Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×

Feds Start Small on Smart IDs 92

Posted by Zonk from the small-start-leads-to-big-ending dept.
jcatcw writes "Some government employees will be getting smart ID cards beginning this week. The unfunded mandate to have all employees and contractors use Personal Identity Verification (PIV) cards is part of Homeland Security Presidential Directive 12. The U.S. General Services Administration is providing enrollment centers that can verify the identities of employees, fingerprint and photograph the workers, and issue PIV cards to them. The deadline for getting cards to all employees and contractors is the end of September 2008."
This discussion has been archived. No new comments can be posted.

Feds Start Small on Smart IDs More

Feds Start Small on Smart IDs

Comments Filter:

  • So what? (Score:2, Insightful)

    by Footix ( 972079 )
    As long as these IDs are only being used to keep unauthorized people out of government buildings, there's nothing wrong with that - everybody should have an employee ID card anyways. It's only when Fancy-Schmancy National ID Cards(TM) become mandatory that we need to start worrying.

    • Re:So what? (Score:5, Insightful)

      by rts008 ( 812749 ) on Saturday October 21, 2006 @08:29PM (#16532479) Journal
      Step by step is how it happens- so subtle you don't even realise until it's too late.

      It's starting to get late, heading towards too late soon.
      • That's it. Even if there's no big plan beind it. Your post should have a score of 6

      • Re:So what? (Score:4, Insightful)

        by MightyYar ( 622222 ) on Saturday October 21, 2006 @09:53PM (#16532901)
        But what about this step is alarming? You can't just wave off ALL security measures because they might someday lead to a police state.
        • You can if you're a fanatic. Fanaticism on either side of the issue is a danger.

        • Re: (Score:2)

          by dwandy ( 907337 )
          When it comes to security (of all kinds) the question isn't "what's the harm if we do this?" but "what's the reward for doing this?"

          So what exactly is the purpose of finger printing gvt employees? are they criminals now? they've already (presumably) done a background check and it was obviously ok (else they would not be there, right?)

          First off every action has some potential risk, and every action that erodes rights and freedoms does increase the risk (by increasing the acceptance) of a police state.
          Sec

          • Re: (Score:3, Insightful)

            by MightyYar ( 622222 )

            First, I want to compliment you on your well-crafted reply. I think that your points are valid - though it may be necessary to have SOME kind of biometric entry system. I think that recording an iris-print, for instance, is probably less of an invasion of privacy for the employees, and less prone to abuse since they are pretty useless for anything except security. They also do not carry the "criminal" stigma of fingerprints, and couldn't be spoofed as easily.

            I think that biometric entry is SUPPOSED to impr

            • Re: (Score:2)

              by dwandy ( 907337 )
              since AFAIK federal employees are already fingerprinted as part of their background check
              aaah ... not here in Canada ... this explains why everyone is talking about the ID card, and not the fingerprinting...

              Thanks!

      • Sooooooo, are you saying I should get rid of my ID badge I wear at work?

        No, seriously I understand you are frightened of the government getting too big for its britches, I just wonder if you really think that ID badges at work are a bad idea, or just for the government.

        I hope you are three times as frightened at the idea of the government taking over health care (I mean even more than it already is).

    • Re:So what? (Score:4, Insightful)

      by suv4x4 ( 956391 ) on Saturday October 21, 2006 @09:51PM (#16532887)
      As long as these IDs are only being used ... It's only when Fancy-Schmancy National ID Cards(TM) become mandatory that we need to start worrying.

      Maybe you're not familiar with how to enroll a technology/change/law/regulation etc. that is wildly unpopular with the population.

      And you do it, by enforcing it gradually. First to the most loyal circle of people, then wider and wider, gradually, quetly, setting a trend and preventing any mass outbreak against it.

      As the amount of people with IDs grow, you now have some "passive support" from them when trying to enforce it on the rest. That is: they don't care if they have ID or not, and maybe they in fact would rather not, but if they would, then why the rest would have the privilege to be ID-free?

      You don't have to look far to see how this works: see taxes. Noone likes to pay taxes, yet if someone (especially rich) is revealed to have hidden some of his taxes, the whole nation jumps against him, since they have to pay all those taxes, why not he?

    • This is a test program for National IDs (Score:1, Interesting)

      by Anonymous Coward
      You deploy them first to government employees, desensitize the public to them, then roll them out to the entire nation. Note they said "and contractors". Contractors are civilians.

      We already have a National ID system, through various coordinated data through Drivers Licences, tax filings, SSN cards, Credit Cards, Voter Registration, and the like. Mainly Drivers Licences. Have you tried to get one renewed in the last 4 years? They require your fingerprint, even though you are not a criminal. Once they

    • Re: (Score:3, Informative)

      by JimBobJoe ( 2758 )
      everybody should have an employee ID card anyways

      They should? Why? What exactly is achieved?

