A Major Driver

On August 27, 2004, the White House issued Homeland Security Presidential Directive 12 (HSPD 12) entitled “Policy for a Common Identification Standard for Federal Employees and Contractors” which directed the promulgation of a U.S. Federal Standard for secure and reliable forms of identification for Federal employees and contractors doing business with the government.  Subsequently, the U.S. National Institute of Standards and Technology (NIST) released their Standard 201 for “Personal Identification Verification (PIV) of Federal Employees and Contractors.”  This Standard meets the security requirements of HSPD 12 and specifies the use of smart cards in a Federal personal identify verification system.  Major changes are coming in all departments of the Federal government.  These changes will quickly be incorporated into the global business world, especially for those companies doing business with the U.S. government.

Other governments outside the U.S. have also implemented or are planning secure ID card programs.

•  Turkey is issuing secure IDs to members of its armed forces that will store monetary value, health records, secure access rights, and digital signature.
•  India is planning to issue secure ID cards to migrant workers containing ID, employment, and insurance data. 
•  Saudi Arabia and Italy are implementing national IDs for all citizens of their respective countries.
•  Israel issues IDs with biometric data for a border crossing project that regulates admission points between Israel and the Palestinian Authority.

Security No Longer Left to Evolution

Up to the time of the 9/11 tragedy, changes to the ID card business were evolutionary and little attention was paid to either physical or data security issues.  Numerous technologies were developed to improve security but implementation of these capabilities was not considered mandatory by either government or businesses.  That has now changed forever.  Secure identification is now important at a new level such that, within the bounds of a cardholder’s reasonable convenience, no level of security is unreasonable.

Some of the more prevalent technologies we expect to see employed in these developing secure ID programs are:

•  Smart card, both contact and contactless
•  Biometric elements, both digital and physical
•  Secure inks and overlay
•  Public and private key generation, encryption
•  Encrypted data communication Making the issuance process as secure as the ID

While implementing new, secure ID standards, attention has to be paid to the way in which the IDs are issued.  A secure card issuance process must complement -- not detract from -- the security of the entire ID program.  New security requirements speak to operations that issue IDs from a central location as well as to those that issue IDs from satellite locations.

Essentially, four axioms of secure card issuance must be followed in order to foster security:

•  The card has to meet the program’s security requirements regardless of how and where it is issued.
•  Card formats have to be identical whether they are issued from a central facility or from a distributed location.
•  Focus must remain on the function and benefits of the card itself, rather than solely on the way in which it is distributed.
•  The process of replacing cards must be a serious part of the implementation of the card system.

Security No Longer an Option

The security of government ID cards and ID card issuance is definitely under the microscope.  While ID “Security” may have long been an objective, a secure standard is now being specified with great detail and urgency.  Indeed, not only the type of card technology the government specifies, but also the process for distributing those cards is under scrutiny.  Given the events of 9/11, most people are clear on the real, potential benefits of controlling the security and issuance of national IDs, driver licenses or employee IDs that grant dual access to buildings and computer networks.

David Tushie is an industry veteran, who, with John Stearns, formed Magellan Consulting, Inc. (www.magellan-consulting.com), dedicated to providing consulting services to all aspects of the card industry.  Services range from card issuance systems to card operations; from key management and ID security to smart card issuance and card management.

※ This article has been reprinted from ID Solutions by Fargo Electronics (www.fargo.com).