Slashdot Mirror
Feds Start Small on Smart IDs
jcatcw writes "Some government employees will be getting smart ID cards beginning this week. The unfunded mandate to have all employees and contractors use Personal Identity Verification (PIV) cards is part of Homeland Security Presidential Directive 12. The U.S. General Services Administration is providing enrollment centers that can verify the identities of employees, fingerprint and photograph the workers, and issue PIV cards to them. The deadline for getting cards to all employees and contractors is the end of September 2008."
As long as these IDs are only being used to keep unauthorized people out of government buildings, there's nothing wrong with that - everybody should have an employee ID card anyways. It's only when Fancy-Schmancy National ID Cards(TM) become mandatory that we need to start worrying.
Footix - President, Society For Putting Things On Top Of Other Things
I have no problem with smart IDs themselves; but if they're RFIDs there's going to be trouble. Hopefully a few exploits will be tried while the system is being rolled out so our wonderful government regulators will realize there's a problem.
What's the alternative to RFIDs? Well, the alternative to contactless is non-contactless. You may remember the original American Express Blue cards with the little copper pads on one side. Similar "smartcard" technology has been used by other card makers, especially in Europe.
So what's the difference? The difference is that RFIDs can be accessed without one's notice, and it's difficult to determine whether or not you're safe. The RFIDs in US passports, meant to be accessed at a distance of no more than a few inches, has been read at distances of a few feet and detected from dozens of feet away. Do you want to advertise you're carrying around your valuable passport? I don't.
The U.S. General Services Administration is providing enrollment centers that can verify the identities of employees, fingerprint and photograph the workers, and issue PIV cards to them.
And as they have proven without a doubt, once they roll this out to the general population, it will be completely impossible for anyone with bad intentions to obtain fraudulent ID, and terrorism will be defeated.
Push Button, Receive Bacon
Either that site is running a pathetic site, way too much code, or it's being slashdotted because it's running really slow...
No info on how the cards are "smart" I see...would've been nice to have something like that thrown in there, but it is an intreging article. Personally I think it's a great idea how they're starting the implementation, giving the cards to government employees pretty well eliminates the majority of the complaints as they'll get tested on people who work for the people doing the testing. Much better than making everyone get Smart ID's and it also removes the tricky issue of identifying people in order to give them their ID because the majority of these people will have already had at least a minor background search.
It would be nice to have more information, but I'm sure that'll follow soon enough. Nice plan and implementation by the government though.
There are two kinds of fool One says 'This is old therefore good' Another says 'This is new therefore better'- Dean Ing
"from the small-start-leads-to-big-ending dept." How unusual is it for an employer to have some sort of an identity card scheme and why is it that this will no doubt inspire all sorts of comments about government privacy violations?
Did they run out of ironic program and directive names? I mean, come on. Homeland Security Presidential Directive 12? What about Security Initiative for the Protection and Valid Identification of Selected Individuals for the Protection of Families and Children of America? No one could say no to that!
I'm DoD and got my mandated Common Access Card over a year ago. We PKI enabled almost everything. Besides a few inevitable rollout inconveniences (ran out of blanks once, way more people forgot their PINs than they expected, end user training and confusion) it was actually a VERY smooth transition. I'm glad they did it, I honestly think we are more secure because of it (server side, not client side)
So a Federal agency is paying for these with Federal dollars - what's unfunded about this?
You may be thinking about the REAL-ID program, which is indeed an unfunded mandate. But this isn't it.
Thanks for the flamebait anyway.
"As God is my witness, I thought turkeys could fly." A. Carlson
I've worked as a contractor for the Federal Government and the City of New York (which considers themselves a Federal Government). Most of the agencies I worked at had security that was an absolute joke. I'll give the guys at the DoE/Forrestal Building some credit as well as the Department of Juvenile Justice in NYC , they actually asked questions and took their jobs seriously. (The DoJJ guys in New York are the only ones who have flat-out denied me entry... no matter how much smooth talking I did. For whatever reason, the guards I came across took protecting the identities and lives of the children in overseen by the agency very, very seriously and I have the utmost respect for them because of it.) Most of the other security guards were too concerned about talking about the caboose of the last woman to walk through the metal detector.
