Smart card program earns its wings

As the government's largest user of smart cards, the Air Force has at least one piece of advice for agencies embarking on their own smart card programs: Keep it simple. That makes it easier for the system developers and for the people who will be using the cards. And simplicity breeds success.

With the Air Force Standard Asset Tracking System (SATS), for example, a relatively straightforward smart card application has helped slash the amount of paperwork associated with the distribution of goods by 96 percent and reduced the time to issue assets by 81 percent, according to Air Force officials.

The change also helps the Air Force keep better track of the location of its assets, said Tommie Ellis, SATS project manager in the headquarters Standard Systems Group at Maxwell Air Force Base, Ala. "The system has given us better availability of our assets," Ellis said. "It has really been beneficial to us."

The Air Force has to keep track of items ranging from office and medical supplies to high-tech ammunition and aircraft components, so the service needed a more secure system than the bar code scanners used by overnight parcel delivery services, according to Ellis.

SATS' pioneering use of smart cards began as a pilot program in 1995. Ultimately, everyone in the Air Force will carry a Common Access Card for identification and for access to computer networks and secure facilities. They will also be able to use the cards for SATS. Smart card use moved even further into the Air Force mainstream on July 1 when SATS evolved from its special project status to became part of the Standard Base Supply System, Ellis said.

Today's SATS cards are second- generation devices that carry 8K of data, compared with the 2K capacity of the original cards, which remain in use, according to Peter Langworthy, director of the automatic identification technology center at the SATS integrator, Logicon Corp.

SATS uses Gemplus Corp.'s multiple-purse card with the EMV payment standard, which is also used by other customers for electronic payment applications, according to Magruder Dent, director of government and health care sales for Gemplus.

"SATS was one of the earliest systems that deployed smart cards," Dent said. "I think it has proven to be a very effective system." Until recently, the 8K cards were considered high-end devices but have since moved into the mainstream. The company also offers models with 16K and 32K of memory.

The strength of the SATS program was the Air Force's ability to resist the temptation to do too much, too soon, Dent said. "We saw programs stumble that tried to do too much, with too many applications on one card," he said. That isn't to say the technology can't handle multiple applications, only that it is better to get users accustomed to one or two applications before adding more, he said.

"The key to their success was the integration work," Dent said. "While smart cards can do a multitude of tasks, they limited it to one area and made it a bulletproof system."

For SATS, the smart cards are used to verify that the person signing to receive goods is authorized to receive them, and that he or she is in fact the correct person. "The smart card was used to replace a signature on a paper form," Langworthy said. "It provides a secure way to authenticate the customer."

When an Air Force delivery truck brings packages to a location, the technician can only release them to designated individuals, and those people must have the necessary security clearance to receive each item. Some items, such as aircraft parts, are restricted to recipients with certain security clearances, so a clerk who can sign for a crate of replacement parts for a support truck might not be able to also receive the fighter jet parts, Ellis said.

Previously, the delivery technician carried a list of people allowed to accept deliveries at each location and their clearance levels, according to Langworthy. Every package carried its own paperwork, and each had to be signed for individually.

Later, each sheet of paper was scanned into a computer and the paper copy was destroyed. This time-consuming step has been largely eliminated by the switch to an all-digital smart card system. The Air Force saw immediate productivity gains because the system freed workers for other tasks.

"The biggest efficiencies were gained in the document-control section," said Peter Ramirez of the Air Force automatic identification program management office.

Although staffing requirements vary depending on the size of the base, a medium-size facility such as Shaw Air Force Base, S.C., can serve as an example to illustrate the benefits of automation. With smart cards, the base was able to cut the staff in its receiving office from 11 people to four because assets can be handled and accounted for more efficiently, Ramirez said. And the document-control section went from six full-time workers to one part-time person, he added.

Using smart cards, the delivery technician inserts the "customer's" card into a handheld card reader. The card reader is a PC Card Type II device from Gemplus that is installed in a handheld PC from Intermec Technologies Corp. running the Microsoft Corp. Windows CE operating system.

The card tells the reader the customer's name, duty assignment and clearance level. That information is compared with the requirements for the item being delivered. The cardholder must then key in a personal identification number known only to the cardholder and stored only on the card itself.

The user gets three tries to enter the correct PIN before the reader denies the card.

If the number is entered correctly, the card generates a "token" that carries information about the transaction and delivers it to the card reader. At the end of the day, the delivery technician connects the handheld reader to a workstation and uploads all of the collected tokens to a database that tracks all the assets in the Air Force shipping system.

"All of the transactions are uploaded back in the warehouse," Logicon's Langworthy said. "It has eliminated the requirement for paper signatures.

With the smart card connected and authenticated by the PIN, the technician scans in each of the items the customer is signing for, just like a cashier running groceries over the bar code scanner at the supermarket. And like the supermarket scanner, the SATS scanner produces a distinctive beep when it successfully scans an item and compares it to the cardholders' information. The system gives an OK when the person can receive the item and gives a different beep if the transaction is not approved. In that case, the delivery person has to try to find someone else with sufficient clearance to sign for the delivery.

Carney is a freelance writer based in Herndon, Va.