ID cards prepare for takeoff
Airports broaden credentialing efforts asCongress and TSA look at security breaches
- By Alice Lipowicz
- Apr 17, 2008
In November, police arrested 23 airport workers
who used fake identification cards to enter
secure areas at Chicago's O'Hare Airport. An
airport contractor had routinely been issuing its
employees old and deactivated ID badges to
avoid security checks.
The fraud was simple but effective.
According to an affidavit, workers were told to
sort through deactivated identification cards to
select those with photographs that most closely
Security breaches such as this are spurring
Congress, airports and the Transportation
Security Administration to move more quickly
toward issuing biometric identification cards to
an estimated 3 million airport employees
nationwide, officials and industry experts say.
"The O'Hare incident caught the attention of
TSA and of Congress," said Walter Hamilton,
chairman of the International Biometric
Industry Association. "If they had biometrics,
they would not have been able to do that at
Airports have issued employee badges for
many years. Now the focus is shifting toward use
of biometrics ? primarily fingerprints and iris
recognition ? in such credentials. Even so, it is
not clear how quickly those technologies will be
deployed, how they will be paid for and whether
the federal government will require them.
Estimates for 3 million cards range into the
hundreds of millions of dollars, sources say.
Transportation worker identification has
been a cornerstone of homeland security for
several years. The Homeland Security Department
began implementing last year
the Transportation Worker Identification
Credential for 750,000 port workers. Lockheed
Martin Corp. won the $70 million contract to
produce a smart card with a chip containing a
fingerprint template and a digital photograph.
It is modeled on Federal Information
Processing Standard 201.PRIORITY PROJECT
Airport employees are likely to be one of the
next large groups to undergo biometric identification
Congress is pushing for 100 percent airport
employee screening, which typically includes an
X-ray for weapons and might also incorporate
biometric identification and a check for suspicious
In January, Congress included a provision in
the Omnibus Appropriations Act to authorize
90-day tests of airport screening to be conducted
by TSA starting in May. TSA will report on
the tests in September.
Biometric identification cards will be part of
the testing at Denver International and Boston
Logan International airports, TSA spokesman
Chris White said, but he added that TSA has
not yet decided whether biometric identification
should be deployed by airports nationwide.
"For employee screening, we are looking at
the entire universe," White said. "Part of that is
biometric, part of it is screening, part is at a
checkpoint, part is remote. It is premature for
us to say what the end state might be."
Meanwhile, an airport consortium has begun
developing a biometric solution on its own.
"This is an airport-driven initiative," said
Carter Morris, senior vice president of security
policy at the American Association of Airport
Executives. "We are looking to start moving it
Colleen Chamberlain, vice president of transportation
security policy at the association, said
the goal is to stay a step or two in front of
Congress and TSA so the airports help shape a
biometric ID card program on their own, with
or without a mandate.
"We don't want a top-down solution from the
TSA but rather something that allows for local
control," Chamberlain said. "We want to do this
sooner rather than later."
Eventually, the airports expect to adopt a
solution compliant with FIPS-201, she said, but
it might have to be adapted somewhat for use
outdoors under harsh winter conditions.
"Do you ask a worker to take off a winter
glove to use the fingerprint scanner outdoors?"
Chamberlain asked. The answer: probably not.INSTALLED BASE
The airport coalition also wants to develop a
concept of operations that builds on existing
solutions, develop a reasonable timeline for
implementation, and identify costs and sources
of financing for the new ID cards, she said.
Participating airports include Atlanta; Boston;
Denver; Jacksonville, Fla.; Miami; Minneapolis;
Port Authority of New York and New Jersey;
Phoenix; Portland, Ore.; San Diego; San
Francisco; and Washington Dulles.
The airports also are working with TSA on its
interoperability project so the identification
cards can be used at more than one airport.
Presumably, they would follow TWIC and
FIPS-201 interoperability models.
Airports are already implementing biometric
identification cards on their own. In a recent
survey of 56 airports, 40 percent said they were using biometrics for identification in some
fashion, Chamberlain said. Most were using
fingerprints or iris recognition, and a few were
trying hand geometry or facial recognition.
Meanwhile, airline pilots also are entering
the fray. The Air Line Pilots Association (ALPA)
held demonstrations in March to prod TSA into
testing a separate ID check procedure for pilots.
The proposed procedure, called CrewPass, is
described in a white paper released last year.
Pilots and flight crews go through physical
screenings along with passengers. The pilots'
group said it would prefer a separate screening
in which the pilot would display photo identification
to a TSA screener, who would then check
the card against a database of photographs and
"Pilots are tired of being 'strip searched,'" said
Peter Janhunen, an ALPA spokesman. "It is
degrading, demoralizing and disrespectful, and
it treats them like a terrorist threat."
TSA has approved CrewPass for testing.
The airport ID cards will operate differently
from TWIC, Hamilton said. For one thing, the
credentials will be issued by the airports rather
than through a central authority. For another,
they are likely to be swiped at thousands of
access doors and gates rather than a handful of
manned gates as is the case at seaports.
If TSA approves a general biometric credential
for airport employees, it likely would apply
to 2 million to 3 million employees, Hamilton
said. Cost estimates are expected to be in the
hundreds of millions of dollars, and it is not
immediately clear who will pay.
"There is a lack of clarity on the funding," said
Raj Nanavati, a partner at the International
Biometrics Group consulting firm. "Funding
will be the key."Alice Lipowicz (firstname.lastname@example.org) is a
staff writer at Washington Technology.
Alice Lipowicz is a staff writer covering government 2.0, homeland security and other IT policies for Federal Computer Week.