/looking for the black helicopters
The point is, no amount of technological or physical security is going to do any good if the people entrusted with its implementation are not trained to do their job properly or take it seriously. The only "serious" contracts I worked were at DoE but at the rest of the agencies I had access to enough information to financially ruin a good number of the people in the United States. Thankfully I worked with people who took that responsibility as seriously as I did but I can't help but feel that was through luck of the draw and not the success of the system.
Smartcards/RFID make sense if they going to be used and implemented properly (e.g. you picture is on the card and encrypted with a public key system so that the agency can verify that it's authentic and not a clever forgery... and the people at the desk care enough to actually check)... otherwise it's just another way for contractors/etc to make money and a waste of everyone else's time.
Mr PIV, meet Mr Hammer.
The government is saying that they can do things that are impossible. Have we forgotten the philosophical works of the past few hundred years? Certainty! There is no certainty in any of this.
IT's meaningless nonsense.
The same. We have a competent IT staff, haven't had any major snafus really. Mostly problems between the keyboard and the chair :)
Slick system, login via CAC card (common access card) with a PIN. Emails can be encrypted with a digital signature. When online training is completed it is automatically added to your record and signed with your key. Very slick system.
PIV and CAC aren't the same thing? Isn't the PIV FIPS 201 standard used to define a card that can be used across federal government and contractors? The Common Access Card, if I'm not mistaken, is only used by the department of defense.
In case anyone cares to actually LEARN what it is rather than just ramble on about how horrible the world is:
http://csrc.nist.gov/piv-program/index.html
It's a very sensible document (and HSPD12 is just the mandate, FIPS201 is the implementation). All it does (ALL) is say "agencies need to have a process in place to make sure Joe is Joe, and they need to give him a card that says he's Joe, and it needs to look like this."
It doesn't actually go further than that. It outlines an interoperable infrastructure based on dirt simple, well understood, highly tested smart card stock, lays out minimum requirements for readers, and puts a system certification process in place. The "tech" part of this is really quite simple and boring for anyone who's spent more than 10 minutes thinking about PKI or smartcards.
The much much more important part of this is the credentialling part (PIV-1) which has been in place for a year. This establishes clear lines of responsibility and clear processes for actually establishing that Joe is Joe, and at least an attempt to make sure that, say, the Defense Manpower Data Center is using the same process as the Janitor's closet in the Department of Education. This is a GOOD THING people. It's about breaking down silos and creating (gasp) an open standard for strong(er) authentication.
That's right folks, an open interoperability standard sponsored by the US of A. Wanna make sure your corporate ID is just a wee bit futureproof? Read the FIPS201 docs and mimic the data model and tech requirements.
OK, back to the sarcasm laced punditry. Thank's for playing.
You deploy them first to government employees, desensitize the public to them, then roll them out to the entire nation. Note they said "and contractors". Contractors are civilians.
We already have a National ID system, through various coordinated data through Drivers Licences, tax filings, SSN cards, Credit Cards, Voter Registration, and the like. Mainly Drivers Licences. Have you tried to get one renewed in the last 4 years? They require your fingerprint, even though you are not a criminal. Once they get your fingerprint, or DNA, or both, they pwn you.
The NAZIs implimented their campaign of extermination of the Jews in the same method. First you go after a subset, not rocking the boat, and then you after another, and expand your campaign and momentum as you meet little or no resistance along the way. Once most of the population has become desensitized to the idea, and it becomes commonplace to arrest Jews and ship them off, nobody cares anymore. Its the same with Drivers Licnences. They did it gradually... and nobody is pissed about being fingerprinted like a criminal now and having all your vital information stored with your fingerprint and picture in an FBI database.
Some enterprising person came up with a series of far better ones:
h tm
http://homepage.mac.com/rcareaga/diebold/adworks.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
No, seriously I understand you are frightened of the government getting too big for its britches, I just wonder if you really think that ID badges at work are a bad idea, or just for the government.
I hope you are three times as frightened at the idea of the government taking over health care (I mean even more than it already is).
I cried real tears when Li Mu Bai died.
Could be used in a biometric environment, instead of various national ID schemes...
PIV is a NIST standard. Not set in stone, but they are pretty far along.
Contactless was out because they wanted to use proper PKI. Cryptographic functions over contactless card is too slow.
