Government Smart-Card Project Hits Snags on Fingerprints, Costs

Source: Washington Post
By Stephen Barr

The government’s smart-card project appears at risk of falling behind schedule.

Federal agencies are supposed to begin issuing government-wide identification cards that can vouch for the identity of federal employees and most contractors in October, but the Government Accountability Office warns that setting up and testing new ID systems may not be completed within deadlines set by the Bush administration.

The GAO reviewed the progress of six agencies in developing smart-card systems and found differences in implementation plans, which could hamper efforts to create a government-wide ID card accepted by all agencies. The congressional watchdog agency also found a lack of reliable information about the costs of buying cards and equipment and modifying software systems.

“We acknowledge much more work must be done in order to be successful,” the Office of Management and Budget said in a letter accompanying the GAO report. The letter was signed by Karen S. Evans , who is in charge of technology policy at the Office of Management and Budget.

President Bush launched the smart-card project in August 2004, calling for more secure and reliable forms of identification for government workers as part of a broader effort to keep terrorists, criminals and other unauthorized people from getting into federal buildings or hacking into computer systems.

Federal employees are issued a variety of ID cards, and many can be easily forged or altered to gain access to federal buildings. Some agencies, such as the departments of Defense and State, have developed versions of smart cards for many of their employees.

Smart cards, which resemble plastic credit cards, are embedded with a computer chip that permits an exchange of data with another system. The card can store biometric information, such as fingerprints, and can track where a person goes, based on clearances through security checkpoints. In addition to building access, smart cards can be used to supplement passwords for logging onto computers, with users inserting the card into readers on their desktops.

Under the federal project, cards must display the name of the government employee or contractor, a photograph, the name of their agency or affiliation, a serial number, and an expiration date.

There is no estimate of how many smart cards will be handed out across government (although the Defense Department has said it plans to issue 3.6 million cards to the military, civil service, contractor and other employee groups).

The administration’s timetable requires agencies to start issuing cards Oct. 27 and to verify or complete background investigations on employees and contractors in 2007 and 2008.

But the project has hit some snags. The original guidelines called for the cards to carry electronic representations of two fingerprints, but the GAO said agency officials have objected because reading two fingerprint images will require a large amount of computer memory.

The GAO report said it could take 30 seconds to read the fingerprints, “a length of time that would likely cause unacceptable delays in admitting individuals to federal buildings.”

Some agency officials prefer to store only details of the ridges in a fingertip, which would cut the transmission time between the cards and card readers to less than 10 seconds. But GAO said that the partial images are of “questionable reliability” and that vendors use techniques that are “proprietary and incompatible.” Efforts are underway to resolve the matter, GAO said.

The cost of converting ID systems, however, may be one of the largest problems facing the government. The GAO said some agencies may find it difficult to cover conversion costs out of existing budgets.

“Agencies have been faced with having to potentially make substantial new investments in smart card technology systems with little time to adequately plan and budget for such investments and little cost information about products they will need to acquire,” the GAO said.

Stephen Barr’s e-mail address isbarrs@washpost.com.
2006 The Washington Post Company