1. Federal Approach to Electronic Credentials For services to citizens, businesses, other governments, and employees Mary J. Mitchell Office of Electronic Government mary.mitchell@gsa.gov web: egov.gov Federal PKI efforts: www.cio.gov/fpkisc

2. E-Government Management Initiative Vision: deliver an order of magnitude improvement in the federal government’s value to the citizen. Integral Part of President’s Management Agenda Definition: use of digital technologies to transform government operations in order to improve effectiveness, efficiency, and service delivery. The Principles: r Citizen-centered, Market-based, Results- oriented r Simplify & Unify

3. E-Gov’t Services Landscape Internal Effectiveness and Efficiency Government to Government Government to Business Government to Citizen

4. When Web Interactions Need Strong Security To protect privacy, government must know whom it is dealing with Operations exceed reasonable risk User Authentication –Knowing who your correspondent is Transaction Integrity –Ensuring the message sent is the message received Non-Repudiation –Correspondent cannot deny conducting transaction Confidentiality –Only authorized persons can read the message

5. Identity Credentials Driver’s License Employee Identification Card Passport Birth Certificate Physical Presence Social Security Number Signature Electronic Credentials (including PKI Certificates)

6. Obstacles to Issuing Citizens Digital Certificates Some populations (e.g., students, low- income) lack sufficient means for identity proofing like a credit history, permanent address, etc. Certain individuals object to divulging personal information (lack of trust in who and if adequately safeguarded) Cost and administrative complexity of the certificate issuance

7. E-Gov’t Strategy: Solutions to Barriers Incorporates PKI

8. eAuthentication Direction Simplify and Unify Efforts focused on PMC approved E-Gov e-Authentication Initiative and tie to Firstgov Assist other E-Gov’t initiatives in defining their identity authentication needs Develop applications for cross-governmental use Coordinate aggregated buy of authentication products and services Promote interoperability with other entities through FBCA

9. Factors Privilege Management Signature Required Identity Verification Required Identity Verification Not Required Low Risk High Risk General Information Change Request Benefits Application Personal Information Proprietary Information

10. Gateway Citizen Business Agent Academia Health Care State Government FBCA Identity Verification Required Identity Verification Not Required Credential Validation Process eAuthentication Gateway

11. Cross Certified CAs Directory System Agent Cross certificates CRL FIP 140-1 L3 Crypto Cross certificates CRL Cross certificates ARL Trust Domain 1Trust Domain 2 Directory Infrastructure 2 Directory Infrastructure 1 Federal Bridge Certification Authority

12. Selected Agency PKI Efforts The Evolving Federal Public Key Infrastructure document: www.cio.gov/fpkisc Department of Labor’s Career Management Account National Institute of Standards’ Advanced Technology Grants System Social Security Administration’s Wage Reporting and Medical Evidence Drug Enforcement Agency’s Electronic Prescriptions for Controlled Substances

14. Nat’l Institute ofStandards and Technology (NIST) ACES used for the electronic submission and review of proposals for the Advanced Technology Program (ATP) Uses digitally signed documents to send proprietary information over the Internet, digitally signs and encrypts forms, captures data and populates ATP database Uses a web server for downloads/ submission of forms and documents, then pulls them behind NIST and ATP firewall Pilot with 12 proposal submissions completed in Sept 2001 Goes “live” for ATP’s FY2002 competition

15. Social Security Administration (SSA) Piloting ACES Digital Signature Certificates for on-line annual wage reporting Following pilot, SSA had a 90 percent approval by the 100 businesses participating Automating W-2 submissions critical to agency where nearly 6.5 million employers submit over 240 million W-2 forms for their employees Continuing to expand pilot capabilities and implementing digitally signed forms

16. SSA’s Electronic Medical Evidence Pilots. California Third party providers submit encrypted Medical Evidence of Record and encrypted and signed Consultative Exams Using Secure e-Mail Expanding to include Web based Secure Messaging and Secure FTP SSA/VA Mississippi requests Medical Evidence from VAMCs in Jackson and Biloxi. VAMCs send encrypted response to DDS via secure e- mail. Phase I decreased turnaround time from 25 days to 3

17. DEA’s Controlled Substances Secure electronic transmission of controlled substance prescriptions Reduces prescription forgeries and medical mistakes Pharmacists, Medical practitioners, Long term care facilities Pilot program in concert with Veterans Administration (VA) Outpatient Pharmacies Baltimore Technologies UniCert CA Office of Diversion Control May 2001

18. In the future, what role does PKI play? PKI is not the answer for all needs but it can add the required authentication for trustworthy e-gov services Using PKI technology for strong authentication needs addresses mandates such as HIPPA and eSign Federal bridge CA facilitates unifying islands of automation e-Authentication initiative will organize authentication needs for critical government business lines

19. Closing Words The Vision: Enable e-Government through –A cross-governmental, ubiquitous, interoperable Public Key Infrastructure. –The development and use of applications which employ that PKI in support of Agency business processes. Government-wide initiatives include: –Federal PKI Policy Authority –Federal Bridge Certification Authority –Access Certificates for Electronic Services –Leveraging other authentication investments where appropriate