      The only circumstance I think it's justifiable is hospitals and other situations in which there's a lot of employees mingling with non-employees. Even then, I think I might be justifying that psychologically because I can't find any other logical basis for the card.

      I've cautioned against employee ID cards with the name/logo on the card. I believe this presents a major liability problem if the employee (or someone els

      • Re: (Score:1)

        by KDR_11k ( 778916 )
        Wouldn't the guards start just ignoring that data and let anyone in that has a piece of paper looking roughly like a valid ID?

  • RF (Score:4, Insightful)

    by TheSHAD0W ( 258774 ) on Saturday October 21, 2006 @08:17PM (#16532379) Homepage
    I have no problem with smart IDs themselves; but if they're RFIDs there's going to be trouble. Hopefully a few exploits will be tried while the system is being rolled out so our wonderful government regulators will realize there's a problem.

    What's the alternative to RFIDs? Well, the alternative to contactless is non-contactless. You may remember the original American Express Blue cards with the little copper pads on one side. Similar "smartcard" technology has been used by other card makers, especially in Europe.

    So what's the difference? The difference is that RFIDs can be accessed without one's notice, and it's difficult to determine whether or not you're safe. The RFIDs in US passports, meant to be accessed at a distance of no more than a few inches, has been read at distances of a few feet and detected from dozens of feet away. Do you want to advertise you're carrying around your valuable passport? I don't.

    • Re:RF (Score:4, Insightful)

      by CosmeticLobotamy ( 155360 ) on Saturday October 21, 2006 @08:22PM (#16532425)
      Hopefully a few exploits will be tried while the system is being rolled out so our wonderful government regulators will realize there's a problem.

      When has proof that a system doesn't work and is dangerous ever convinced a large group of politicians not to scale it up?

    • Re: (Score:2, Interesting)

      by LiquidCoooled ( 634315 )
      I agree with this and hoped that these would be smart cards as we currently use in the uk for bank cards (contact based connection to an embedded chip), but alas, they are using a multifunction card with RFID built in.

      They are leaving it open for additional uses later.

      The DHS is using ID One Cosmo smart cards made by Nanterre, France-based Oberthur Card Systems SA. Like all PIV cards, Oberthur's feature both a contact interface, such as a magnetic stripe, and a contactless radio frequency interface to make

    • Re:RF (Score:4, Insightful)

      by EtherealStrife ( 724374 ) on Saturday October 21, 2006 @09:40PM (#16532821)
      Um...HELLO? A relative of mine works at the local city hall (which adjoins the police department) and she's had an rfid card for the entire time she's worked there (over 15 years). The RFID battle is over for state/govt employees, it happened a LONG time ago.

      In California a huge chunk of the population (myself included) has FasTrak [wikipedia.org]. It allows automated toll processing for FasTrak lanes on freeways (carpool for the socially challenged) and for access to dedicated toll roads.

      As much as I hate Bush, this is technology that has been in *use* for longer than he's been in office. Worry when they're mandatory for Average Joe, but until then this is old news.

      • Re: (Score:2, Interesting)

        by fintler ( 140604 )
        I work for the Dept of Veteran Affairs. The only change that happened (about 2 weeks ago) was the replacement of my picture id card and a hid card (rfid) with a single picture id card and rfid card combo. The only news here is that the government is making it harder for federal employees to loose their card. Now we only have one card instead of two. In addition to having an rfid card, we also have a 6-8+ digit number that we need to type into a keypad to get into more secure areas (data center, pbx room, et

      • Re: (Score:2)

        by duerra ( 684053 ) *
        Does FasTrak allow you to use the system anonymously? In other words, can you credit your account without having to associate your transponder or whatever with your identity?
    • PIV is a NIST standard. Not set in stone, but they are pretty far along.

      Contactless was out because they wanted to use proper PKI. Cryptographic functions over contactless card is too slow.

      The Government Printing Office was supposed to subcontract the entire print/perso process to be run in one of their facilities.

      I wonder who's software they are using? Anyone have any info?

      Bearing Point "handles" the CAC card. I would be very interested to see how much of the whole project was awarded their contracts wi

  • can you feel the sarcasm? (Score:4, Funny)

    by macadamia_harold ( 947445 ) on Saturday October 21, 2006 @08:18PM (#16532381) Homepage
    The U.S. General Services Administration is providing enrollment centers that can verify the identities of employees, fingerprint and photograph the workers, and issue PIV cards to them.

    And as they have proven without a doubt, once they roll this out to the general population, it will be completely impossible for anyone with bad intentions to obtain fraudulent ID, and terrorism will be defeated.
  • Either that site is running a pathetic site, way too much code, or it's being slashdotted because it's running really slow...

