Common Access Card traveled a long, rocky road to success
Connecting state and local government leaders
When the Defense Department began its rollout of the Common Access Card program, "many said we were on the bleeding edge of technology," program analyst Lynda A. Cole said. It soon became clear how true that was.
A team of officials from the Defense Manpower Data Center this morning gave a behind-the-scenes glimpse of the challenges in managing the Defense Department's Common Access Card.
"Many said we were on the bleeding edge of technology when we started this roll-out," said Lynda A. Cole, a management and program analyst in the DMDC's Access Card Office. It soon became clear how true that was, Cole said.
Cole was one of nine speakers who described the CAC lifecycle at the CardTech-SecurTech conference in Washington. With more than 4 million cards issued to active, reserve and retired military personnel and contractors, the Common Access Card is the largest and most ambitious government smart-card program. About 90 percent of target recipients have received the card, but the constant influx of new recruits, and the need to reissue cards to existing personnel, keeps the process at full speed at 1,400 locations around the world, said Mary Dixon, director of the Access Card Office.
The rollout of 2,000 workstations used to issue the new smart ID cards took two years to complete, Cole said, and required some major infrastructure work.
"Network connectivity was one of the most difficult problems we had to answer," she said. About one-third of the sites issuing military ID cards were then on dial-up connections to DOD data systems. "We knew how chatty the issuing process would be, and we knew issuing time would go down if they had LAN connectivity," Cole said.
Once the system was up and running, the printers began giving headaches. DMDC officials received complaints that barcodes on the new cards could not be read. They found that the printers producing the cards would not hold settings during shipments to issuing sites. The design had to be tweaked for new printers, and existing printers had to be retrofitted.
Once in use, the cards themselves began giving problems. Data on the back of the cards, which were not laminated because of the magnetic stripe, was wearing off and becoming unreadable. A partial lamination for the back of the card had to be added, and once again the printers were retrofitted to produce them.
If fielding a complex smart-card program were not enough, the military went to war during the process, adding a new layer of challenges. Issuing stations had to be established in theaters such as Afghanistan and Iraq, which offered some unforeseen practical problems.
"The inspection dogs didn't like our cleaning kits," delaying delivery of the equipment to issuing sites, Cole said.
But in the best tradition of Admiral David Farragut, who declared, "Damn the torpedoes! Full speed ahead," DMDC forged ahead with the deployment in the face of difficulties, Dixon said.
"If you meet a roadblock, go around it or go through it," she said. "You need to focus on what you can do."
The speakers also gave a look at what is coming for CAC. Dixon said that in June the services will decide on whether to go to a 64K chip on the card, in place of the current 32K chip, and whether to add a contactless chip. She said there probably is a 90 percent chance that the 64K chip would be added.
"The 32K chip is reaching the end of its life," she said. Cards with the new chip would probably be available by the end of this year. The odds were less, although still good, that the contactless chip would be adopted. That technology would be used primarily for access control, and expenses for access control are so little known that making the business case for adding the new technology could be difficult. If adopted, the contactless chips probably would be available on the cards in early 2005, Dixon said.
Most of the additional storage space on the 64K chips would go toward new Java applets, said Lynne Prince, deputy of DMDC's Access and Authentication Technology Division. Existing applets include three digital certificates, for ID, e-mail encryption and digital signatures; a general container for data storage; Personal Identification Number management, which controls access to applications, and a security domain that contains rules for each applet. The new version would include space for biometric controllers, a separate access control rules space that would control access to each applet, and a module that would ensure compliance with developing standards.
Prince said the new generation of cards would also be certified at level 3 for the Federal Information Processing Standard 140-2.
Two pilot programs also have been established to test DOD authentication of other standard ID cards, Dixon said. The Defense National Visitors Center will verify government IDs from other departments for visitors to military facilities. The Defense Cross-Credentialing ID System will be a federated model that will access databases to verify nongovernment IDs from trusted third parties.