Today, federal employees are issued a wide variety of identification (ID) cards, which are used to access federal buildings and facilities, sometimes solely on the basis of visual inspection by security personnel. These cards often cannot be used for other important identification purposes—such as gaining access to an agency’s computer systems—and many can be easily forged or stolen and altered to permit access by unauthorized individuals. In general, the ease with which traditional ID cards—including credit cards—can be forged has contributed to increases in identity theft and related security and financial problems for both individuals and organizations. Smart cards are plastic devices about the size of a credit card that contain an embedded integrated circuit chip capable of both storing and processing data. Figure 1 shows a typical example of a smart card. The unique advantage of smart cards—as opposed to cards with simpler technology, such as magnetic stripes or bar codes—is that smart cards can exchange data with other systems and process information rather than simply serving as static data repositories. By securely exchanging information, a smart card can help authenticate the identity of the individual possessing the card in a far more rigorous way than is possible with simpler, traditional ID cards. A smart card’s processing power also allows it to exchange and update many other kinds of information with a variety of external systems, which can facilitate applications such as financial transactions or other services that involve electronic record keeping. Smart cards can also be used to significantly enhance the security of an organization’s computer systems by tightening controls over user access. A user wishing to log on to a computer system or network with controlled access must “prove” his or her identity to the system—a process called authentication. Many systems authenticate users by merely requiring them to enter secret passwords, which provide only modest security because they can be easily compromised. Substantially better user authentication can be achieved by supplementing passwords with smart cards. To gain access under this scenario, a user is prompted to insert a smart card into a reader attached to the computer as well as type in a password. This authentication process is significantly harder to circumvent because an intruder would need not only to guess a user’s password but also to possess the same user’s smart card. Even stronger authentication can be achieved by using smart cards in conjunction with biometrics. Smart cards can be configured to store biometric information (such as fingerprint templates or iris scans) in electronic records that can be retrieved and compared with an individual’s live biometric scan as a means of verifying that person’s identity in a way that is difficult to circumvent. A system requiring users to present a smart card, enter a password, and verify a biometric scan provides what security experts call “three-factor” authentication, the three factors being “something you possess” (the smart card), “something you know” (the password), and “something you are” (the biometric). Systems employing three-factor authentication are considered to provide a relatively high level of security. The combination of smart cards and biometrics can provide equally strong authentication for controlling access to physical facilities. Smart cards can also be used in conjunction with PKI technology to better secure electronic messages and transactions. A properly implemented and maintained PKI can offer several important security services, including assurance that (1) the parties to an electronic transaction are really whom they claim to be, (2) the information has not been altered or shared with any unauthorized entity, and (3) neither party will be able to wrongfully deny taking part in the transaction. An essential component is the use of electronic encryption keys, called “private keys,” that are unique to each user and must be kept secret and secure. For example, storing and using private keys on a user’s computer leaves them susceptible to attack because a hacker who gains control of that computer may then be able to use the private key stored in it to fraudulently sign messages and conduct electronic transactions. However, if the private key is stored on a user’s smart card, it may be significantly less vulnerable to attack and compromise. Security experts generally agree that PKI technology is most effective when deployed in conjunction with smart cards. In addition to enhancing security, smart cards have the flexibility to support a wide variety of uses not related to security. A typical smart card in use today can store and process 16 to 32 kilobytes of data, while newer cards can accommodate 64 kilobytes. The larger the card’s electronic memory, the more functions can be supported, such as tracking itineraries for travelers, linking to immunization or other medical records, or storing cash value for electronic purchases. Other media—such as magnetic stripes, bar codes, and optical memory (laser-readable) stripes—can be added to smart cards to support interactions with existing systems and services or provide additional storage capacity. For example, an agency that has been using magnetic stripe cards for access to certain facilities could migrate to smart cards that would work with both its existing magnetic stripe readers as