    No info on how the cards are "smart" I see...would've been nice to have something like that thrown in there, but it is an intreging article. Personally I think it's a great idea how they're starting the implementation, giving the cards to government employees pretty well eliminates the majority of the complaints as they'll get tested on people who work for the people doing the testing
  • "from the small-start-leads-to-big-ending dept." How unusual is it for an employer to have some sort of an identity card scheme and why is it that this will no doubt inspire all sorts of comments about government privacy violations?
  • Homeland Security Presidential Directive 12


    Did they run out of ironic program and directive names? I mean, come on. Homeland Security Presidential Directive 12? What about Security Initiative for the Protection and Valid Identification of Selected Individuals for the Protection of Families and Children of America? No one could say no to that!

    • Re:Homeland Security Presidential Directive 12? (Score:4, Funny)

      by CosmeticLobotamy ( 155360 ) on Saturday October 21, 2006 @08:28PM (#16532471)
      Just laying the groundwork, making sure things all blur together so it's hard to oppose them. Presidential Directive 12: ID cards. Presidential Directive 13: Hugging Puppies Initiative. ... Presidential Directive 41: "I am Emperor of Earth." Presidential Directive 42: Increase fines for littering by 3%.

      On a related note, George W. has ridden the mighty moon worm.

      And note to self: "The Mighty Moon Worm" is a great name for both an amusement park ride and a marital aid.
      • PD12 is about getting all federal agencies down to 1 process of identification -- a unified system -- so that you don't have 7 cards for 4 agencies, with 3 pictures and 5 different finger prints taken by different agencies. I am strongly anti-bush, but you are just way barking up the wrong tree. I actually work on the project for NIST.
    • Directive 12, we've got a long way to go 'til we get to Directive 10-289, but I have a feeling it's not far off.

  • I've had mine for a year (Score:5, Interesting)

    by superid ( 46543 ) on Saturday October 21, 2006 @08:26PM (#16532453) Homepage
    I'm DoD and got my mandated Common Access Card over a year ago. We PKI enabled almost everything. Besides a few inevitable rollout inconveniences (ran out of blanks once, way more people forgot their PINs than they expected, end user training and confusion) it was actually a VERY smooth transition. I'm glad they did it, I honestly think we are more secure because of it (server side, not client side)

    • Re: (Score:2, Insightful)

      by MysticOne ( 142751 )
      I was going to say the same thing. I'm a contractor and just started working with the DoD in April, and I have a Common Access Card as well. I don't know if other bases are using them in the same manner, but we even use them for base access now (unless you're somebody who, for some reason, doesn't get one).

      • Re: (Score:3, Interesting)

        by Zackbass ( 457384 )
        I worked at a base this summer and had to get one for physical and computer access and was pretty impressed with how they were handled. They were taken very seriously from a security standpoint and had few technical problems.

    • Yup (Score:4, Insightful)

      by everphilski ( 877346 ) on Saturday October 21, 2006 @08:56PM (#16532643) Journal
      The same. We have a competent IT staff, haven't had any major snafus really. Mostly problems between the keyboard and the chair :)

      Slick system, login via CAC card (common access card) with a PIN. Emails can be encrypted with a digital signature. When online training is completed it is automatically added to your record and signed with your key. Very slick system.
      • Actually, you encrypt with THEIR public key and not your signature. Your signature is a Private Key operation. The PIV Card is a huge improvement over the CAC cards.
    • PIV and CAC aren't the same thing? Isn't the PIV FIPS 201 standard used to define a card that can be used across federal government and contractors? The Common Access Card, if I'm not mistaken, is only used by the department of defense.
    • The only problem is that when you enter the wrong PIN 3 times your card locks. With the normal login they can call to have it unlocked, or just wait to have it unlock itself. With these card they have to go to a PIN reset station. For some sites this means traveling 2-3 hours.

  • Unfunded Mandate? (Score:2, Informative)

    by R2.0 ( 532027 )
    So a Federal agency is paying for these with Federal dollars - what's unfunded about this?

    You may be thinking about the REAL-ID program, which is indeed an unfunded mandate. But this isn't it.

    Thanks for the flamebait anyway.
    • Pots of money. Sure - its Federal dollars. But because of the oddities of Federal spending and budgets, one Fed dollar isn't the same as another Fed dollar. It's one thing to say "you will implement this program at whatever cost" and an entirely different matter to say "you will implement this program with this extra pot of money we're allocating to your organization."

