Slashdot Mirror
Feds Start Small on Smart IDs
jcatcw writes "Some government employees will be getting smart ID cards beginning this week. The unfunded mandate to have all employees and contractors use Personal Identity Verification (PIV) cards is part of Homeland Security Presidential Directive 12. The U.S. General Services Administration is providing enrollment centers that can verify the identities of employees, fingerprint and photograph the workers, and issue PIV cards to them. The deadline for getting cards to all employees and contractors is the end of September 2008."
I have no problem with smart IDs themselves; but if they're RFIDs there's going to be trouble. Hopefully a few exploits will be tried while the system is being rolled out so our wonderful government regulators will realize there's a problem.
What's the alternative to RFIDs? Well, the alternative to contactless is non-contactless. You may remember the original American Express Blue cards with the little copper pads on one side. Similar "smartcard" technology has been used by other card makers, especially in Europe.
So what's the difference? The difference is that RFIDs can be accessed without one's notice, and it's difficult to determine whether or not you're safe. The RFIDs in US passports, meant to be accessed at a distance of no more than a few inches, has been read at distances of a few feet and detected from dozens of feet away. Do you want to advertise you're carrying around your valuable passport? I don't.
The U.S. General Services Administration is providing enrollment centers that can verify the identities of employees, fingerprint and photograph the workers, and issue PIV cards to them.
And as they have proven without a doubt, once they roll this out to the general population, it will be completely impossible for anyone with bad intentions to obtain fraudulent ID, and terrorism will be defeated.
Push Button, Receive Bacon
I'm DoD and got my mandated Common Access Card over a year ago. We PKI enabled almost everything. Besides a few inevitable rollout inconveniences (ran out of blanks once, way more people forgot their PINs than they expected, end user training and confusion) it was actually a VERY smooth transition. I'm glad they did it, I honestly think we are more secure because of it (server side, not client side)
Just laying the groundwork, making sure things all blur together so it's hard to oppose them. Presidential Directive 12: ID cards. Presidential Directive 13: Hugging Puppies Initiative. ... Presidential Directive 41: "I am Emperor of Earth." Presidential Directive 42: Increase fines for littering by 3%.
On a related note, George W. has ridden the mighty moon worm.
And note to self: "The Mighty Moon Worm" is a great name for both an amusement park ride and a marital aid.
Step by step is how it happens- so subtle you don't even realise until it's too late.
It's starting to get late, heading towards too late soon.
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
I've worked as a contractor for the Federal Government and the City of New York (which considers themselves a Federal Government). Most of the agencies I worked at had security that was an absolute joke. I'll give the guys at the DoE/Forrestal Building some credit as well as the Department of Juvenile Justice in NYC , they actually asked questions and took their jobs seriously. (The DoJJ guys in New York are the only ones who have flat-out denied me entry... no matter how much smooth talking I did. For whatever reason, the guards I came across took protecting the identities and lives of the children in overseen by the agency very, very seriously and I have the utmost respect for them because of it.) Most of the other security guards were too concerned about talking about the caboose of the last woman to walk through the metal detector.
/looking for the black helicopters
The point is, no amount of technological or physical security is going to do any good if the people entrusted with its implementation are not trained to do their job properly or take it seriously. The only "serious" contracts I worked were at DoE but at the rest of the agencies I had access to enough information to financially ruin a good number of the people in the United States. Thankfully I worked with people who took that responsibility as seriously as I did but I can't help but feel that was through luck of the draw and not the success of the system.
Smartcards/RFID make sense if they going to be used and implemented properly (e.g. you picture is on the card and encrypted with a public key system so that the agency can verify that it's authentic and not a clever forgery... and the people at the desk care enough to actually check)... otherwise it's just another way for contractors/etc to make money and a waste of everyone else's time.
The same. We have a competent IT staff, haven't had any major snafus really. Mostly problems between the keyboard and the chair :)
Slick system, login via CAC card (common access card) with a PIN. Emails can be encrypted with a digital signature. When online training is completed it is automatically added to your record and signed with your key. Very slick system.
In case anyone cares to actually LEARN what it is rather than just ramble on about how horrible the world is:
http://csrc.nist.gov/piv-program/index.html
It's a very sensible document (and HSPD12 is just the mandate, FIPS201 is the implementation). All it does (ALL) is say "agencies need to have a process in place to make sure Joe is Joe, and they need to give him a card that says he's Joe, and it needs to look like this."
It doesn't actually go further than that. It outlines an interoperable infrastructure based on dirt simple, well understood, highly tested smart card stock, lays out minimum requirements for readers, and puts a system certification process in place. The "tech" part of this is really quite simple and boring for anyone who's spent more than 10 minutes thinking about PKI or smartcards.
The much much more important part of this is the credentialling part (PIV-1) which has been in place for a year. This establishes clear lines of responsibility and clear processes for actually establishing that Joe is Joe, and at least an attempt to make sure that, say, the Defense Manpower Data Center is using the same process as the Janitor's closet in the Department of Education. This is a GOOD THING people. It's about breaking down silos and creating (gasp) an open standard for strong(er) authentication.
That's right folks, an open interoperability standard sponsored by the US of A. Wanna make sure your corporate ID is just a wee bit futureproof? Read the FIPS201 docs and mimic the data model and tech requirements.
OK, back to the sarcasm laced punditry. Thank's for playing.
As long as these IDs are only being used ... It's only when Fancy-Schmancy National ID Cards(TM) become mandatory that we need to start worrying.
Maybe you're not familiar with how to enroll a technology/change/law/regulation etc. that is wildly unpopular with the population.
And you do it, by enforcing it gradually. First to the most loyal circle of people, then wider and wider, gradually, quetly, setting a trend and preventing any mass outbreak against it.
As the amount of people with IDs grow, you now have some "passive support" from them when trying to enforce it on the rest. That is: they don't care if they have ID or not, and maybe they in fact would rather not, but if they would, then why the rest would have the privilege to be ID-free?
You don't have to look far to see how this works: see taxes. Noone likes to pay taxes, yet if someone (especially rich) is revealed to have hidden some of his taxes, the whole nation jumps against him, since they have to pay all those taxes, why not he?
But what about this step is alarming? You can't just wave off ALL security measures because they might someday lead to a police state.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
I hate to say it but anyone who carries a cell phone is trackable. In fact, were using the internet right now. Trackable. It's all possible, and no one is safe from wrong-doings. But we can't phase out technology just because it's "Trackable". History tells us that in fact that this WILL be used for wrongdoings by government. It's a matter of WHEN it gets out of hand. And it will. Stay alert and cautious.
How the hell did I get such bad karma? I blame the meds...