EIIP Virtual Forum Presentation January 14, 2009
Emergency Response Official Credentials
A Smart Card Alliance White Paper
Secretary, Identity Council Steering Committee
Smart Card Alliance (SCA)
The introduction, presentation, and closing parts of the transcript are prepared remarks and not necessarily verbatim. The Q&A portion is prepared from a transcription of the recording. The complete slide set (Adobe PDF) may be downloaded from http://www.emforum.org/vforum/SmartCard/ERO_sda_a.pdf for ease of printing.
[Welcome / Introduction]
Amy Sebring: Good morning/afternoon everyone and Happy New Year! Welcome to EMforum.org and our first program for 2009. Todays topic is "Emergency Response Official Credentials: A Smart Card Alliance White Paper."
Our topic is timely in that NIMS currently has a Guideline for the Credentialing of Personnel out for review and comment. Comments are due by January 21, a week from today. A copy of the guideline is also available as a handout. The related Federal Register notice and comment review form are also linked from todays Background Page [http://www.emforum.org/vforum/090114.htm].
Also note the related poll on our homepage. "Any ID/credential system should be implemented at the: national, state, regional or local level." Please take time to participate by voting and review the results thus far.
Now it is my pleasure to introduce todays guest speaker: Salvatore DAgostino is Secretary of the Identity Council Steering Committee of the Smart Card Alliance (SCA), and principal author of the white paper that is our topic of discussion today.
The Identity Council is focused on promoting the need for technologies and usage solutions regarding human identity information to address the challenges of securing identity information and reducing identity fraud, and to help organizations realize the benefits that secure identity information delivers
Sal is also CEO of IDmachines, Cambridge, MA and has helped provide DHS and FEMA with the initial first responder authentication credential (FRAC) system as well as many of the subsequent deployments and use of the FIPS 201 based FRAC.
Welcome Sal, and thank you for being with us today. I now turn the floor over to you to start us off please.
Sal DAgostino: The Smart Card Alliance is a not-for-profit, multi-industry association working to stimulate the understanding, adoption, use and widespread application of smart card technology. The Alliance invests heavily in education on the appropriate uses of technology for identification, payment and other applications and strongly advocates the use of smart card technology in a way that protects privacy and enhances data security and integrity.
Through specific projects such as education programs, market research, advocacy, industry relations and open forums, the Alliance keeps its members connected to industry leaders and innovative thought. The Alliance is the single industry voice for smart card technology, leading industry discussion on the impact and value of smart cards in the U.S. and Latin America.
The Alliance is comprised of over 170 members worldwide, including participants from financial, government, enterprise, transportation, mobile telecommunications, healthcare, and retail industries. A mix of issuers and adopters of smart card technology work in concert with leading industry suppliers of the full range of products and services supporting the implementation of smart-card based systems for secure payments, identification, access, and mobile communications.
This Emergency Response Official White Paper is the joint effort of the Smart Card Alliance Identity and Physical Access Councils. In addition a number of people from the Department of Homeland Security also participated in the process as indicated on the slide. A number of other individuals from state and local government also contributed.
The white paper recommends the use of Federal Information Processing Standard 201 as the basis for a credentialing program. The reasons for this include the use of standards bases commercial off the shelf products, to leverage a multi-billion dollar US Government investment in identity assurance, to use a multi-purpose smart card technology and to follow the FEMA lead on how to obtain interoperability.
Why focus on identity? It turns out that this is something that is used every day and becomes particularly crucial on "the day". It needs to be easy to use, reliable and very robust. Simply it has to work under almost any circumstance. To be able to unequivocally answer: who are you, is clearly a good thing.
[Slides 6 and 7]
What is being set up?
FEMA is setting up an infrastructure to support the use of FIPS 201 based credentials in the National Capitol Region. It complements an existing DoD infrastructure in support of the Pentagon. This infrastructure is expected to be rolled out nationally. It provides a "dial tone" for the electronic validation of credentials. The system has been undergone years of testing and is in production.
So what does it do?
