DHS gets HSPD-12 extension

Department officials say they are committed to making smart card ID program operational

HSPD-12 off to a slow start

The General Services Administration’s Homeland Security Presidential Directive 12 Managed Services Office has issued only 32 cards and has 17 of 67 agencies qualified to begin enrolling employees. But Mike Butler, the MSO’s program manager, said he isn’t worried yet.

About 85 percent of the MSO’s anticipated 850,000 customers are located in those 17 agencies, which include some of the largest departments such as GSA, Agriculture, Commerce and Energy.

“We will try to get all 67 customers ready to issue cards by Jan. 1,” Butler said at a recent Interagency Smart Card Advisory Board meeting in Washington. “We will spend our time with our biggest customers because they will be the ones who will bring the cards to market. The first five customers will begin the chain of trust.”

Butler added that the MSO plans to open 50 enrollment centers by Jan. 1, depending on how soon agencies can make their data available for enrollment and card issuance. There are seven stations open now, all of them in Washington.

— Jason Miller

The Office of Management and Budget repeatedly has said it would not extend the Oct. 27, 2008, deadline for agencies to implement Homeland Security Presidential Directive 12. But four departments have convinced OMB to make exceptions.

OMB has granted extensions to the Defense, Homeland Security, State and Veterans Affairs departments. Some experts say that DOD, State and possibly VA have a legitimate need for the delay but that DHS’ extension casts doubt on the Bush administration’s dedication to the HSPD-12 mandate. OMB’s decision also sends a message to other agencies that are struggling to comply with HSPD-12.

“Why give the people who need this the most an extension?” asked a federal official who is involved in an HSPD-12 implementation. “It doesn’t make sense.”

DOD, for instance, has issued more than 3 million cards under its old smart card standard, and it wouldn’t be cost-effective to issue new cards or fix all of them at once. State’s extension is only for its overseas facilities, sources say.

“No agencies have received ‘extensions,’” said Karen Evans, OMB’s administrator for IT and e-government. “All agencies have mutually agreed-upon plans in place, including DHS. Implementation plans were reviewed and took into consideration key milestones as well as the factors involved in integrating their physical and logical access using the HSPD-12 credential.”

OMB’s deputy general counsel confirmed to the DHS inspector general that OMB had granted the department an extension to implement HSPD-12. DHS must begin issuing HSPD-12-compliant cards next month, complete issuing 80 percent of the cards by December 2008 and issue the remaining 20 percent by December 2010.

Even with the extension, DHS might not meet its 2010 deadline, according to a recent IG report. Although the department has taken steps to meet the mandate for issuing personal identity verification cards, DHS must better manage its HSPD-12 program, the IG said. The department has failed to give its components sufficient guidance on how to implement the directive, according to the audit.

“OMB asked for a realistic time frame to meet the deadline, and we submitted a plan and they approved it,” said Cynthia Sjoberg, DHS’ HSPD-12 program manager, adding that DHS wanted an operational system. “We just didn’t want to issue cards.”

Sjoberg said DHS will award a blanket purchase agreement in the near future that will be mandatory for all agency components to use to implement HSPD-12.

“We will set up a card-management system and an identification-management system that will be mandatory for all components to use,” she said.

She declined to comment further on the procurement because it is under evaluation. However, industry sources say DHS has asked for best and final proposals from BearingPoint, EDS and XTec.

Even with DHS’ latest effort to comply with the HSPD-12 mandate, federal and industry experts criticized the department’s commitment. Among its missteps, DHS has not reported its implementation progress as required by OMB, according to the IDManagement.gov Web site.

“It doesn’t surprise me, and I am disappointed,” said another federal official involved in an HSPD-12 implementation. DHS “should be leading the effort.”

Sjoberg rejects the claim that DHS is not taking the initiative seriously. She said the department met all of its previous OMB-mandated milestones in 2005 and 2006.

“We don’t put our numbers on the Web for security reasons,” she said. “We asked OMB if we could report our numbers directly to them. We don’t want to be vulnerable to data mining.”

The government official added that the news of DHS’ extension would most likely inspire other agencies to r equest delays.

OMB might have launched that conversation in an Oct. 26 memo from Evans. The memo asked agencies to “either confirm your current plan is still on target or update your plan with a revised schedule under which your agency will meet as soon as possible the requirements of HSPD-12 and associated policy memoranda.”

The official said that once OMB backed off the deadline, agencies saw they could  wait for the end of the Bush administration and not have to implement HSPD-12.

Another agency official said every agency probably needs an extension, for many of the same reasons that DHS does. 

Featured

  • Cybersecurity

    DHS floats 'collective defense' model for cybersecurity

    Homeland Security Secretary Kirstjen Nielsen wants her department to have a more direct role in defending the private sector and critical infrastructure entities from cyberthreats.

  • Defense
    Defense Secretary James Mattis testifies at an April 12 hearing of the House Armed Services Committee.

    Mattis: Cloud deal not tailored for Amazon

    On Capitol Hill, Defense Secretary Jim Mattis sought to quell "rumors" that the Pentagon's planned single-award cloud acquisition was designed with Amazon Web Services in mind.

  • Census
    shutterstock image

    2020 Census to include citizenship question

    The Department of Commerce is breaking with recent practice and restoring a question about respondent citizenship last used in 1950, despite being urged not to by former Census directors and outside experts.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.