Since the 1990s, the federal government has considered the use of smart  card technology as one option for electronically improving security over  buildings and computer systems. For example, the process of verifying the identity of people  accessing federal buildings and computer systems, especially when used in  combination with other technologies, such as biometrics, is significantly  enhanced with the use of smart cards. Other potential  benefits and uses include creating electronic passenger lists for deploying  military personnel and tracking immunization and other medical records. Challenges to the Successful Adoption of Smart Cards

The benefits of smart card adoption can be achieved only if key  management and technical challenges are understood and met. While  these challenges have slowed the adoption of smart card technology in  past years, they may be less difficult in the future because of increased  management concerns about securing federal facilities and information  systems, and because technical advances have improved the capabilities  and reduced the cost of smart card systems. As a result, agency officials have found that obtaining adequate resources  is critical to implementing a major government smart card system. Maintaining the Security of Smart Card Systems and Privacy of Personal Information

Although concerns about security are a key driver for the adoption of  smart card technology in the federal government, the security of smart  card systems is not foolproof and must be addressed when agencies plan  the implementation of a smart card system. Actions Have Been Taken to Promote Consistent Smart Card Adoption across Government

Given the significant management and technical challenges associated  with successful adoption of smart cards, an ongoing series of initiatives  have been undertaken in the federal government to facilitate the adoption  of the technology. As I mentioned earlier, GSA was originally tasked in  1996 with coordinating an effort to adopt multiapplication smart cards  across the federal government, and it has taken important steps to  promote federal smart card use. OMB has begun to take action to develop a framework of policy guidance  for governmentwide smart card adoption. The memo sketched out a three-part initiative:    First, OMB plans to develop common policy for authentication and  identity management, including technical guidance to be developed by  GSA and NIST, that will result in a comprehensive policy for credentialing  federal employees. Second, OMB intends to execute a governmentwide acquisition of  authentication technology, including smart cards, to achieve cost savings  in the near term. However, agencies continue to face a number of challenges  in implementing smart-card–based systems, including sustaining executive  level commitment, recognizing resource requirements, integrating physical  and logical security practices, achieving interoperability, and maintaining  system security and privacy of personal information.
Why GAO Did This Study

The federal government is increasingly interested in the use of smart cards--credit-card-like devices that use integrated circuit chips to store and process data--for improving the security of its many physical and information assets. Besides better authentication of the identities of people accessing buildings and computer systems, smart cards offer a number of potential benefits and uses, such as creating electronic passenger lists for deploying military personnel, and tracking immunization and other medical records. Earlier this year, GAO reported on the use of smart cards across the federal government (GAO-03-144). GAO was asked to testify on the results of this work, including the challenges to successful adoption of smart cards throughout the federal government, as well as the government's progress in promoting this smart card adoption.

What GAO Found

To successfully implement smart card systems, agency managers have faced a number of substantial challenges: sustaining executive-level commitment in the face of organizational resistance and cost concerns; obtaining adequate resources for projects that can require extensive modifications to technical infrastructures and software; integrating security practices across agencies, a task requiring collaboration among separate and dissimilar internal organizations; achieving smart card interoperability across the government; and maintaining the security of smart card systems and the privacy of personal information. These difficulties may be less formidable as management concerns about facility and information system security increase and as technical advances improve smart card capabilities and reduce costs. However, such challenges, which have slowed the adoption of this technology in the past, continue to be factors in smart card projects. Given the significant management and technical challenges associated with successful adoption of smart cards, a series of initiatives has been undertaken to facilitate the adoption of the technology. As the federal government's designated promoter of smart card technology, GSA assists agencies in assessing the potential of smart cards and in implementation. GSA has set up a governmentwide, standards-based contracting vehicle and has established interagency groups to work on procedures, standards, and guidelines. As the government's policymaker, OMB is beginning to develop a framework of policy guidance for governmentwide smart card adoption. In a July 2003 memorandum, OMB described a three-part initiative on authentication and identity management in the government, consisting of (1) developing common policy and technical guidance; (2) executing a governmentwide acquisition of authentication technology, including smart cards; and (3) selecting shared service providers for smart card technology. These efforts address the need for consistent, up-to-date standards and policy on smart cards, but both GSA and OMB still have much work to do before common credentialing systems can be successfully implemented across government agencies.