It basically answers two questions, who are you and what are you allowed to do. It does this in a manner that does not require any connections at the time the questions are being asked, it can use up to 4 factors of identification, checks to make sure the credential is not revoked and then displays the emergency support functions and/or national infrastructure protection plan sector that the individual is associated with at that time.
Its important to note the division and sharing of responsibility in answering these questions. The Federal government has a standard and provides and infrastructure to determine if you are who you say you are. Local entities with responsibility for the employment and qualification of the responders are responsible for the issuance of the credential and assigning the privileges or attributes. These are then uploaded to FEMA, which makes them available via its infrastructure. Individual organizations then use this infrastructure to make access control decision, provide situational awareness, log activity, etc.
So if we turn to the credential, what is it?
The difference here is that the means of determining the credential is valid is based on cryptographically sound electronic authentication techniques. What this means is that the basis of the decision is primarily a digital one. Each of these credentials has the digital equivalent of a birth certificate (and other certificates) that is effectively unbreakable. A card reader is used to check the identity certificate, in combination with PIN, photo and fingerprint.
It is a multipurpose credential capable of a wide range of applications that we will get into.
Id like to take a minute to go through the different groups of cardholders that will be getting FIPS 201 credential. The first are those covered by Homeland Security Presidential Directive 12 (HSPD-12). This applies to government employees and contractors. Technically these are the only credentials COMPLIANT with FIPS 201.
The next are the INTEROPERABLE credentials, these require the use of the same cryptographically sound technique and as importantly are issued to a process that allows TRUST of the issuer.
The trust anchor from a security (Public Key Infrastructure) perspective for these credentials is the Federal Bridge Certificate Authority. The other source of trust is that the sponsorship, enrollment, adjudication, production/personalization, activation is done absolutely according to agreed processes as defined in FIPS 201. Another webcast could be spent on the roles and responsibilities in this process, the Smart Card Alliance white paper and the FIPS 201 documents provide an excellent primer.
COMPATIBLE credentials simply match the technical specification; I could make them in my kitchen by following the specification. This means that they probably will work with all of the COTS products being developed, including Microsoft, Apple, Sun, Novell, Oracle, and Probaris and with many physical access control system vendors.
[Slides 11 and 12]
Here are two pictures, front and back of a FIPS 201 credential. Its important to realize that the physical "token" of the identity credential can have many forms. Smart cards are the current means of deploying FIPS 201 in the US Federal government but a variety of form factors already exist, including options to use cell phones with multiple radios.
[Slides 13 and 14]
Again, this is a rigorous process. This drawing gives a good graphical representation of the process. Importantly as you go through sponsorship, enrollment, adjudication, production/personalization, activation and then finally use you need to have designated individuals, with qualifications and the work flow definitions to support them. FIPS 201 lays this out making it easy to comply, albeit at significantly more cost than current back office badging solutions. But with that you get security and interoperability enabling the local and wider enterprises.
[Slides 15 and 16]
To repeat, the benefit here is the ability to have strong authentication and high assurance. This is an essential building block and significantly better that the multiple ID types, flash passes and cryptographically unsound things used today. The goal is one credential that works across applications and the same security model for not only people but things.
How is it being used?
It is a physical access control credential used every day, e.g. building access, lockers, and parking
Materiel logistics, post-event reconstruction and liability issue assessment.
Emergency response gets immediate (20 second) access to high security zones and situational awareness related to the activity in that zone, and well as other reporting functions.
Among the categories of emergency response where security and interoperability are crucial are mutual aid and enduring constitutional government. In both these cases the FEMA and DoD infrastructure support this for FIPS 201 credentials.
[Slides 21 and 22]
So besides physical access and emergency response what can a FIPS 201 credential be used for?
Desktop and web site access, sign and encrypt email, again the use of PKI and digital certificates are part of most current operating systems. It can be used for transit and payments and other things depending on how the organization implements it.
DHS and FEMA are working to expand this in cooperation with the Federal Bridge, cross-certification exists for the bio-pharma industry via the SAFE-Bio Pharma bridge and the Certipath bridge for aerospace, credentialing for ports and airports (TWIC and ACIS) are also aligning with FIPS 201. This represents tens of millions of credentials that will be activated in the next several years.
