Will feds trust nonfederal ID card for contractors and agency partners?

CIO Council sets specs for a card that would interoperate with the federal PIV Card

Responding to private-sector demand for identity credentials that the government can trust, the CIO Council has established specifications for PIV Interoperability for nonfederal issuers, and the first commercial vendors have received certification to issue the cards.

PIV Interoperability — or PIV-I — remains a work in progress, said the General Services Administration’s Deborah Gallagher, co-chairwoman of the CIO Council’s Identity, Credential and Access Management subcommittee. “But it is working.”

CertiPath and VeriSign have been certified that they meet requirements of the Federal Bridge Certification Authority for issuing the interoperable cards, and some cards have been issued and are undergoing compliance testing, Gallagher said Feb. 3 at a conference on identity management held in Washington by the Digital Government Institute.


Related  coverage:

ID management’s weakness: ‘There is no demand’

NIST: National ID is not part of 'identity ecosystem'


The Homeland Security Presidential Directive 12 mandated the Personal Identity Verification card to establish a common, interoperable smart ID credential for executive branch employees and contractors. Technical standards for the card are set out in Federal Information Processing Standard 201.

PIV-I addresses a continuing problem of identity management: the need for interoperable credentials that can be verified electronically in the online and physical worlds.

“This isn’t a new story,” said Dan Turissini, chief technology officer of Widepiont and board member of the Federation for Identity and Cross-Credentialing Systems, a nonprofit industry group. “It’s still the same thing we’ve been trying to figure out for some time” — that is, how to make a card that multiple entities can trust while producing strong credentials that can be cost-effective and simple to use. “We have the technology; we’re just not using it.”

At the Defense Department, a Defense Installation Access Control working group is standardizing access control requirements for worldwide DOD facilities. A national architecture is being designed to share identity information and allow standard physical access control systems to authorize credentials. The scheme would use electronic authentication and could accept compliant nongovernment cards,such as PIV-I, said Air Force Lt. Col. Mark DiCarlo.

“The technology exists” to enable the scheme, DiCarlo said. “It’s a matter of policy.”

With the creation of the PIV card, nonfederal governments and the private sector also wanted cards that could interoperate with federal PIV systems and be trusted by federal agencies. But the FIPS 201 PIV standard is limited to federal use and has some requirements specific to the federal community, so some guidance was needed for nonfederal issuers.

The CIO Council released the first guidance on PIV Interoperability for nonfederal issuers in May 2009 and updated it last year. The guidance provides a set of minimum requirements for trusted nonfederally issued identity cards and addresses four barriers to trusted interoperability that the CIO Council identified.

  • Common terminology for identity cards: A lexicon for differentiating a federal PIV card from a nonfederally issued identity card seeking PIV system interoperability must be developed.
  • Technical requirements: For nonfederally issued identity cards to interact with federal infrastructure, basic technological requirements must be met.
  • Identifier name space: Effective use of identity cards requires an identifier that is unique across all cards.
  • Trusted identity: The fundamental purpose of an identity card is to establish the identity of the card holder. Therefore, an identity card must be issued in a manner that the federal government can trust.

PIV-I cards must meet not only technical specifications but also policies and procedures for vetting the identity of recipients and securely issuing cards. Commercial providers must cross-certify with the Federal Bridge Certification Authority to provide PIV-I credentials. A revised X.509 Certificate Policy for the Federal Bridge Certification Authority was published addressing PIV-I issuing procedures and addresses cross-certification.

Several nonfederally issued cards already have been developed, including the First Responder Authentication Credential, Transportation Worker Identity Credential and Airport Credential Interoperability Solution. PIV-I would enable general availability of a card that could be used with government.

Although PIV-I cards are intended to be fully interoperable with government PIV systems, agencies are not required to accept the cards. The program only provides minimum requirements for enabling trust. Each organization will make its own decision on whether to trust the cards. They may not be used in place of PIV cards if those government-issued cards are required, and they will not replace First Responder Authentication Cards, Transportation Worker Identification Credentials, Aviation Credential Interoperability Solution cards or other industry-specific credentials.

About the Author

William Jackson is freelance writer and the author of the CyberEye blog.

Reader Comments

Mon, Feb 7, 2011 Walter Washington DC

Are you kidding? Different parts of DoD don't trust each others ID cards. EPA trusts an ID with US Navy on it, but not Naval such and such, even though they are both Feds that work in the same building. Until recently I could site several examples of different parts of the Navy not trusting ID badges from other parts of the Navy. I am sure they Army and AF have similar issues. Until you plug the things into a computer, they are just a photo ID. All the biometrics are unusable to most security personnel, and to none others. That means they have a picture, a name, an agency, and usually an expiration date. All other information is either on a complex form of bar code, a magnetic strip, or a micro chip, none of which can be read or varified casually. Since many contractors don't need computer access, most of this is a waste anyway, and the remainder should be reviewed to determin if they should be federal workers instead of contractors.

Mon, Feb 7, 2011

Everybody has gotta reinvent the wheel. Here is an idea- take the ID cards away from the agencies, since it is not part of their core mission. Common-service it with one agency (for feds) like it should have been done in the first place, and have a standard spec sheet and SOP for any outside vendor that wants to jump through the hoops and get certified. No need to waste more millions on R&D contracts, and try to do by committee something so trivial. Just make a decision and go with it.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above