Former U.S. Defense Director Talks Smartcards In Australia

A former U.S. Department of Defense (DoD) director who oversaw the implementation of 11 million smart cards for military personnel met with federal government agencies in Canberra last week.

Minister for Human Services Joe Hockey confirmed briefing sessions were held with Robert Brandewie, former director of the Defense Manpower Data Center, which provides information services for DoD’s military personnel, civilian employees and contractors.

Brandewie, who also met with AGIMO, gave a firsthand account of the challenges surrounding the U.S. DoD’s Common Access Card program, which issued more than 11 million smart cards by August 2006.

Hockey is overseeing the introduction of Australia’s own health and social services access card, which will replace 17 existing welfare cards and will link Medicare, Centrelink and the Department of Veterans Affairs.

The access card will be phased in over two years from 2008 at a cost of more than 1 billion Australian dollars (US$755.2 million).

Brandewie is senior vice president of public sector solutions for security vendor Actividentity, which was the provider in the CAC program.

He said non-technical issues such as implementing the right policies are the biggest challenge in smart card rollouts.

The right standards and policies will extend the life of the card system.

“But the single most important factor in terms of security is how the cards are issued to the population,” Brandewie said.

“While the underlying infrastructure may be secure, the delivery system has to be right to get the card to the correct person.”

Brandewie said card-based systems provide multifactor authentication with layers of protection.

To secure the Common Access Card program data, he said the Department of Defense also used PKI technology for transactions.

“Australians are sensitive to privacy concerns, but what data goes on the card is really a policy issue,” he said.

“The level of authentication you do on the identity has nothing to do with the card.”

Brandewie suggested a system could have three stages of identity assurance—high, medium and low—linking the value of the actual transaction to the level of identity assurance required.

“We [ActiveIdenity] have a big advantage because we know where the potholes are in the road,” Brandewie said.

“The other big advantage we have is the ability to securely update the card if changes are required or if the card needs new capabilities.”

By Michael Crawford, Computerworld Australia

Keep checking in at our Security Feed for updated news coverage.