State and local activity has spiraled out from the National Capitol Region. There is a particular emphasis on the Pentagon after 9-11 Northern Virginia was the first to issue the credentials in any significant quantity; they are now looking to expand this statewide. Other organization in the National Capitol Region are following suit and are in process with establishing or expanding their interoperable credential programs.
I turn you back to our Moderator.
Amy Sebring: Thank you very much Sal. Now, to proceed to our Q&A.
[Audience Questions & Answers]
Patrick McLaugh: Is this program for only the public side? Can the private side take advantage of the credentialing program? My audio is not working so I cannot hear the presentation. I work for a financial institution that wants credentialing for key employees.
Sal DAgostino: The answer is yes. If you look at the National Infrastructure Protection Plan, there are 15 or 17 critical infrastructure components; finance is one of them. In the National Capital Region, there is a consortium called NCR First which, just as I was describing, SAFE Bio Pharma and the Certipath bridge for aerospace, there is a certain trust bridge that is being established among financial institutions. A lot of people are interested in having these things for their continuity of operations of critical infrastructure, and finance qualifies.
Not surprisingly, there is some information about the financial industry ISAC, which is their infrastructure security coordinating council. Its pretty far along at looking at FIPS 201 for the financial sector, so Id be glad to try to provide some of those specific references to Patrick if hes interested. [See https://www.fsscc.org/fsscc/.]
Amy Sebring: And if I may add, that issue is specifically addressed in that NIMS draft guidance for credentialing, correct? You may want to refer to that as well.
John Bowman: 1) What do you see as the greatest barrier to widespread adoption of this approach? 2) Is the same approach being adopted in other countries?
Sal DAgostino: Funding is the biggest issue. Because its infrastructure, it takes time. This is not the sort of thing that can be done here and there. So, the fact that it ends up being large scale, its not surprising that it takes awhile. If you look at all the communities of interest that are involved--emergency response and recovery and critical infrastructure, ports and airports and all the various programs--I think it covers most people. Because its that big, I think thats one of the things that will cause it to be awhile and slow in getting there. But in the meantime, I think its finally taking off where over the next 5 years youll have tens of millions of these credentials. That is certainly some progress.
The digital certificates that are used in the FIPS 201 credential are basically the same being used in national ID programs around the world. In fact, outside the United States, there are hundreds of millions of people who have chip ID cards which are either their national ID or their national health card. RealID got a really hard time here in the U.S. so that were not nearly as far along there.
Melanie Hooks: What is the cost, and are organizations still going to have to verify medical credentials?
Sal DAgostino: The cost is the cost of an identity credential. What its used for: whether its medical, whether its public safety, federal government or independent, the court. If you look at what the General Services Administration charges, (thats the aggregated U.S. government program), its about $85 for the first year and then $36 every year after that, for this credential and all the additional certificates, and a good bit of the infrastructure that comes along with it. Theres a certain number of enrollment, etc. etc.
I also have the highway transportation worker identification credential. That cost $135 and it was good for 5 years. There are different price points out there for what a FIPS 201 interoperable level, compatible credential, but the credential itself is basically $100 and it lasts 3 to 5 years. Your paying maintenance on it for being able to use it and its related infrastructure, and thats comparable to what it costs to produce these things for the population in other countries.
Amy Sebring: The second part of her question may have had to do with the credentialing process. Lets say an individual has a medical credential such as an EMT or something like that.
Sal DAgostino: In that sense, in that credential, what youre doing is that you then are able to associate with that FIPS 201 credential what we would refer to as the attributes for your certification. Your privileges are your other credentialing certs. What were saying at this point is that youre being thrown into a broad ESF category. The infrastructure that FEMA has put in place is in the process of defining beyond EMT what you are, at this time.
Shannon Strother: Has this expanded to include VOADs and truck drivers transporting emergency supplies during the initial emergency response?
Sal DAgostino: The truck drivers should probably be covered by TWIC. If theyre not, that could be an option. In terms of volunteer organizations, this exact credential is also being looked at. At this point Im not aware of any VOADs who have FIPS 201 credentials, but certainly some of the large ones are looking at it, as well as some of the natives and other groups that in reality could qualify for one of these. It certainly is applicable, but I dont know of any that have done it yet.
