Slashdot Mirror
Feds Start Small on Smart IDs
jcatcw writes "Some government employees will be getting smart ID cards beginning this week. The unfunded mandate to have all employees and contractors use Personal Identity Verification (PIV) cards is part of Homeland Security Presidential Directive 12. The U.S. General Services Administration is providing enrollment centers that can verify the identities of employees, fingerprint and photograph the workers, and issue PIV cards to them. The deadline for getting cards to all employees and contractors is the end of September 2008."
As long as these IDs are only being used to keep unauthorized people out of government buildings, there's nothing wrong with that - everybody should have an employee ID card anyways. It's only when Fancy-Schmancy National ID Cards(TM) become mandatory that we need to start worrying.
Footix - President, Society For Putting Things On Top Of Other Things
I have no problem with smart IDs themselves; but if they're RFIDs there's going to be trouble. Hopefully a few exploits will be tried while the system is being rolled out so our wonderful government regulators will realize there's a problem.
What's the alternative to RFIDs? Well, the alternative to contactless is non-contactless. You may remember the original American Express Blue cards with the little copper pads on one side. Similar "smartcard" technology has been used by other card makers, especially in Europe.
So what's the difference? The difference is that RFIDs can be accessed without one's notice, and it's difficult to determine whether or not you're safe. The RFIDs in US passports, meant to be accessed at a distance of no more than a few inches, has been read at distances of a few feet and detected from dozens of feet away. Do you want to advertise you're carrying around your valuable passport? I don't.
The U.S. General Services Administration is providing enrollment centers that can verify the identities of employees, fingerprint and photograph the workers, and issue PIV cards to them.
And as they have proven without a doubt, once they roll this out to the general population, it will be completely impossible for anyone with bad intentions to obtain fraudulent ID, and terrorism will be defeated.
Push Button, Receive Bacon
"from the small-start-leads-to-big-ending dept." How unusual is it for an employer to have some sort of an identity card scheme and why is it that this will no doubt inspire all sorts of comments about government privacy violations?
I'm DoD and got my mandated Common Access Card over a year ago. We PKI enabled almost everything. Besides a few inevitable rollout inconveniences (ran out of blanks once, way more people forgot their PINs than they expected, end user training and confusion) it was actually a VERY smooth transition. I'm glad they did it, I honestly think we are more secure because of it (server side, not client side)
Just laying the groundwork, making sure things all blur together so it's hard to oppose them. Presidential Directive 12: ID cards. Presidential Directive 13: Hugging Puppies Initiative. ... Presidential Directive 41: "I am Emperor of Earth." Presidential Directive 42: Increase fines for littering by 3%.
On a related note, George W. has ridden the mighty moon worm.
And note to self: "The Mighty Moon Worm" is a great name for both an amusement park ride and a marital aid.
So a Federal agency is paying for these with Federal dollars - what's unfunded about this?
You may be thinking about the REAL-ID program, which is indeed an unfunded mandate. But this isn't it.
Thanks for the flamebait anyway.
"As God is my witness, I thought turkeys could fly." A. Carlson
I've worked as a contractor for the Federal Government and the City of New York (which considers themselves a Federal Government). Most of the agencies I worked at had security that was an absolute joke. I'll give the guys at the DoE/Forrestal Building some credit as well as the Department of Juvenile Justice in NYC , they actually asked questions and took their jobs seriously. (The DoJJ guys in New York are the only ones who have flat-out denied me entry... no matter how much smooth talking I did. For whatever reason, the guards I came across took protecting the identities and lives of the children in overseen by the agency very, very seriously and I have the utmost respect for them because of it.) Most of the other security guards were too concerned about talking about the caboose of the last woman to walk through the metal detector.
/looking for the black helicopters
The point is, no amount of technological or physical security is going to do any good if the people entrusted with its implementation are not trained to do their job properly or take it seriously. The only "serious" contracts I worked were at DoE but at the rest of the agencies I had access to enough information to financially ruin a good number of the people in the United States. Thankfully I worked with people who took that responsibility as seriously as I did but I can't help but feel that was through luck of the draw and not the success of the system.
Smartcards/RFID make sense if they going to be used and implemented properly (e.g. you picture is on the card and encrypted with a public key system so that the agency can verify that it's authentic and not a clever forgery... and the people at the desk care enough to actually check)... otherwise it's just another way for contractors/etc to make money and a waste of everyone else's time.
The same. We have a competent IT staff, haven't had any major snafus really. Mostly problems between the keyboard and the chair :)
Slick system, login via CAC card (common access card) with a PIN. Emails can be encrypted with a digital signature. When online training is completed it is automatically added to your record and signed with your key. Very slick system.
In case anyone cares to actually LEARN what it is rather than just ramble on about how horrible the world is:
http://csrc.nist.gov/piv-program/index.html
It's a very sensible document (and HSPD12 is just the mandate, FIPS201 is the implementation). All it does (ALL) is say "agencies need to have a process in place to make sure Joe is Joe, and they need to give him a card that says he's Joe, and it needs to look like this."
