DHS falls behind in issuing HSPD-12 ID cards, IG reports

Homeland Security Department has issued less than 6 percent of the Personal Identity Verficiation cards mandated by the White House

The Homeland Security Department is nearly three years behind in getting Personal Identity Verification (PIV) cards for its employees and contractors, according to a new report from DHS Inspector General Richard Skinner.

Under Homeland Security Presidential Directive-12 (HSPD-12), the White House ordered federal agencies to issue secure federal ID cards by October 2008.

DHS was granted an extension, but now expects to miss its extended deadline of December 2010, Skinner wrote in the Feb. 16 report. The department anticipates it will not complete issuing the cards until September 2011.

As of five months ago, DHS had issued about 15,600 ID cards to its employees and contractors, out of a total of about 275,000 to be issued, according to the report.

The report said DHS' Transportation Security Administration had issued only five cards, Immigration and Customs Enforcement had issued eight cards and  Customs and Border Protection issued nine cards, while DHS headquarters distributed more than 11,800 cards.

Skinner blamed the delays on weak program management, insufficient funding and resources, and a change in implementation strategy midway through the program.

In addition, Skinner said he identified shortcomings with system configuration management, separation of duties, biometric checking, certification and accreditation, account roles and privileges, and card controls.

Problems with the PIV cards appear to be ongoing, Skinner wrote. “Despite the progress made, DHS still faces further delays and significant program and system management challenges in implementing an effective HSPD-12 program.”

“DHS does not have a plan to successfully implement a robust program to increase physical and logical access security within the department. The absence of an HSPD-12 program implementation plan, department-wide deployment strategy, and sufficient resources are hindering progress,” the report said.

The IG made 15 recommendations for change, and DHS officials agreed with the recommendations and said they have begun implementing them.

About the Author

Alice Lipowicz is a staff writer covering government 2.0, homeland security and other IT policies for Federal Computer Week.

Reader comments

Tue, Sep 21, 2010

We have the HSPD-12 cards but it's another matter to get the federal building to put in readers for them. That's another area that needs to be enforced. Our fed. bldg. uses cards issued by the Marshalls not the HSPD-12 cards. We are building a new federal bldg, I asked if HSPD-12 reader would be installed. I was told "no," the Marshalls are in charge of that. So there is a lack of enforcement to force the federal building to use them.

Wed, Feb 24, 2010 Washington DC

Who would have guessed after all of the Standards Development by NIST with Leadership from the Interagency Advisory Board and the Private Sector that DHS would find themselves reading another article about Organizational and Program shortcomings, especially one that is truly not that hard to deliver. Another extension is almost inexcusable neglect and anyone associated with that proposal should be filling out their resume and looking for work. Small Federal Agencies, Big Federal Agencies and States have working successful programs. Our agency sent staff to DHS in 2004 to help them understand HSPD-12. This has the makings of the Leadership associated with Katrina written all over it!

Thu, Feb 18, 2010

Three years ago, a team working for the DHS Program Office developed and implemented a fully functional PIV Issuance platform. The team had a fully certified and accredited system with a subordinated certificate authority to the DHS root CA. We issued the first DHS PIV cards, which were compliant with NIST 800-76-1 requirements. The project was shut down by politics stemming from the HSPD-12 program office. This decision to shut our team down purely by political motivation delayed the rollout by 3 years and added several million additional dollars to the budget. From a taxpayer’s perspective, I'm glad the IG was able to surface the mismanagement and poor leadership prevalent within the HSPD-12 program office.

Thu, Feb 18, 2010

Why reinvent the wheel? DoD CAC system has been up and running for years. Either outsorice the card service to DoD, and piggyback on existing system, or set up another instance of their system and hire DoD to train the operators. It ain't perfect, but it works.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above