The Government Printing Office was supposed to subcontract the entire print/perso process to be run in one of their facilities.
I wonder who's software they are using? Anyone have any info?
Bearing Point "handles" the CAC card. I would be very interested to see how much of the whole project was awarded their contracts without any bid process whatsoever. Mind you, Bearing Point doesn't -do- anything. The actual work is subcontracted out.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Your being assimilated into the Borg, you don't have to worry about me, the next guy has the cattle prod.
The Department of Defense has been issueing these "smart cards" for several years now. The various branches of the military have used them exclusivly for a few years.
If you want news from today, you have to come back tomorrow.
Have you tried to get one renewed in the last 4 years?
Yup. 2 years ago. No fingerprinting.
I hate to say it but anyone who carries a cell phone is trackable. In fact, were using the internet right now. Trackable. It's all possible, and no one is safe from wrong-doings. But we can't phase out technology just because it's "Trackable". History tells us that in fact that this WILL be used for wrongdoings by government. It's a matter of WHEN it gets out of hand. And it will. Stay alert and cautious.
How the hell did I get such bad karma? I blame the meds...
If these cards can be used to demonstrably increase security, then why not use them?
Which is the breakdown of logic on this entire issue: Nobody has demontrated that ID increases security. The 9/11 hijackers, after all, did have proper identification, and were allowed on the planes.
Push Button, Receive Bacon
yup a little over a year ago, and I didn't even have to go anywhere they mailed it to me. I found this disturbing but convenient.
A big use is access control. There are many areas of federal facilities that you only want authorized personnel. They are ultimately intended to be usable for logical (computer) access as well.
Let me start by saying: I am working on the NIST PKCS11 implementation (it will be public domain). THE PD12 is meant to unify identification and processing of government employees. So that you don't end up with several badges with different pictures and fingers prints, from numerous agencies. It's a simplification process and one that's long overdue. I am no bush fan, but people are barking up the wrong tree here. As far as national id cards go, it's just a matter of time. I see resonance here that might label me a troll but I will say it just the same: The slashdot crowd loves to howl about how the RIAA/MPAA is clinging to old and dying bussiness models when they should embrace new ones and stop fighting the inevitable. I completely agree. I also see that the slashdot crowd has a tendency to cling to the more anonymous days before national id's and smart cards. Come to grips with the fact that it will become harder and harder to fake your identity (as it should be) and learn to embrace it. Did anyone ever think that smart cards could come damn close to wiping out identity theft (if used correctly)? Why should I have to get a different drivers license for a new state? Did I forget how to drive? Am I a different person now that I moved? A national id can put an end to the hodge-podge nature of governing in this enormous country. Now, I have always said that "Everyone has something to hide" and I still hold to that for those who say they don't. Don't forget though: Your smart card can encrypt everything you do online and depending on the encryption used, can't be cracked in our lifetime. It is for this very reason that the NSA and FBI desperately attempted (and still do) to prevent the export of RSA encryption abroad -- classifying it as a munition on the same scale as a nuclear weapon. Slashdot is definately a democratic leaning site: It was Bill Clinton who wanted a "clipper chip" back door (read the book Crypto). And, if you want a secret identity, your smart card can support multiple identities. You can have an alternative that only you and your friends in a web-of-trust know about and accept. In real-life I am XXX but on slashdot I am sideswipe76. Freedom of speech has never meant freedom from all consequences of that speech. Look at Martin Luther King -- the man excercised his freedom of speech and brought revolution to the US against the wishes of many of those high-up in government. He also paid with his life not to the government but to James Earl Ray.
In a society where there is no freedom -- there is no crime.
Actually, it works pretty well -- the Nazi's did it, the Communists did (and do) it. When everyone is scared shitless to do anything wrong because no matter what you do, or where you do it, big brother is watching -- it works great!
Right now, the USA is going through the first phase -- FUD. The president is trying to scare everyone so much with terrorists lurking behind every tree that you'll GLADLY give up what little freedom you have left just to be 'safe' from the foreign menace.
Nothing new -- the Communists had the same agenda with people fed the same threat stories about the Americans back during the cold war. Guess Mr. Bush figures if it worked for them, it'll work for him. He's not smart enough to come up with his own plan I suppose.