  • The right solution for the wrong problem (Score:5, Insightful)

    by thesandbender ( 911391 ) on Saturday October 21, 2006 @08:38PM (#16532529)
    I've worked as a contractor for the Federal Government and the City of New York (which considers themselves a Federal Government). Most of the agencies I worked at had security that was an absolute joke. I'll give the guys at the DoE/Forrestal Building some credit as well as the Department of Juvenile Justice in NYC , they actually asked questions and took their jobs seriously. (The DoJJ guys in New York are the only ones who have flat-out denied me entry... no matter how much smooth talking I did. For whatever reason, the guards I came across took protecting the identities and lives of the children in overseen by the agency very, very seriously and I have the utmost respect for them because of it.) Most of the other security guards were too concerned about talking about the caboose of the last woman to walk through the metal detector.

    The point is, no amount of technological or physical security is going to do any good if the people entrusted with its implementation are not trained to do their job properly or take it seriously. The only "serious" contracts I worked were at DoE but at the rest of the agencies I had access to enough information to financially ruin a good number of the people in the United States. Thankfully I worked with people who took that responsibility as seriously as I did but I can't help but feel that was through luck of the draw and not the success of the system.

    Smartcards/RFID make sense if they going to be used and implemented properly (e.g. you picture is on the card and encrypted with a public key system so that the agency can verify that it's authentic and not a clever forgery... and the people at the desk care enough to actually check)... otherwise it's just another way for contractors/etc to make money and a waste of everyone else's time. /looking for the black helicopters
    • Wow... vodka does horrible, horrible things to the grammatical functions of the brain. People under the age of 21 take note... 60% of the time, vodka screws you up all of the time. I felt I had to comment though. Please excuse me.

  • Smash (Score:2)

    by chiph ( 523845 )
    Mr PIV, meet Mr Hammer.
  • IT's meaningless nonsense.

  • The Actual Program Information (imagine that) (Score:5, Informative)

    by dnadig ( 414126 ) on Saturday October 21, 2006 @09:11PM (#16532713)
    In case anyone cares to actually LEARN what it is rather than just ramble on about how horrible the world is:

    http://csrc.nist.gov/piv-program/index.html [nist.gov]

    It's a very sensible document (and HSPD12 is just the mandate, FIPS201 is the implementation). All it does (ALL) is say "agencies need to have a process in place to make sure Joe is Joe, and they need to give him a card that says he's Joe, and it needs to look like this."

    It doesn't actually go further than that. It outlines an interoperable infrastructure based on dirt simple, well understood, highly tested smart card stock, lays out minimum requirements for readers, and puts a system certification process in place. The "tech" part of this is really quite simple and boring for anyone who's spent more than 10 minutes thinking about PKI or smartcards.

    The much much more important part of this is the credentialling part (PIV-1) which has been in place for a year. This establishes clear lines of responsibility and clear processes for actually establishing that Joe is Joe, and at least an attempt to make sure that, say, the Defense Manpower Data Center is using the same process as the Janitor's closet in the Department of Education. This is a GOOD THING people. It's about breaking down silos and creating (gasp) an open standard for strong(er) authentication.

    That's right folks, an open interoperability standard sponsored by the US of A. Wanna make sure your corporate ID is just a wee bit futureproof? Read the FIPS201 docs and mimic the data model and tech requirements.

    OK, back to the sarcasm laced punditry. Thank's for playing.

  • Keep Moving (Score:1, Offtopic)

    by WillRobinson ( 159226 )
    Your being assimilated into the Borg, you don't have to worry about me, the next guy has the cattle prod.
  • The Department of Defense has been issueing these "smart cards" for several years now. The various branches of the military have used them exclusivly for a few years.

  • Other means of tracking (Score:3, Insightful)

    by Guitarhero1000 ( 1007633 ) on Saturday October 21, 2006 @11:47PM (#16533262)
    I hate to say it but anyone who carries a cell phone is trackable. In fact, were using the internet right now. Trackable. It's all possible, and no one is safe from wrong-doings. But we can't phase out technology just because it's "Trackable". History tells us that in fact that this WILL be used for wrongdoings by government. It's a matter of WHEN it gets out of hand. And it will. Stay alert and cautious.
  • Let me start by saying: I am working on the NIST PKCS11 implementation (it will be public domain). THE PD12 is meant to unify identification and processing of government employees. So that you don't end up with several badges with different pictures and fingers prints, from numerous agencies. It's a simplification process and one that's long overdue. I am no bush fan, but people are barking up the wrong tree here. As far as national id cards go, it's just a matter of time. I see resonance here that might l
  • In a society where there is no freedom -- there is no crime.

    Actually, it works pretty well -- the Nazi's did it, the Communists did (and do) it. When everyone is scared shitless to do anything wrong because no matter what you do, or where you do it, big brother is watching -- it works great!

    Right now, the USA is going through the first phase -- FUD. The president is trying to scare everyone so much with terrorists lurking behind every tree that you'll GLADLY give up what little freedom you have left jus

Slashdot Top Deals

Our OS who art in CPU, UNIX be thy name. Thy programs run, thy syscalls done, In kernel as it is in user!

Close