  governmentwide implementation strategy and administrative guidance  on implementing smart card systems to address current security  priorities; (3) establishing guidelines for federal building security that  address the role of smart card technology; and (4) developing a process  for conducting ongoing evaluations of the implementation of smart  card–based systems by federal agencies to ensure that lessons learned  and best practices are shared across government.
To date, all three agencies have taken actions to address the  recommendations made to them. In response to our recommendation,  OMB issued a July 3, 2003, memorandum to major departments and  agencies directing them to coordinate and consolidate investments related  to authentication and identity management, including the implementation  of smart card technology. NIST has responded by improving and updating  the government smart card interoperability specification to address  additional technologies, including contactless cards and biometrics.GSA  responded to our recommendations by updating its “Smart Card Policy and  Administrative Guidance” to better address security priorities, including  minimum security standards for federal facilities, computer systems, and  data across the government. However, three of our four recommendations  to GSA are still outstanding. GSA officials stated that they are working to  address the recommendations to develop an internal GSA smart card  implementation strategy, develop a process for conducting evaluations of  smart card implementations, and share lessons learned and best practices  across government. The responsibility for one recommendation— establishing guidelines for federal building security that address the role of  smart card technology—was transferred to DHS.

	Status of Previously Ongoing Smart Card Efforts

In January 2003, we reported that 18 federal agencies were planning,  testing, operating, or completing 62 smart card projects. These projects  varied widely in size and technical complexity, ranging from small-scale,  limited-duration pilot projects to large-scale, agencywide initiatives  providing multiple services. The projects were reported in varying stages of  deployment. Specifically, 17 projects were listed as operational, 13 projects  were in the planning stage, and 7 were being piloted. In addition, 10 were  reported at that time as having been completed or discontinued for various  reasons. No information was provided about the project phase of the  remaining 15 initiatives.
In responding to our survey regarding the 52 projects listed as ongoing in  our previous report, agencies reported that as of June 2004, 28 had been  terminated. Of the remaining projects, 11 were operational, 5 were in the  planning or pilot phase, and agencies did not provide current information  on 8. The operational and planned projects consist mostly of large-scale  projects intended to provide identity credentials to an entire agency’s  employees or other large groups of individuals. Figure 2 shows the current  status of the 52 federal smart card projects that were previously reported  as continuing. Table 1 provides summary information on the status of  individual projects, providing reasons for any terminations.
Agencies reported that the majority (28) of the above projects had been  terminated since our last review was conducted. According to agency  officials, reasons for termination were primarily that the projects were  absorbed into other smart card projects or were deemed no longer feasible.  For example, DOD terminated 14 of 26 previously reported projects by  substituting functionality provided by two large-scale smart card projects,  the Common Access Card (CAC) and the EZPay (a project that was not  previously reported). DOD’s CAC card is to be used to authenticate the  identity of nearly 3.5 million military and civilian personnel and to improve  security over online systems and transactions. The EZPay program is a  stored-value card given to recruits at training installations to accelerate the  processing time and thus maximize training time.
Table 2 provides further details on the remaining 16 ongoing projects. As  the table shows, 12 of these are large-scale projects. Agencywide smart  card projects are ongoing at NASA and the Departments of Defense, the  Interior, State, and the Treasury.
These and other large projects will serve populations ranging up to  6 million. The cards will be used for identity credentials, physical access to  buildings, logical access to computer systems, and stored value. The  remaining 4 projects are used for similar purposes. However, they are  smaller in scale, serving populations ranging from 612 to 3,100 individuals.  For example, the Interior’s Minerals Management Service is planning a  smart card program for use as identity credentials, and physical and logical  access for about 2,100 employees.
In response to our survey, agency officials reported 8 additional smart card  projects that were ongoing at the time of our last review but not previously  reported. Four of the 8 projects were planned for multiple applications  such as identity credentials and physical and logical access. The remaining  4 projects were planned for single applications such as stored value, logical  access to computer systems and networks, or processing travel documents.  Figure 3 shows the number of these projects by the type of applications  planned and the stage of reported deployment. Table 3 provides more  detailed status information on these projects.

	Agencies across the Government Continue to Invest in Smart Card Projects

In response to our survey, agencies reported 10 smart card projects that  were initiated since our last review was completed. Based on these  reported projects, more agencies are using GSA’s Smart Card Access  Common ID contracting vehicle to acquire smart card technology.

