As of June  2004, 15 federal agencies reported 34 ongoing smart card projects. Initially, many of the smart card initiatives that were undertaken  were small-scale demonstration projects that involved as few as 100  cardholders and intended to show the value of using smart cards for  identification or to store cash value or other personal information. However, federal efforts toward the adoption of smart cards have  continued to evolve as agencies have gained an increased  understanding of the technology and its potential uses and benefits. Our most recent study of federal agencies’ investments in smart card  technology, which we reported on last month, noted that agencies  are increasingly moving away from many of their earlier efforts— which frequently involved small-scale, limited-duration pilot  projects—toward much larger, integrated, agencywide initiatives  aimed at providing smart cards as identity credentials that agency  employees can use to gain both physical access to facilities, such as  buildings, and logical access to computer systems and networks. Results from this project have indicated that smart cards can offer  many useful benefits, such as significantly reducing the processing  time required for deploying military personnel, tracking  immunization records of dependent children, and verifying the  identity of individuals accessing buildings and computer systems. Our prior work noted a number of  management and technical challenges that agency managers have  faced. In considering these challenges, it is important to note that, while  they served to slow the adoption of smart card technology in past  years, they may be less difficult in the future because of increased  management concerns about securing federal facilities and  information systems and because technical advances have improved  the capabilities and reduced the cost of smart card systems. Specifically, we recommended that   ●  the Director, OMB, issue governmentwide policy guidance regarding  adoption of smart cards for secure access to physical and logical  assets;  ●  the Director, NIST, continue to improve and update the government  smart card interoperability specification by addressing  governmentwide standards for additional technologies—such as  contactless cards, biometrics, and optical stripe media—as well as  integration with PKI; and  ●  the Administrator, GSA, improve the effectiveness of GSA’s  promotion of smart card technologies within the federal government  by (1) developing an internal implementation strategy with specific  goals and milestones to ensure that GSA’s internal organizations  support and implement smart card systems consistently; (2)  updating its governmentwide implementation strategy and  administrative guidance on implementing smart card systems to  address current security priorities; (3) establishing guidelines for  federal building security that address the role of smart card  technology; and (4) developing a process for conducting ongoing  evaluations of the implementation of smart card-based systems by  federal agencies to ensure that lessons learned and best practices  are shared across government. VA Is Pursuing Agencywide Use of Smart Cards

Mr. Chairman, beyond the governmentwide assessment presented,  you requested that we specifically address actions of the  Department of Veterans Affairs in adopting smart card technology. VA currently estimates that,  between fiscal years 2004 and 2009, this initiative will cost about  $162 million. According to  project documentation, the One-VA ID card is intended to replace  the several hundred methods for issuing identification cards that are  currently in place across the department, and improve physical and  information security by strengthening the ability to authenticate  users and grant access to information systems that employees and  contractors rely on to perform VA’s business functions. The  adoption of such technology is continuing to evolve, with a number  of large-scale, agencywide projects having been undertaken by  federal agencies over the past several years.
Why GAO Did This Study

The federal government is interested in the use of smart cards--credit card-like devices that use integrated circuit chips to store and process data--for improving the security of its many physical and information assets. Besides providing better authentication of the identities of people accessing buildings and computer systems, smart cards offer a number of other potential benefits and uses, such as creating electronic passenger lists for deploying military personnel and tracking immunization and other medical records. Over the past 2 years, GAO has studied and reported on the uses of smart cards across the federal government. Congress requested that GAO testify on federal agencies' efforts in adopting smart card technology--based on the results of this prior work--and on the specific actions that the Department of Veterans Affairs is taking to implement smart card technology.

What GAO Found

As the unique properties and capabilities of smart cards have become more apparent, federal agencies, including the Office of Management and Budget, the National Institute of Standards and Technology, and the General Services Administration, have acted to advance the governmentwide adoption of smart card technology. In turn, numerous smart card projects that offer a variety of uses and benefits have been launched. As of June 2004, 15 federal agencies reported 34 ongoing smart card projects. Further, agencies' actions toward the adoption of smart cards continue to evolve as understanding of the technology grows. Agencies are moving away from the small-scale, limited-duration demonstration projects of past years (involving as few as 100 cardholders and aiming mostly to show the value of using smart cards for identification) to larger, more integrated, agencywide initiatives involving many thousands (or even millions) of users and that are focused on physical access to facilities and logical (information systems) access to computer systems and networks. In pursuing smart card projects, federal agencies have had to contend with numerous management and technical challenges. However, these challenges may be less imposing in the future because of increased management concerns about securing federal facilities and because technical advances have improved the capabilities and cost effectiveness of smart card systems. The Department of Veterans Affairs (VA) is one of 9 federal agencies currently pursuing large-scale, agencywide smart card initiatives. VA's project, currently in limited deployment, involves using, among other technologies, the One-VA Identification smart card to provide an agencywide capability to authenticate users with certainty and grant them access to information systems essential to accomplishing the agency's business functions. VA estimates that this project will cost about $162 million between 2004 and 2009, and enable it to issue 500,000 smart cards to its employees and contractors.