Amy Sebring: Again I refer you to this NIMS draft credentialing guide because they do anticipate or suggest that VOADs should be included in this program.
Wally Miyasaki: Why is the cost for maintenance with the Federal Bridge so expensive ($40/50 a year per card). Do you see the cost being reduced in the future?
Sal DAgostino: Its basically the identity service, so rather than having to stand up the servers and other associated infrastructure to manage where youre storing your background documents, your biometric information, issuance of your digital certificates, the keys that are associated with that--theres a whole identity infrastructure which is essential in order to make this work--either you put in place all the servers and some things that are associated with that, or you can get a card which is produced by someone who already has that in place. Those people exist, whether its GSA or Transportation Security Administration, via their contract or whoever it may be.
The way thats typically bought is by software. You can either buy it as a service on a year-by-year basis, or you end up buying it like it is regular software, where theres an initial license of $100 and typically something around 20% maintenance for 24/7 support on these things. Believe me, you want thatits your identity. Thats where the pricing comes from. It is different; you may not be used to buying software to some extent. At the end of the day, really youre buying software, not a Smart Card.
Amy Sebring: So the Federal Bridge is housed in GSA?
Sal DAgostino: GSA FIPS 201 credential issuance infrastructure is cross-certified to the Federal Bridge, so theres a Federal Bridge Certificate Authority which is the trust anchor for all the United States government cards, whether youve got a common access card with the Department of Defense, etc. Theres a certain cost thats associated with maintaining that hardware infrastructure through an assurance level, with disaster recovery and all these things based in identity. And then, besides that, theres a process associated with the enrollment officers, the adjudicators. These are people who individually have been vested with the storing of your identity documents, basically one time but very well, and locking it down then forever ordinarily. Its not obvious when you work with a Smart Card.
Amy Sebring: That bridge is providing the capability for example, the transportation credential, to be recognized by other agencies and so forth?
Sal DAgostino: You get that as a result of following that process. You can trust something which has been very carefully issued, bound to a cryptographically sound thing, and then locked down but also set up so that you can have disaster recovery. Its easy to leverage it.
Kevin Reardon: Do you think that in states and locals to buy into this will be difficult?
Sal DAgostino: Always because its new, to some extent, and always again because its big, because it covers all uses of credentials. If you look at what it does and what it costs, many state organizations are already spending this on identity ______. Theyre running around with LCDs, one-time password devices, etc. What you will find if they look at it as an IT and security enterprise, is that this will save them money. It will save them money on shipping, on mailing, on administration, on insurance, on all sorts of fun things. There are a few states which are beginning to do it. A lot of states have implemented PKI, and have used it for a number of years and are now interested to know that they can use it for other things. I think it will be hard, but I dont think its impossible.
Amy Sebring: Are you aware of any grant guidance that currently includes compliance with this?
Sal DAgostino: The Responder Knowledge Base, which has been up for a long time, has got a lot of stuff related to this, but I dont remember the URL. [See https://www.rkb.us/.]
To a certain extent there is guidance to use FIPS 201 for credentialing in federal grants certainly. The UASI funding for the National Capitol Region was used specifically for that so its relatively easy to go back and say "I want to get some of that."
BK: What are the three basic problems and use cases being addressed by a FRAC card?
Sal DAgostino: Access control, getting into the Northern Virginia Transportation Center building, responding from that building to the Pentagon and getting past its security, and I guess a third would be the ability to then show up somewhere else in the country and establish the fact that you are a qualified transportation emergency responder. Quickly, these three.
Melanie Hooks: Will this expand to Medical Reserve Corps (MRC) or Emergency System for Advanced Registration of Volunteer Health Professionals [ESAR-VHP], being that these groups can be used as state assets?
Sal DAgostino: A number of the DHS demonstrations that FEMA has been doing for years now has reached out and included, as an example, the ESAR-VHP community of states like Pennsylvania. And the Health Volunteer Corps are an ESF typing easily supported, has been demonstrated with this for some time now. And a number of the states are going forward and are looking at that as a driver in its use case.