		Federal Investments in Smart Card Projects

The 10 new projects identified in response to our survey vary in size, scope,  and stage of deployment: planning, pilot, and operational. All of the  projects are planned for multiple applications such as identity credentials  and physical and logical access. Figure 4 shows the number of these  projects by the type of application planned and the stage of reported  deployment.
These 10 projects vary widely in size, including small-scale projects— involving smart cards issued to as few as 126 cardholders—as well as much  larger scale initiatives. For example, Department of Labor officials  reported that the Employment and Training Administration physical access  control smart card was issued to 126 federal employees and contractors as  of December 2003. This card is operational and will be issued to 175  cardholders when fully deployed; it is used for identity credentials and  physical access to buildings and other facilities. In contrast, VA plans to  issue an estimated 500,000 smart cards to employees and contractors under  its Authentication and Authorization Infrastructure Project. Through this  initiative, smart cards will be used for identity credentials, accessing  buildings or other facilities, and accessing computer systems. Production  began in July 2004.
Another example of a large-scale project is GSA’s Nationwide ID card. GSA  plans to issue cards to 61,000 federal employees, contractors, and tenant  agencies. Using this card, GSA plans to implement nationwide uniform  credentials based on smart card technology by providing a single standard  credential card for identification, building access, property management,  and other applications. Table 4 provides status information on the 10  recently initiated smart card projects.

		Agencies’ Reported Use of GSA’s Contracting Vehicle

GSA developed the Smart Card Access Common ID contracting vehicle to  help make it easier for federal agencies to acquire commercial smart card  products and services. According to the director of GSA’s Center for Smart  Card Solutions, further guidance is planned that will require agencies to  use the contracting vehicle or provide justification for not using it. The  Director also stated that using GSA’s contract should help reduce the cost  of smart cards and ensure that vendors incorporate interoperability  specifications. Between December 2004 and December 2008, five  agencies—including NASA and the Departments of Defense, Homeland  Security, the Interior, and Veterans Affairs—are planning to make an  aggregated purchase of up to 40 million cards through the GSA contract. As  a part of this purchase, these agencies are scheduled to begin making  quarterly procurements beginning in December 2004 of approximately 1.2  million cards.
In response to our survey, the majority of the agencies (4 of 7) that reported  new initiatives told us that they purchased smart cards under the GSA  contract. The remaining agencies cited reasons for not acquiring smart  cards under the GSA contract, such as purchase arrangements with  another agency or purchases under other types of contracts.

	Implementation of Agencywide Smart Card Initiatives

Agencies continue to move towards integrated agencywide initiatives that  use smart cards as identity credentials that agency employees can use to  gain both physical access to facilities, such as buildings, and logical access  to computer systems and networks. In some cases, additional functions,  such as asset management and stored value, are also being included. Nine  agencies reported such projects: 4 of these were reported in our prior  report, and 5 are recently initiated efforts. These projects are in various  stages of deployment.
One of the largest agencywide efforts is DHS’s identification and  credentialing project. The agency plans to issue 250,000 cards to employees  and contractors. This is a comprehensive identification and credentialing  effort that will use PKI technology for logical access and proximity chips  for physical access. Authentication will rely on biometrics with a personal  identification number as a backup. Other recently initiated agencywide  smart card projects include GSA’s Nationwide Identification, VA’s  Authentication and Authorization Infrastructure Project, and the  Department of Labor’s E-Authentication project. Table 5 summarizes both  previously reported and recently initiated agencywide smart card efforts.

	Agency Comments and Our Evaluation

We received oral comments on a draft of this report from GSA’s Associate  Administrator, Office of Governmentwide Policy, and from officials of  OMB’s Office of Information and Regulatory Affairs and its Office of  General Counsel. Both GSA and OMB generally agreed with the content in  the draft report. In addition, each agency provided technical comments,  which have been addressed where appropriate in the final report.
We will provide copies of this report to the Director of OMB and the  Administrator of GSA, and the report will be available at no charge on the  GAO Web site at http://www.gao.gov.
Should you have any questions on matters contained in this report, please  contact me at (202) 512-6240 or John de Ferrari, Assistant Director, at (202)  512-6335. We can also be reached by e-mail at koontzl@gao.gov and  deferrarij@gao.gov, respectively. Other key contributors to this report were  Tonia Brown, Barbara Collier, Felipe Colón, Pamlutricia Greenleaf, and  Joel Grossman.