It doesn't actually go further than that. It outlines an interoperable infrastructure based on dirt simple, well understood, highly tested smart card stock, lays out minimum requirements for readers, and puts a system certification process in place. The "tech" part of this is really quite simple and boring for anyone who's spent more than 10 minutes thinking about PKI or smartcards.
The much much more important part of this is the credentialling part (PIV-1) which has been in place for a year. This establishes clear lines of responsibility and clear processes for actually establishing that Joe is Joe, and at least an attempt to make sure that, say, the Defense Manpower Data Center is using the same process as the Janitor's closet in the Department of Education. This is a GOOD THING people. It's about breaking down silos and creating (gasp) an open standard for strong(er) authentication.
That's right folks, an open interoperability standard sponsored by the US of A. Wanna make sure your corporate ID is just a wee bit futureproof? Read the FIPS201 docs and mimic the data model and tech requirements.
OK, back to the sarcasm laced punditry. Thank's for playing.
Some enterprising person came up with a series of far better ones:
h tm
http://homepage.mac.com/rcareaga/diebold/adworks.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
And the country's health care quality and affordability for everyone (not just the fortunate few that can afford if) may improve towards that which people in most other developed countries enjoy.
very few government regulated things (there are exceptions but they are exceedingly rare) are more efficient and cost-effective than things run by the private sector. This includes health care. You get what you pay for, and guess how much taxes will go up to subsidize this new health care?
No thanks, I'm very happy with my very low (relative to other costs of living) copay for insurance and the ability to see a doctor on a whim. I have canadian friends and they tell me about waiting in line to see a doctor. No thank you.
I hate to say it but anyone who carries a cell phone is trackable. In fact, were using the internet right now. Trackable. It's all possible, and no one is safe from wrong-doings. But we can't phase out technology just because it's "Trackable". History tells us that in fact that this WILL be used for wrongdoings by government. It's a matter of WHEN it gets out of hand. And it will. Stay alert and cautious.
How the hell did I get such bad karma? I blame the meds...
Yes how sad it would be for all these healthcare raping gluttons to become bracketed and their skills evaluated. Don't you just dread the notion of having unionized, managed, disciplined healthcare workers that actually charge you less money for better services ?
:P
I will tell you one thing: Canadian-style healthcare is great for health, yes, because it lets anyone from the bottom to the top of the social ladder receive equal service and live equally long lives.
That is also the worst thing about it. Simple: what's the worst thing about community college ? Any freaking idiot in the community can go. Canadian hospitals are particularly affected by overpopulation because well, all the lazy ass welfare bottom-feeders hang out there to get their work exemption forms or to claim invalidity.. I don't know how the hell someone can get a crippling back injury when all they ever do is watch TV and smoke indian cigarettes 8 days a week, but hey what the hell do I know, I'm just a genius with a paper degree
I don't have a good solution for it, you can't just deny service to the unemployed (well, I would, but I'm not exactly the most ethical guy). I don't think the true solution lies halfway like that, it's going to be a tangential divergence. Something that's not as easily forged or corrupted. It's a case where if you trim off the bottom 5%, the other 95% of patients will greatly benefit
-Billco, Fnarg.com
Two VERY different circumstances. An airplane is public - of course ID provides little security. In the case of an access-controlled building, it's only common sense that better ID would increase security.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
Let me start by saying: I am working on the NIST PKCS11 implementation (it will be public domain). THE PD12 is meant to unify identification and processing of government employees. So that you don't end up with several badges with different pictures and fingers prints, from numerous agencies. It's a simplification process and one that's long overdue. I am no bush fan, but people are barking up the wrong tree here. As far as national id cards go, it's just a matter of time. I see resonance here that might label me a troll but I will say it just the same: The slashdot crowd loves to howl about how the RIAA/MPAA is clinging to old and dying bussiness models when they should embrace new ones and stop fighting the inevitable. I completely agree. I also see that the slashdot crowd has a tendency to cling to the more anonymous days before national id's and smart cards. Come to grips with the fact that it will become harder and harder to fake your identity (as it should be) and learn to embrace it. Did anyone ever think that smart cards could come damn close to wiping out identity theft (if used correctly)? Why should I have to get a different drivers license for a new state? Did I forget how to drive? Am I a different person now that I moved? A national id can put an end to the hodge-podge nature of governing in this enormous country. Now, I have always said that "Everyone has something to hide" and I still hold to that for those who say they don't. Don't forget though: Your smart card can encrypt everything you do online and depending on the encryption used, can't be cracked in our lifetime. It is for this very reason that the NSA and FBI desperately attempted (and still do) to prevent the export of RSA encryption abroad -- classifying it as a munition on the same scale as a nuclear weapon. Slashdot is definately a democratic leaning site: It was Bill Clinton who wanted a "clipper chip" back door (read the book Crypto). And, if you want a secret identity, your smart card can support multiple identities. You can have an alternative that only you and your friends in a web-of-trust know about and accept. In real-life I am XXX but on slashdot I am sideswipe76. Freedom of speech has never meant freedom from all consequences of that speech. Look at Martin Luther King -- the man excercised his freedom of speech and brought revolution to the US against the wishes of many of those high-up in government. He also paid with his life not to the government but to James Earl Ray.