Historically, federal employees have been issued a wide variety of ID cards that are used to access federal buildings and other facilities. In many cases, security personnel allow access on the basis of visual inspection of these cards. However, many of these cards can be easily forged and have other limitations in their ability to effectively authenticate individuals seeking access to federal facilities. Access control is the process of determining the permissible activities of users and authorizing or prohibiting activities by each user. Controlling a user’s access to facilities and computer systems includes setting rights and permissions that grant access only to authorized users. There are two types of access control: physical access and logical access. Physical access control focuses on restricting the entry and/or exit of users from a physical area, such as a building or a room in a building. Physical access control techniques include devices such as locks that require a key to open doors or ID cards that establish an individual’s authorization to enter a building. Logical access control is used to determine what electronic information and systems users and other systems may access and what may be done to the information that is accessed. Methods for controlling logical access include requiring a user to enter a password to access information stored on a computer. Access control techniques vary in the extent to which they can provide assurance that only authorized individuals and systems have been granted access. Some techniques can be easily subverted, while others are more difficult to circumvent. Generally, techniques that provide higher levels of assurance are more expensive, more difficult to implement, and cause greater inconvenience to users than less sophisticated techniques. When deciding which access control mechanisms to implement, agencies must first understand the level of risk associated with the facility or information that is to be protected. The higher the risk level, the greater the need for agencies to implement a high-assurance-level access control system. One means to implement a high-assurance-level access control system is through the use of smart cards. Smart cards are plastic devices that are about the size of a credit card and contain an embedded integrated circuit chip capable of storing and processing data. The unique advantage that smart cards have over traditional cards with simpler technologies, such as magnetic strips or bar codes, is that they can exchange data with other systems and process information, rather than simply serving as static data repositories. By securely exchanging information, a smart card can help authenticate the identity of the individual possessing the card in a far more rigorous way than is possible with traditional ID cards. A smart card’s processing power also allows it to exchange and update many other kinds of information with a variety of external systems, which can facilitate applications such as financial transactions or other services that involve electronic record-keeping. Figure 1 shows an example of a typical smart card. Smart cards can also be used to significantly enhance the security of an agency’s computer systems by tightening controls over user access. A user wishing to log on to a computer system or network with controlled access must “prove” his or her identity to the system—a process called authentication. Many systems authenticate users by requiring them to enter secret passwords. This requirement provides only modest security because passwords can be easily compromised. Substantially better user authentication can be achieved by supplementing passwords with smart cards. To gain access under this scenario, a user is prompted to insert a smart card into a reader attached to the computer as well as type in a password. This authentication process is significantly harder to circumvent because an intruder would not only need to guess a user’s password but would also need to possess that same user’s smart card. Even stronger authentication can be achieved by using smart cards in conjunction with biometrics. Smart cards can be configured to store biometric information (such as fingerprints or iris scans) in an electronic record that can be retrieved and compared with an individual’s live biometric scan as a means of verifying that person’s identity in a way that is difficult to circumvent. An information system requiring users to present a smart card, enter a password, and verify a biometric scan uses what is known as “three-factor authentication,” which requires users to authenticate themselves by means of “something they possess” (the smart card), “something they know” (the password), and “something they are” (the biometric). Systems employing three-factor authentication provide a relatively high level of security. The combination of a smart card used with biometrics can provide equally strong authentication for controlling access to physical facilities. Smart cards can also be used in conjunction with public key infrastructure (PKI) technology to better secure electronic messages and transactions. PKI is a system of computers, software, and data that relies on certain cryptographic techniques to protect sensitive communications and transactions. A properly implemented and maintained PKI can offer several important security services, including assurances that (1) the parties to an electronic transaction are really who they claim to be, (2) the information has not been altered or shared with any unauthorized entity, and (3) neither party will be able to wrongfully deny taking part in the transaction. PKI systems are based on cryptography and require each user to have two different digital “keys” to gain access: a public key and a private key. Both public and private keys may be generated on a smart card or on a user’s computer. Security experts generally agree that PKI technology is most effective when used in tandem with hardware tokens, such as smart cards. PKI systems use cryptographic techniques to generate and manage electronic “certificates” that link an individual or entity to a given public key. These digital certificates are then used to verify digital signatures and facilitate data encryption. The digital certificates are created by a trusted third party called a certification authority, which is also responsible for providing status information on whether the certificate is still valid or has been revoked or suspended. The PKI software in the user’s computer can verify that a certificate is valid by first verifying that the certificate has not expired, and then by checking the online status information to ensure that it has not been revoked or suspended. Implementing a functioning PKI across government agencies involves much more than just establishing the basic hardware and software infrastructure at individual agencies. For example, for PKI certificates to work across the government, a vast network of interoperable online directories would need to be in place so that each user’s identity could be looked up and his or her digital certificate verified before any transaction takes place. Software applications would likely need to consult a number of disparate directories to validate an incoming user’s digital certificate. Significant costs are involved in developing, fielding, and maintaining a production PKI to meet these requirements. Systems must be set up to positively identify users and manage the exchange and verification of certificates. In addition, existing software applications, electronic directories, and other legacy systems must be modified so that they can interact with the PKI. As a result, the total costs associated with building a PKI and enabling applications to use it can be significant. In August 2004, the President issued HSPD-12, which directed Commerce to develop a new standard for secure and reliable forms of ID for federal employees and contractors to enable interoperability across the federal government by February 27, 2005. The directive defined secure and reliable ID as meeting four control objectives. Specifically, the identification credentials must be based on sound criteria for verifying an individual employee’s or contractor’s identity; strongly resistant to identity fraud, tampering, counterfeiting, and terrorist able to be rapidly authenticated electronically; and issued only by providers whose reliability has been established by an official accreditation process. HSPD-12 stipulates that the standard must include criteria that are graduated from “least secure” to “most secure” to ensure flexibility in selecting the appropriate level of security for each application. In addition, the directive directs agencies to implement, to the maximum extent practicable, the standard for IDs issued to federal employees and contractors in order to gain physical access to controlled facilities and logical access to controlled information systems by October 27, 2005. In response to HSPD-12, Commerce’s NIST published FIPS 201, Personal Identity Verification of Federal Employees and Contractors, on February 25, 2005. The standard specifies the technical requirements for PIV systems to issue secure and reliable ID credentials to federal employees and contractors for gaining physical access to federal facilities and logical access to information systems and software applications. Smart cards are a primary component of the envisioned PIV system. The FIPS 201 standard is composed of two parts. The first part, called PIV-I, sets standards for PIV systems in three areas: (1) identity proofing and registration, (2) card issuance and maintenance, and (3) protection of card applicants’ privacy. The second part of the FIPS 201 standard, PIV-II, provides technical specifications for interoperable smart card-based PIV systems. To verify individuals’ identities, agencies are directed to adopt an accredited identity proofing and registration process that is approved by the head of the agency. There are many steps to the verification process, such as completing a background investigation of the applicant, conducting and adjudicating a fingerprint check prior to credential issuance, and requiring applicants to provide two original forms of identity source documents from an OMB-approved list of documents. Agencies are also directed to adopt an accredited card issuance and maintenance process that is approved by the head of the agency. This process should include standardized specifications for printing photographs, names, and other information on PIV cards and for other activities, such as capturing and storing biometric and other data, and issuing, distributing, and managing digital certificates.