Objectives, Scope, and Methodology

Our objectives were to (1) determine the current status of smart card  projects under way at the time of our last review, (2) identify and determine  the status of projects initiated since our last review was completed, and  (3) identify integrated agencywide smart card projects that are currently  under way.
To address these objectives, we developed a questionnaire and surveyed 24  federal agencies. These included agencies that are subject to the provisions  of the Chief Financial Officers Act as well as the Department of Homeland  Security. The survey included the 18 agencies pursuing smart card projects  that were identified in our previous report.
The practical difficulties of conducting any survey may introduce errors.  For example, differences in how a particular question is interpreted, the  sources of information available to respondents, or the types of people who  do not respond can introduce unwanted variability into the survey results.  We included steps in both the data collection and data analysis stages for  the purpose of minimizing such errors.
We analyzed information obtained through the survey to develop summary  results and identify trends. To ensure the reliability of the information  reported through the survey, we obtained available supporting  documentation—such as project plans and descriptions—to verify  (1) reported planning and implementation dates and (2) the numbers of  smart cards issued as of December 31, 2003, or planned for issuance. As  needed, we conducted follow-up interviews with agency officials  responding to the survey to further ensure that the information provided  was current and accurate. In addition, we contacted GSA officials to  discuss agencies’ use of the Smart Card Access Common ID contract and  other governmentwide implementation issues.
We performed our work in Washington, D.C., and Atlanta, Georgia, between  November 2003 and July 2004, in accordance with generally accepted  government auditing standards.

	GAO’s Mission

The Government Accountability Office, the audit, evaluation and  investigative arm of Congress, exists to support Congress in meeting its  constitutional responsibilities and to help improve the performance and  accountability of the federal government for the American people. GAO  examines the use of public funds; evaluates federal programs and policies;  and provides analyses, recommendations, and other assistance to help  Congress make informed oversight, policy, and funding decisions. GAO’s  commitment to good government is reflected in its core values of  accountability, integrity, and reliability.

	Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost  is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts  newly released reports, testimony, and correspondence on its Web site. To  have GAO e-mail you a list of newly posted products every afternoon, go to  www.gao.gov and select “Subscribe to Updates.”

		Order by Mail or Phone

	To Report Fraud, Waste, and Abuse in Federal Programs

	Congressional Relations

	Public Affairs

Summary:
Why GAO Did This Study

Smart cards--plastic devices about the size of a credit card--use integrated circuit chips to store and process data, much like a computer. Among other uses, these devices can provide security for physical assets and information by helping to verify the identity of people accessing buildings and computer systems. They can also support functions such as tracking immunization records or storing cash value for electronic purchases. Government adoption of smart card technology is being facilitated by the General Services Administration (GSA), which has implemented a governmentwide Smart Card Access Common ID contract, which federal agencies can use to procure smart card products and services. GAO was asked to update information that it reported in January 2003 on the progress made by the federal government in promoting smart card technology. Specific objectives were to (1) determine the current status of smart card projects identified in GAO's last review, (2) identify and determine the status of projects initiated since the last review, and (3) identify integrated agencywide smart card projects currently under way. To accomplish these objectives, GAO surveyed the 24 major federal agencies. In commenting on a draft of this report, officials from GSA and the Office of Management and Budget generally agreed with its content.

What GAO Found

According to GAO's survey results, as of June 2004, more than half of the smart card projects previously reported as ongoing (28 out of 52) had been discontinued because they were absorbed into other smart card projects or were deemed no longer feasible. Of the remaining 24 projects, 16 are in planning, pilot, or operational phases and are intended to support a variety of uses (agencies did not provide current information for 8 projects). Twelve of the 16 projects are large-scale projects intended to provide identity credentials to an entire agency's employees or other large group of individuals. For example, the Department of Defense's (DOD) Common Access Card is to be issued to an estimated 3.5 million DOD-related personnel, and the Transportation Security Administration's Transportation Worker Identification Credential is to be used by an estimated 6 million transportation industry workers. The other 4 projects are smaller in scale, and are intended to provide access or other services to limited groups of people. For example, the Department of Commerce's Geophysical Fluid Dynamics Laboratory Access Card is to be issued to about 612 employees, contractors, and research collaborators. Further, in response to the survey, agencies reported 8 additional smart card projects that were ongoing at the time of the last review. These projects include 4 planned for multiple applications (such as identity credentials and access) and 4 for single applications, including stored value, access to computer systems, and processing travel documents. Based on GAO's survey of federal agencies, 10 additional smart card projects have been initiated since the last review. These projects vary widely in size and scope. Included are small-scale projects, involving cards issued to as few as 126 cardholders (such as a project in the Department of Labor's Employment and Training Administration), and large-scale agencywide initiatives, such as the Department of Veterans Affairs Authentication and Authorization Infrastructure card, which is to be issued to an estimated 500,000 employees and contractors. Four agencies reported purchases under GSA's Smart Card Access Common ID contracting vehicle, and others likewise have plans to use this contract. Specifically, five agencies--the Departments of Defense, Homeland Security, the Interior, and Veterans Affairs, and the National Aeronautics and Space Administration--are planning to make an aggregated purchase of up to 40 million cards over the next 4 years using the GSA contract. Finally, nine agencies are developing and implementing integrated agencywide smart card initiatives. These projects are intended to use one card to support multiple functions, such as providing identification credentials, accessing computer systems, and storing monetary values.