As you know, technology plays an important role in helping the federal government provide security for its many physical and information assets. Today, federal employees are issued a wide variety of identification (ID) cards, which are used to access federal buildings and facilities, sometimes solely on the basis of visual inspection by security personnel. These cards often cannot be used for other important identification purposes—such as gaining access to an agency’s computer systems—and many can be easily forged or stolen and altered to permit access by unauthorized individuals. In general, the ease with which traditional ID cards—including credit cards—can be forged has contributed to increases in identity theft and related security and financial problems for both individuals and organizations. Smart cards can readily be tailored to meet the varying needs of federal agencies or to accommodate previously installed systems. For example, other media—such as magnetic stripes, bar codes, and optical memory (laser-readable) stripes—can be added to smart cards to support interactions with existing systems and services or to provide additional storage capacity. An agency that has been using magnetic stripe cards for access to certain facilities could migrate to smart cards that would work with both its existing magnetic stripe readers as well as new smart card readers. Of course, the functions provided by the card’s magnetic stripe, which cannot process transactions, would be much more limited than those supported by the card’s integrated circuit chip. Optical memory stripes (which are similar to the technology used in commercial compact discs) can be used to equip a card with a large memory capacity for storing more extensive data—such as color photos, multiple fingerprint images, or other digitized images—and for making that card and its stored data very difficult to counterfeit. Figure 1 shows a typical example of a smart card. Smart cards are grouped into two major classes: contact cards and “contactless” cards. Contact cards have gold-plated contacts that connect directly with the read/write heads of a smart card reader when the card is inserted into the device. Contactless cards contain an embedded antenna and work when the card is waved within the magnetic field of a card reader or terminal. Contactless cards are better suited for environments where quick interaction between the card and reader is required, such as high-volume physical access. For example, the Washington Metropolitan Area Transit Authority has deployed an automated fare collection system using contactless smart cards as a way of speeding patrons’ access to the Washington, D.C., subway system. Smart cards can be configured to include both contact and contactless capabilities, but two separate interfaces are needed, because standards for the technologies are very different. Since the 1990s, the federal government has considered the use of smart card technology as one option for electronically improving security over buildings and computer systems. In 1996, OMB tasked GSA with taking the lead in facilitating a coordinated interagency management approach for the adoption of multiapplication smart cards across government. At the time, OMB envisioned broad adoption of smart card technology throughout the government, as evidenced by the President’s budget for fiscal year 1998, which set a goal of enabling every federal employee ultimately to be able to use one smart card for a wide range of purposes, including travel, small purchases, and building access. In January 1998, the President’s Management Council and the Electronic Processing Initiatives Committee (EPIC) established an implementation plan for smart cards that called for a governmentwide, multiapplication card that would support a range of functions—including controlling access to government buildings—and operate as part of a standardized system. More recently, the Enhanced Border Security and Visa Entry Reform Act of 2002 called for enhancing national security and counterterrorism efforts by using technologies such as smart cards that could provide biometric comparison and authentication to better identify individuals entering the country. In developing this testimony, our objectives were to explain the potential benefits of smart cards, to discuss the challenges to successful adoption of smart cards, and to discuss the steps that federal agencies have taken to address those challenges. To address these objectives, we obtained relevant documentation and interviewed officials from GSA and the Department of the Interior. We also analyzed agencies’ accomplishments and planned activities to promote smart cards in light of the challenges to smart card adoption across the federal government that we identified in our January report. We performed our work between August 2003 and September 2003, in accordance with generally accepted auditing standards. The unique properties and capabilities of smart cards offer the potential to significantly improve the security of federal buildings, systems, data, and transactions. For example, the process of verifying the identity of people accessing federal buildings and computer systems, especially when used in combination with other technologies, such as biometrics, is significantly enhanced with the use of smart cards. Since 1998, multiple smart card projects have been launched in the federal government, addressing an array of capabilities and providing many tangible and intangible benefits, including enhancing security over buildings and other