Smart cards are plastic devices about the size of a credit card that contain  an embedded integrated circuit chip capable of both storing and processing  data. The larger the card’s electronic  memory, the more functions can be supported, such as tracking itineraries  for travelers, linking to immunization or other medical records, or storing  cash value for electronic purchases. Specifically, we recommended that  the Director, OMB, issue governmentwide policy guidance regarding  adoption of smart cards for secure access to physical and logical assets;   the Director, NIST, continue to improve and update the government  smart card interoperability specification by addressing governmentwide  standards for additional technologies—such as contactless cards,  biometrics, and optical stripe media—as well as integration with PKI;  and   the Administrator, GSA, improve the effectiveness of its promotion of  smart card technologies within the federal government by  (1) developing an internal implementation strategy with specific goals  and milestones to ensure that GSA’s internal organizations support and  implement smart card systems consistently; (2) updating its  governmentwide implementation strategy and administrative guidance  on implementing smart card systems to address current security  priorities; (3) establishing guidelines for federal building security that  address the role of smart card technology; and (4) developing a process  for conducting ongoing evaluations of the implementation of smart  card–based systems by federal agencies to ensure that lessons learned  and best practices are shared across government. Of the remaining projects, 11 were operational, 5 were in the  planning or pilot phase, and agencies did not provide current information  on 8. The operational and planned projects consist mostly of large-scale  projects intended to provide identity credentials to an entire agency’s  employees or other large groups of individuals. Agencies reported that the majority (28) of the above projects had been  terminated since our last review was conducted. According to agency  officials, reasons for termination were primarily that the projects were  absorbed into other smart card projects or were deemed no longer feasible. DOD’s CAC card is to be used to authenticate the  identity of nearly 3.5 million military and civilian personnel and to improve  security over online systems and transactions. As  the table shows, 12 of these are large-scale projects. However, they are  smaller in scale, serving populations ranging from 612 to 3,100 individuals. In response to our survey, agency officials reported 8 additional smart card  projects that were ongoing at the time of our last review but not previously  reported. The remaining  4 projects were planned for single applications such as stored value, logical  access to computer systems and networks, or processing travel documents. Based on these  reported projects, more agencies are using GSA’s Smart Card Access  Common ID contracting vehicle to acquire smart card technology. These 10 projects vary widely in size, including small-scale projects— involving smart cards issued to as few as 126 cardholders—as well as much  larger scale initiatives. For example, Department of Labor officials  reported that the Employment and Training Administration physical access  control smart card was issued to 126 federal employees and contractors as  of December 2003. In contrast, VA plans to  issue an estimated 500,000 smart cards to employees and contractors under  its Authentication and Authorization Infrastructure Project. Through this  initiative, smart cards will be used for identity credentials, accessing  buildings or other facilities, and accessing computer systems. Agencies’ Reported Use of GSA’s Contracting Vehicle

GSA developed the Smart Card Access Common ID contracting vehicle to  help make it easier for federal agencies to acquire commercial smart card  products and services. Between December 2004 and December 2008, five  agencies—including NASA and the Departments of Defense, Homeland  Security, the Interior, and Veterans Affairs—are planning to make an  aggregated purchase of up to 40 million cards through the GSA contract. Implementation of Agencywide Smart Card Initiatives

Agencies continue to move towards integrated agencywide initiatives that  use smart cards as identity credentials that agency employees can use to  gain both physical access to facilities, such as buildings, and logical access  to computer systems and networks. In some cases, additional functions,  such as asset management and stored value, are also being included. These projects are in various  stages of deployment. Both GSA and OMB generally agreed with the content in  the draft report. Objectives, Scope, and Methodology

Our objectives were to (1) determine the current status of smart card  projects under way at the time of our last review, (2) identify and determine  the status of projects initiated since our last review was completed, and  (3) identify integrated agencywide smart card projects that are currently  under way.
Why GAO Did This Study

Smart cards--plastic devices about the size of a credit card--use integrated circuit chips to store and process data, much like a computer. Among other uses, these devices can provide security for physical assets and information by helping to verify the identity of people accessing buildings and computer systems. They can also support functions such as tracking immunization records or storing cash value for electronic purchases. Government adoption of smart card technology is being facilitated by the General Services Administration (GSA), which has implemented a governmentwide Smart Card Access Common ID contract, which federal agencies can use to procure smart card products and services. GAO was asked to update information that it reported in January 2003 on the progress made by the federal government in promoting smart card technology. Specific objectives were to (1) determine the current status of smart card projects identified in GAO's last review, (2) identify and determine the status of projects initiated since the last review, and (3) identify integrated agencywide smart card projects currently under way. To accomplish these objectives, GAO surveyed the 24 major federal agencies. In commenting on a draft of this report, officials from GSA and the Office of Management and Budget generally agreed with its content.

What GAO Found

According to GAO's survey results, as of June 2004, more than half of the smart card projects previously reported as ongoing (28 out of 52) had been discontinued because they were absorbed into other smart card projects or were deemed no longer feasible. Of the remaining 24 projects, 16 are in planning, pilot, or operational phases and are intended to support a variety of uses (agencies did not provide current information for 8 projects). Twelve of the 16 projects are large-scale projects intended to provide identity credentials to an entire agency's employees or other large group of individuals. For example, the Department of Defense's (DOD) Common Access Card is to be issued to an estimated 3.5 million DOD-related personnel, and the Transportation Security Administration's Transportation Worker Identification Credential is to be used by an estimated 6 million transportation industry workers. The other 4 projects are smaller in scale, and are intended to provide access or other services to limited groups of people. For example, the Department of Commerce's Geophysical Fluid Dynamics Laboratory Access Card is to be issued to about 612 employees, contractors, and research collaborators. Further, in response to the survey, agencies reported 8 additional smart card projects that were ongoing at the time of the last review. These projects include 4 planned for multiple applications (such as identity credentials and access) and 4 for single applications, including stored value, access to computer systems, and processing travel documents. Based on GAO's survey of federal agencies, 10 additional smart card projects have been initiated since the last review. These projects vary widely in size and scope. Included are small-scale projects, involving cards issued to as few as 126 cardholders (such as a project in the Department of Labor's Employment and Training Administration), and large-scale agencywide initiatives, such as the Department of Veterans Affairs Authentication and Authorization Infrastructure card, which is to be issued to an estimated 500,000 employees and contractors. Four agencies reported purchases under GSA's Smart Card Access Common ID contracting vehicle, and others likewise have plans to use this contract. Specifically, five agencies--the Departments of Defense, Homeland Security, the Interior, and Veterans Affairs, and the National Aeronautics and Space Administration--are planning to make an aggregated purchase of up to 40 million cards over the next 4 years using the GSA contract. Finally, nine agencies are developing and implementing integrated agencywide smart card initiatives. These projects are intended to use one card to support multiple functions, such as providing identification credentials, accessing computer systems, and storing monetary values.