ID cards have moved a step forward in the US. A new standard has been approved by the Commerce Secretary. The approval paves the way for common smart card-based systems.

the Personal Identity Verification system (PIV) has to be implemented to "the maximum extent possible practicable." by October 25th. The deadline was laid down by a Homeland Security Presidential Directive, that mandated the card.

As with a proposed UK identity card, technical and operational hurdles are likely to be high.

The National Institutes of Standards and Technology (NIST) had been given only 6 months to draw up the standard. Included are forms of identity that are reliable and secure for federal employees and contractors. Additionally the card has to be fraud resistant and able to be authenticated electronically.

Agencies that have to comply with the standard will also have to move fast. By 25th June, they have to submit plans on how they intend to comply. A further 4 months and they will have to be in initial compliance.

Initial compliance will mean applications which will use the cards to have common ID and security requirements. A year on, phase 2 will require the agencies to actually deliver the cards to employees.

The US card will only be issued to government employees and contractors for the purposes of identifying them when trying to access IT systems or physical access. National security and facilities are not covered.

The card itself will have a both a digital and printed photo of the holder. Magnetic strip and bar code will also appear. A programmable chip with both contact and wireless interfaces. Biometrics, initially only for fingerprints are included.

Federal Information Processing Standard 201 specifies the operational and technical requirements for the PIV system.

Related Articles
WebMethods and Common Criteria
Iconix Joins Anti-Phishing Working Group
Identity Theft Concerns Hit Online Economy
Discover Tops Identity Theft Protection Survey
Spyware Action In the U.S.
RSA SOX Compliance Tool