facilities, safeguarding computer systems and data, and conducting financial and nonfinancial transactions more accurately and efficiently. Other potential benefits and uses include creating electronic passenger lists for deploying military personnel and tracking immunization and other medical records. The advantage of smart cards—as opposed to cards with simpler technology, such as magnetic stripes or bar codes—is that smart cards can exchange data with other systems and process information rather than simply serving as static data repositories. By securely exchanging information, a smart card can help authenticate the identity of the individual possessing the card in a far more rigorous way than is possible with simpler, traditional ID cards. Even stronger authentication can be achieved if smart cards are used in conjunction with biometrics. Smart cards can be configured to store biometric information (such as fingerprints or iris scans) in electronic records that can be retrieved and compared with an individual’s live biometric scan as a means of verifying that person’s identity in a way that is difficult to circumvent. A system requiring users to present a smart card, enter a password, and verify a biometric scan provides what security experts call “three-factor” authentication, the three factors being “something you possess” (the smart card), “something you know” (the password), and “something you are” (the biometric). Systems employing three-factor authentication are considered to provide a relatively high level of security. As of November 2002, 18 agencies had reported initiating a total of 62 smart card projects in the federal government. In what could be the largest federally sponsored smart card rollout to date, the Department of Homeland Security’s Transportation Security Administration (TSA) plans to issue smart ID cards to up to 15 million transportation workers who require unescorted access to secure parts of transportation venues, such as airports, seaports, and railroad terminals. TSA’s goal is to create a standardized, universally recognized and accepted credential for the transportation industry. According to agency officials, the card is being designed to address a minimum set of requirements, but it will remain flexible enough to support additional requirements as needed. According to TSA’s plans, local authorities will use the card to verify the identity and security level of the cardholder and will grant access to facilities in accordance with local security policies. In addition to Homeland Security, a number of other agencies have undertaken pilot projects to test the capabilities of smart cards. The Department of the Interior’s Bureau of Land Management, for example, launched a pilot to provide smart cards to about 1,100 employees to be used for personal identification at the bureau’s facilities and to serve as an example to communicate the benefits of smart cards to employees throughout the bureau. According to bureau officials, the project has been a success, and the bureau plans to continue the rollout of smart cards to its remaining employees. Other major smart card projects are also under way at the Departments of the Treasury and State. In addition to better securing physical access to facilities, smart cards can be used to enhance the security of an organization’s computer systems by tightening what is known as “logical” access to systems and networks. A user wishing to log on to a computer system or network with controlled access must “prove” his or her identity to the system—a process called authentication. Many systems authenticate users by merely requiring them to enter secret passwords, which provide only modest security because they can be easily compromised. Substantially better user authentication can be achieved by supplementing passwords with smart cards. To gain access under this scenario, a user is prompted to insert a smart card into a reader attached to the computer as well as type in a password. This authentication process is significantly harder to circumvent, because an intruder would need not only to guess a user’s password but also to possess the same user’s smart card. Smart cards can also be used in conjunction with public key infrastructure (PKI) technology to better secure electronic messages and transactions. A properly implemented and maintained PKI can offer several important security services, including assurance that (1) the parties to an electronic transaction are really whom they claim to be, (2) the information has not been altered or shared with any unauthorized entity, and (3) neither party will be able to wrongfully deny taking part in the transaction. An essential component is the use of special pairs of encryption codes, called “public keys” and “private keys,” that are unique to each user. The private keys must be kept secret and secure; however, storing and using private keys on a computer leaves them susceptible to attack, because a hacker who gains control of that computer may then be able to use the private key stored in it to fraudulently sign messages and conduct electronic transactions. In contrast, if the private key is stored on a user’s smart card, it may be significantly less vulnerable to attack and compromise. Security experts generally agree that PKI technology is most effective when deployed in conjunction with smart cards. The largest smart card program currently in the implementation phase is the Department of Defense’s Common Access Card, which is being used initially for logical access to automated systems and networks.