A matter of funding

To hear Mark Penn tell it, first-responder identification cards are a great idea, but the question is whether and how much communities and the federal government are willing to pay for them. Credentialing-system vendors are now offering fresh approaches to solve that challenge.Penn, emergency management coordinator for Alexandria, Va., helped organize two high-profile demonstrations of the credential. Alexandria, Arlington County, Va., other jurisdictions in the Washington area, the Virginia state government and the Homeland Security Department tested the credentials in the disaster drills Winter Fox in February 2006 and Summer Breeze in July.The tested credential conforms to the Federal Information Processing Standard 201 developed for government employee ID cards. Although that FIPS-201 standard offers numerous benefits, including interoperability with cards from different vendors and security and privacy, it also comes with a price many state and local agencies consider to be hefty.For example, Alexandria has issued about 600 credentials to police, fire, emergency medical, sheriff and city emergency operations employees with the help of state and federal funding, but further growth in the program is not realistic because of high costs, Penn said. Similar cards cost $82 each per year under a program for federal employees, but local communities would spend more because they do not have a support infrastructure in place."We would love to expand the program, but there is no funding," Penn said. "It is a good program that has proven its worth, but until we get funding, we cannot go forward." Overcoming that hurdle affects first responders nationwide. The specialized ID card market covers about 2.5 million police, fire and emergency medical employees nationwide, but vendors say it potentially could be expanded to more than 10 million people if it includes city officials and utility, communications and public works employees who may need access to disaster scenes.The responder ID card program has been on the drawing board for years but has yet to develop momentum. The goal is for police, fire and emergency medical employees to have an ID card that can be checked at the perimeter of an incident scene to verify their qualifications and affiliation. Ideally, such a card would help account for all responders at the scene and deny access to individuals who are unqualified to help or who may slow rescue efforts.To date, however, no national plan has been developed for implementing such a credential. Under the 9/11 legislation approved by Congress in July, the Federal Emergency Management Agency is drawing up a strategy for credentialing response employees nationwide, and some DHS grant dollars are available to sponsor credentialing projects ? one is happening in the Pittsburgh area."The First Responder Accreditation Credential is a concept, not a full-blown program with congressional support," said Jeremy Grant, an identity solutions analyst and senior vice president at Stanford Group Co., a financial services firm in Washington. "Until there is a dedicated stream of funding, it will be hard to develop the market."While they await plans and funding from FEMA and Congress, vendors are taking up the challenge on their own."We are still in the early stages on this," said Rick Sullivan, director of U.S. government application services and solutions at EDS Corp. "The biggest factor is cost. What is the market willing to pay? As you go to the local level, the amount of dollars available for the credential go down." Nonetheless, EDS sees a significant opportunity in the marketplace to fill a need with the cards, he said.One solution might be expansion of the General Services Administration program to manage services for government employee ID cards to first responders nationwide. Another idea would be for states to coordinate first-responder IDs with other ID card programs to gain economies of scale, Sullivan said. In June, GSA began offering the cards and maintenance at $82 per card annually.FIPS-201 is not a one-size-fits-all solution, said Carey Miller, senior manager in the secure identity management solutions unit at BearingPoint Inc. With high expenses for setting up infrastructures to support the first-responder card, it might be prudent for communities to use existing systems for building access and control, she said.Another idea is being advanced by a newly formed consortium, Tiers of Trust, led by companies including HID Global Corp., a smart-card company, and PGP Corp., a security products company. The group is promoting first-responder ID cards at various levels of cost and security. They claim to cost less than a typical FIPS-201 card because they offer fewer features. For example, one version being offered for sale is an ID card with a contactless interface rather than the dual interfaces outlined under FIPS-201."This is a blended solution," said Betty Pierce, president of Secure Network Systems LLC, in Denver, a provider of IT solutions, and a spokeswoman for Tiers of Trust.Another area of potential and significant cost savings is how digital certificates are purchased. A certificate validates the credential of the cardholder. The certificates with the highest confidence may be purchased through a shared-services provider approved by the Federal Bridge Certification Authority. But Tiers of Trust suggests that those costs could be reduced with a state-administered or locally administered certificate authority.But other vendors and DHS officials are leery of departing from the FIPS-201 standards. Even though FIPS-201 is not required to obtain grant money for responder ID cards, it is a highly effective standard that ensures interoperability and effective operation, they say."I would be careful of any claims," said Randy Vanderhoof, executive director at the Smart Card Alliance, an industry group. "FIPS-201 seems like the way to go. It achieves the goals of the first-responder ID card.""FIPS-201 is a backbone," said Kenneth Wall, director of the Office of National Capital Region Coordination at DHS. "With the federal government going to that standard, it makes a lot of sense. It is a natural platform for us."But uncertainties remain, especially with no national plan in place. There is also ongoing work at FEMA to classify attributes of responders ? such as beginner firefighter, hazmat firefighter, advanced rescue firefighter, etc. ? as part of the credentialing.Nonetheless, even though the first responders are not moving quickly and grant money is not yet forthcoming, people perceive it as a big opportunity."I see things heating up to the point that we are putting a priority on standing up a solution in this market," said Tony Damalas, vice president of technology at Diebold ActCom Security Systems in Virginia Beach, Va., a unit of Diebold Inc."The prices will come down over time," said Charles Durkin, chief operating officer at Probaris Inc., an identity solutions provider in Philadelphia. "DHS grant money will help defray the costs."