Tight schedule set for HSPD-12

The first large-scale test of the technology that will put Homeland Security Presidential Directive-12 into practice is slated to be in place by Oct. 20.The General Services Administration set the timeline for a contractor to test and deploy an enrollment and card production system over the next three months, and then install the system at multitenant federal buildings in Atlanta, New York, Seattle and Washington.HSPD-12 mandates the use of standard, interoperable identity cards for government and contractor employees. The cards must have enhanced security features, including biometrics and digital certificates.Some industry experts warn that, although the technology is not complicated, putting the pieces together in one place raises red flags, one of them being the kinks inevitable when doing something for the first time.Still, GSA expects contractors to be ready to meet the three milestones outlined in a recent request for proposals issued on FedBizOpps.gov late last month. Proposals were due by July 19."The government is convinced that industry is prepared to deliver an integrated HSPD-12 enabling system," the RFP said. "Additionally, the government accepts industry's assertion that compliant systems" are ready.Based on the responses the agency received from a request for information late last year, GSA believes that industry is ready to provide a "soup-to-nuts" system that complies with Federal Information Processing Standard 201-1. The agency last month approved General Dynamics Corp., Lockheed Martin Corp. and XTec Inc. of Miami to provide end-to-end services."We are qualifying vendors based on their past experience with government or commercial biometric and identity management systems," said David Temoshok, GSA's director of identity policy and management. "We are not performing a system review."The fact that GSA is not reviewing systems worries some industry experts."Vendors who will be able to get all the pieces put together and working deserve a lot of credit," said Randy Vanderhoof, executive director of the SmartCard Alliance, an industry association in Princeton Junction, N.J. "There are a lot of pieces that haven't been put together in one system and operating under the new specification. This is going to be a challenge for anyone."Because agencies and contractors have never before assembled this type of system, contractors likely will find that some things have been overlooked, he said."There will be a significant amount of validation of a lot of assumptions," Vanderhoof said. "The timelines are tight, but vendors who did Registered Traveler [for the Transportation Security Administration] got the first airports up in a matter of weeks."The National Institute of Standards and Technology earlier this year tested end-to-end systems, proving that they work, GSA's Temoshok said.But the challenge is not so much the technology or the processes, but any one system's ability to work with other agency systems, said Jeremy Grant, a senior vice president and emerging technologies analyst for the Stanford Washington Research Group of Washington and a former executive at Maximus Inc. of Reston, Va.The difficulty will come when the HSPD-12 system has to trade data with systems at the Office of Personnel Management for vetting employees, which includes the FBI's fingerprint check, as well as agency human resources systems, he said.In questions and answers from a recent industry day on the RFP, GSA officials said users must access the front end of the system via a browser using Web services and Simple Object Access Protocol interfaces.The Simple Object Access Protocol is used when exchanging Extensible Markup Language messages over computer networks and was designed to work well with network firewalls. The back end, GSA said, must also be accessible via the Web. Systems also must have an XML gateway using Simple Object Access Protocol to allow multiagency use.Not everyone in the IT industry is worried about meeting GSA's milestones."Essentially, the government is saying to industry: Put your money where your mouth is," said Scott Price, a group senior vice president of the technology solutions group for General Dynamics' IT division. "There is some risk involved, and it will take a good bit of collaboration between the vendor and agencies, but this is doable."General Dynamics plans to bid on the RFP, as does EDS Corp. and Lockheed Martin, according to company officials.Other companies that attended the industry day and are likely bidders include BearingPoint Inc. of McLean, Va., Science Applications International Corp. of San Diego, SRA International Inc. of Fairfax, Va., and XTec.Storage will be a challenge, Price said. The system will have to connect to different databases and pull and push information to those repositories, he said.That could be a major sticking point for getting agencies to use a shared-services provider, said Stanford Washington's Grant."From what I've heard, a lot of agencies said the shared-services concept sounds nice, but they are not sure it reflects what they are doing," he said.But with the Office of Management and Budget requiring agencies to use shared services or justify why they would not, many agencies will have no choice but to make the move.OMB also is touting the savings to be had through use of shared-services providers."The government estimate of savings by doing a large-scale shared service versus agencies doing it independently is 3 to 1," said Chris Niedermayer, chairman of OMB's HSPD-12 Executive Steering Committee. "The savings come from each agency not having to buy an identity management system, and the volume discounts when you buy a million public-key infrastructure certificates."The RFP is designed to let GSA figure out who is qualified and to run a test in the four cities, Niedermayer said."We want to knock out a few feds across a bunch of agencies and if all goes well, then we would look to expand it and make it a key model for shared-services providers," he said. "Nonmandatory shared services have a great cost and overhead benefits and we will prove it."Jason Miller is an assistant managing editor with Government Computer News. He can be reached at jmiller@postnewsweektech.com.