US Government developing standard for positive identification

According to Privacy Digest, the National Institute for Science and Technology is developing a national standard for positive indentification of government employees and contractors. The following is a general introduction to the project, from a working paper released on the NIST site:

The “Personal Identity Verification for Federal Employees and Contractors” briefing was developed in response to the Homeland Security Presidential Directive (HSPD-12). The directive sets a policy for a common identification standard for Federal employees and contractors. It also establishes the high level requirements to be satisfied in the Personal Identity Verification standard.

The following information is intended to convey current thinking regarding the NIST response to the HSPD. The concept and design decisions contained herein are tentative and subject to change in the course of consultations with affected Federal government departments and agencies.

A general threat facing government agencies is the unauthorized access to physical facilities or logical assets under the protection umbrella of the PIV system and in which a PIV card is employed in access control processes. Specific examples of threats to government resources include the following:

• Cardholder makes improper use of a valid card
• Counterfeit cards are used to intercept or gain access to stored information
• Stolen or borrowed cards are used to gain unauthorized access
• PIN information is captured / intercepted through passive surveillance
• Lower sensitivity rated cards are used to gain access to more sensitive and critical assets.

HSPD-12 mandates a government-wide standard for secure and reliable forms of identification. The policy further defines the following criteria for a secure and reliable form of identification. The identification standard (PIV FIPS 201) will be:

• Based on sound criteria to verify an individual employee’s identity
• Strongly resistant to fraud, tampering, counterfeiting, and terrorist exploitation
• Rapidly verifiable electronically
• Issued by providers whose reliability has been established by an official accreditation process
• Applicable to all government organizations and contractors
• Used to grant access to Federally controlled facilities and information systems
• Flexible enough for agencies to select the appropriate security level for each application by providing graduated criteria from least secure to most secure
• Not applicable to identification associated with national security systems
• Implemented in a manner that protects citizens’ privacy

The program working paper is available at http://csrc.nist.gov/piv-project/Papers/Narration-PIV-Briefing10-1.doc and a slideshow from the project briefing is available at http://csrc.nist.gov/piv-project/Papers/PIV-BriefingSept16-2004.pdf.

Thanks to Privacy Digest for the pointer.

This is a complete aside, but I found it very interesting that the word document above is loaded with metadata, showing the last minute revisions that were made to it before the briefing. The tone of the narrative was shifted slightly. To see the changes, open the document, right-click on the toolbar above the document, select "Reviewing" and, on the toolbar that appears, select "Final, showing changes" in the drop-down box. Voila, you can see the revisions made.

Lucily for NIST, the document it is not full of "notes to draft" or anything significantly embarrasing. It is a bit surprising in any event that the organization responsible for IT security standards is posting metadata-laden documents on its website!