well as new smart card readers. Of course, the functions provided by the card’s magnetic stripe, which cannot process transactions, would be much more limited than those supported by the card’s integrated circuit chip. Optical memory stripes (which are similar to the technology used in commercial compact discs) can be used to equip a card with a large memory capacity for storing more extensive data—such as color photos, multiple fingerprint images, or other digitized images—and making that card and its stored data very difficult to counterfeit. Smart cards are grouped into two major classes: contact cards and “contactless” cards. Contact cards have gold-plated contacts that connect directly with the read/write heads of a smart card reader when the card is inserted into the device. Contactless cards contain an embedded antenna and work when the card is waved within the magnetic field of a card reader or terminal. Contactless cards are better suited for environments where quick interaction between the card and reader is required, such as high- volume physical access. For example, the Washington Metropolitan Area Transit Authority has deployed an automated fare collection system using contactless smart cards as a way of speeding patrons’ access to the Washington, D.C., subway system. Smart cards can be configured to include both contact and contactless capabilities, but two separate interfaces are needed, because standards for the technologies are very different. Figure 2 shows some of the capabilities and features that can be included in smart cards. Since the 1990s, the federal government has considered the use of smart card technology as one option for electronically improving security over buildings and computer systems. In 1996, GSA was tasked with taking the lead in facilitating a coordinated interagency management approach for the adoption of multiapplication smart cards across government. The tasking came from OMB, which has statutory responsibility to develop and oversee policies, principles, standards, and guidelines used by agencies for ensuring the security of federal information and systems. At the time, OMB envisioned broad adoption of smart card technology throughout the government, as evidenced by the President’s budget for fiscal year 1998, which set a goal of enabling every federal employee ultimately to be able to use one smart card for a wide range of purposes, including travel, small purchases, and building access. In January 1998, the President’s Management Council and the Electronic Processing Initiatives Committee (EPIC) established an implementation plan for smart cards that called for a governmentwide, multiapplication card that would support a range of functions—including controlling access to government buildings—and operate as part of a standardized system. More recently, several legislative bills have been proposed or enacted in the wake of the events of September 11, 2001, to enhance national security and counterterrorism by using smart card and biometric technologies to better identify individuals entering the country or gaining access to mass transportation systems. Our objectives were to assess (1) the extent to which federal agencies have adopted smart card technologies and realized the associated benefits, (2) the challenges of adopting smart cards within federal agencies, and (3) the effectiveness of GSA in promoting the adoption of smart card technologies within the federal government. To assess the extent of smart card adoption by federal agencies and identify associated benefits and challenges, we reviewed smart card project documentation, cost estimates, and other studies from GSA; OMB; the Western Governors’ Association (WGA), which was responsible for a smart card project funded in part by the Departments of Agriculture and Health and Human Services; the Department of Justice’s Immigration and Naturalization Service; DOD; and the Departments of Interior, Transportation, Treasury, and Veterans Affairs (VA). We also held discussions with key officials from these organizations regarding project benefits and challenges. Discussions were also held with representatives of the Smart Card Alliance, an association of smart card technology vendors, regarding smart card technology benefits and challenges. In addition, we reviewed publicly available materials and reports on smart card technology issues and discussed key issues with representatives of these organizations. To assess GSA’s effectiveness in promoting the governmentwide adoption of smart cards, we reviewed contract task orders, examined pilot project documentation, and assessed smart card plans and other reports obtained from the agency. We also held discussions with key officials in GSA’s Office of Governmentwide Policy, Federal Technology Service, and Public Building Service to obtain information on internal pilot projects and other key plans and documents. We analyzed reports and evaluations on the smart card program obtained from GSA’s Office of Inspector General. To obtain information on whether GSA had taken an effective leadership role in fostering the adoption of smart card technology across government, we interviewed officials from NIST; DOD; VA; the Departments of Interior, Transportation, and Treasury; and OMB. We also interviewed officials from WGA. We performed our work between April and October 2002 in accordance with generally accepted government auditing standards.