Smart cards are plastic devices about the size of a credit card that contain  an embedded integrated circuit chip capable of both storing and processing  data. According to information obtained from GSA, OMB, and other federal  agencies, as of November 2002, 18 federal agencies were planning, testing,  operating, or completing a total of 62 smart card projects. Although there is no work under way to  include optical stripe technology as an option within the Government  Smart Card Interoperability Specification, the guidance does not preclude  the use of this technology. Maintaining the Security of Smart Card Systems and Privacy of Personal Information

Although concerns about security are a key driver for the adoption of smart  card technology in the federal government, the security of smart card  systems is not foolproof and must be addressed when agencies plan the  implementation of a smart card system. Conclusions

Progress has been made in implementing smart card technology across  government, with increasingly ambitious projects, such as DOD’s CAC,  being initiated in recent years as federal managers focus on implementing  smart cards to enhance security across organizations. To successfully  implement smart-card-based systems, agency managers have faced a  number of substantial challenges, including sustaining executive-level  commitment, obtaining adequate resources, integrating physical and  logical security practices, achieving interoperability among smart card  systems, and maintaining system security and privacy of personal  information. Although  OMB has statutory responsibility to develop and oversee policies,  standards, and guidelines used by agencies for ensuring the security of  federal information and systems, it has not issued any guidance or policy  on governmentwide adoption of smart cards since 1996, when it designated  GSA the lead for promoting federal adoption of the technology. GSA continues to play an important role in assisting agencies as they assess  the potential of smart cards and move to implement them. Its implementation strategy and administrative guidance  have not been kept up to date and do not address current priorities and  technological advances. We recommend that the Administrator, GSA, improve the effectiveness of  its promotion of smart card technologies within the federal government by  developing an internal implementation strategy with specific goals and  milestones to ensure that GSA’s internal organizations support and  implement smart card systems, based on internal guidelines drafted in  2002, to provide better service and set an example for other federal  agencies;  updating its governmentwide implementation strategy and  administrative guidance on implementing smart card systems to address  current security priorities, including minimum security standards for  federal facilities, computer systems, and data across the government;  establishing guidelines for federal building security that address the role  of smart card technology; and  developing a process for conducting ongoing evaluations of the  implementation of smart-card-based systems by federal agencies to  ensure that lessons learned and best practices are shared across  government.
Why GAO Did This Study

Smart cards--credit-card-like devices that use integrated circuit chips to store and process data--offer a range of potential uses for the federal government, particularly in increasing security for its many physical and information assets. GAO was asked to review the use of smart cards across the federal government (including identifying potential challenges), as well as the effectiveness of the General Services Administration (GSA) in promoting government adoption of smart card technologies.

What GAO Found

Progress has been made in implementing smart card technology across government. As of November 2002, 18 federal agencies had reported initiating a total of 62 smart card projects. These projects have provided a range of benefits and services, ranging from verifying the identity of people accessing buildings and computer systems to tracking immunization records. To successfully implement such systems, agency managers have faced a number of substantial challenges: (1) sustaining executive-level commitment in the face of organizational resistance and cost concerns; (2) obtaining adequate resources for projects that can require extensive modifications to technical infrastructures and software; (3) integrating security practices across agencies, a task requiring collaboration among separate and dissimilar internal organizations; (4) achieving smart card interoperability across the government; and (5) maintaining the security of smart card systems and privacy of personal information. In helping agencies to overcome these challenges, not only GSA but also the Office of Management and Budget (OMB) and the National Institute of Standards and Technology (NIST) have roles to play. As the federal government's designated promoter of smart card technology, GSA assists agencies in assessing the potential of smart cards and in implementation. Although GSA has helped agencies significantly by implementing a governmentwide, standards-based contracting vehicle, it has not kept guidance up to date and has not addressed important subjects, such as building security standards, in its guidance. Further, OMB, which is responsible for setting policies for ensuring the security of federal information and systems, has not issued governmentwide policy on adoption of smart cards. In its role of setting technical standards, NIST is responsible for the government smart card interoperability specification, which does not yet address significant emerging technologies. Updated guidance, policy, and standards would help agencies to take advantage of the potential of smart cards to enhance security and other agency operations.