PIV cards on the horizon

Six months from the deadline for issuing interoperable smart federal ID cards, standards and specifications are in place. Now the heavy lifting is about to begin.

"Now we face the daunting task of meeting the presidential requirements," Judith Spencer, chairwoman of the Federal Identity Credentialing Committee, said Thursday at the GovSec conference in Washington.

The committee last week released an architectural concept for implementing the standards spelled out by the National Institute of Standards and Technology in a series of publications developed in the last year. The next step is to define exactly how the processes identified in the architectural concept for issuing and maintaining the cards will operate.

"We're trying to have the whole thing done by early summer," in time for agencies to meet the Oct. 27 deadline for beginning issuance of the cards to 4.5 million federal workers and contractors.

Personal Identity Verification cards were mandated in Homeland Security Presidential Directive 12, issued in August 2004. The cards will contain integrated circuit chips, as well as biometric and cryptographic data, and will be interoperable between agencies. It also specified a short timeline without funding.

"We're supposed to do it very fast, for free," said Curt Barker of NIST, who has helped in the development of the technical specifications and standards.

Consultant Jim Litchko said the PIV program is notable for not moving at traditional government speed. "This effort is very different from any other effort I've seen in government," he said. "It's moving fast."

"We're getting there," Spencer added.

Two products have passed conformance testing for Federal Information Processing Standard 201. More challenging than getting the needed hardware and software are likely to be the jobs of setting up a system for issuing the cards. Cardholders, who are scattered across the globe, will have to appear in person twice in the process, to have identity verified and to receive the finished card.

"This is probably the biggest-ticket item," Spencer said of the enrollment services.

Printing and populating that many cards will also be a challenge. Spencer said the single-site printing model being adopted for the Homeland Security Department's Transportation Worker ID Cards should be considered for PIV cards.

"We think that is a very good idea" because it allows high quality and security that is cost-effective. "We advocate a centralized card-printing capability, not necessarily a single location. We don't think that will work for the government."

There will no end-point for the program, because cards will have to be maintained and reissued regularly.

"We know that smart cards have an average life of three to five years," Spencer said.

William Jackson is a staff writer for Washington Technology's sister publication, Government Computer News.