Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 09/11/06 issue

PIV cards: the insider threat

With HSPD-12 requirements kicking in soon, how will your agency prevent ID card theft?

By Dan Tynan, Special to GCN

Criminals have long known that one of the best ways to get fake identifications is to buy them from the people who issue the real things. In August 2005, several former Department of Motor Vehicles employees in Oakland, Calif., were implicated in a scheme to sell false identification cards to illegal aliens. So far, five former DMV workers and five outsiders have been charged with selling more than 200 fake IDs for $1,000 to $5,000 apiece. The investigation is ongoing.

But the Oakland case is hardly an isolated incident. Last March, the New Jersey State Attorney General’s office filed similar charges against two former Motor Vehicle Commission employees. Over the last two years, state employees in Arkansas, Maryland, Massachusetts, Nevada and elsewhere have been caught issuing fraudulent or unauthorized IDs.

Homeland Security Presidential Directive 12 requires all federal agencies to have issued Personal Identity Verification cards following the guidelines outlined in Federal Information Processing Standard 201. But FIPS-201 is hardly a bulletproof solution against the insider threat.

“There’s currently a huge problem with [ID card] fraud,” said Robert Brandewie, former director of the Defense Manpower Data Center in Monterey, California. “It’s significant because today’s technology allows you to create duplicate ID badges without a huge investment. It’s possible to make a credible fake of any identity card if your only authentication of the card is a guard looking at it as someone walks by.”

Combating insider fraud

Following FIPS-201 will reduce the risk of insider fraud, said Neville Pattinson, director of technology and government for Gemalto, an Austin, Texas-based manufacturer of smart-card technology. For example, FIPS-201 requires the use of smart cards, which embed secure silicon chips with operating systems and encrypted data and “are exponentially harder to fake,” he said.

But contactless smart cards can be cloned cheaply and easily, said Dan Bailey, RFID Solutions Architect for RSA Laboratories in Boston. FIPS-201 requires contact or “swipe” cards to be protected by an encrypted public/private key; agency employees have to provide a personal identification number or password to gain access to secure areas. But with contactless cards such protections are optional, in part because doing encryption wirelessly is expensive and time-consuming. And since contactless cards put out a radio signal that can be read from a distance, an identity thief could eavesdrop on an employee’s card without ever being detected.

More news on related topics: IT Security, Authentication / Identity Management, Homeland Security



GCN Popup