John Smith: Are you familiar with or working with Paragon Technologies out of the D. C. area? They are currently working with DHS and King County Washington OEM on resource management and personnel credentialing.
Sal DAgostino: Im not specifically aware of what Paragon is doing in King County. What I am familiar with is the fact that there is the WHTI card, which is the Western Hemisphere Travel Initiative, which is slightly different. Its not a FIPS 201 card; its a different kind of radio frequency card very much akin to what is used for electronic product code or sort of package tracking. Thats sort of being applied to people being tracked as packages going across the border. But I dont know if that is a specific King County application. There are around the country a number of people who have issues--access control badges to first responders. Again theres a difference between that and a FIPS 201 credential.
Dave Roop: Is any SWOT (strength, weaknesses, opportunity and threat) analysis available on using Smart Card identity system in emergency response?
Sal DAgostino: The white paper sort of goes through that. If you look at the threats associated with a Smart Card, other than environmental which is the contact chip. If it works, thats what NIST does, the National Institutes for Standards for Technology. Theyve got several special publications on computer assurance, information assurance, and identity assurance. This has been vetted by our nations experts and in fact, there are people that are using what Ive described here today who dont talk about it. This stuff has gone through that level of scrutiny and comment criteria, and all sorts of federal security standards. Its well over that bar.
LaChelle LeVan: Can you explain a little about the revocation process and why this is so important for the emergency responders and incident response? What is the difference between this federal FIPS 201 revocation process and just carrying around a regular badge with the privileges on it?
Sal DAgostino: Thats a great question. The difference is the FIPS 201 credential is not a flash pass. You can electronically validate whether or not that card is still good. And as LaChelle pointed out, its because the revocation, the status of that credential is public information. Its part of that cloud that I showed, but anybody who is issued a credential which uses a certificate of authority cross-certified by the Federal Bridge, in the place where theyre very careful about keeping this information, one of the basic things that they share is if the card is still good. That information can be distributed so that it is available almost anywhere. There are ways of compressing that information and making it random, so to speak, so that no one can use it, but yet at the same time being able to tell that that card is good.
It doesnt matter who is looking at it. If they have the authority to start and use a device that can accept that card, they can make that decision. Its very different from other credentials, including access control badges, which unfortunately havent gone through the rigor of making something that cant be copied. A lot of cards have been cloned and can be cloned, which are of generations earlier than this Smart Card technology. This is on the other side of that, I imagine.
If you cant clone it and you know whether or not its good or bad, and that person in front of you can show you, either through a PIN or a fingerprint or a facial image, that its you, you can trust it and its very, very different than previous generation of badges. I call them badges very specifically because theyre different from credentials.
Amy Sebring: When you refer to public information, Sal, you are talking within some constraints of privacy for personally identifiable information?
Sal DAgostino: Thats the beauty of it that the revocation information contains no personal identity information. Its simply the status of whether a credential is still good or bad. Theres no negative to making that information known, from a security perspective, from a privacy perspective. Getting out the fact that a persons credential has been lost or stolen or suspended or revoked is just a really good thing that everybody agrees to. And that just takes place as a result of taking this approach.
Amy Sebring: Time to wrap for today. Thank you very much Sal for an excellent job. Please stand by just a moment while we make a couple of quick announcements...
Again, the recording should be available later today and the transcript on Friday. If you are not on our mailing list and would like to get notices of future sessions and availability of transcripts, just go to our home page to Subscribe.
Don't forget to vote in our poll, and PLEASE take a moment to do the rating/review! Note: We are asking you to rate the relevance of the information, and this will assist our future visitors.
Please join us next time, January 28th when the current Chair of the National Emergency Management Association, (NEMA) will be with us to observe the 35th anniversary of that organization.
Thanks to everyone for participating today. We stand adjourned.
[Note: Mr. D'Agostino may be reached at firstname.lastname@example.org . He would be happy to get people in touch with their counterparts, in State, Local, Critical Infrastructure, Emergency Response and Federal government if they are interested in follow up or more details. He would also be happy to answer any additional questions that we didnt get to.]