Enlarge / Sen. Ron Wyden of Oregon has pointed out a particular problem with Senate IT security: Senate staffers’ ID cards are essentially fake smartcards, useless for two-factor authentication. (credit: Getty Images/Justin Sullivan)
When Congress held hearings following the breach of the systems of the Office of Personnel Management (OPM) in 2015, one of the issues that caused great consternation among lawmakers was that the OPM had failed to implement two-factor authentication for employees, particularly when using virtual private networks. Federal information security standards in place at the time called for strong user authentication for any federal information system, but the OPM hadn’t figured out how to implement two-factor authentication principles—something users know (a password), plus something they have (which, in government, is typically a “smartcard” ID with digital authentication keys programmed onto a chip).
The OPM wasn’t alone. While the Department of Defense began issuing Common Access Cards in 2008 to be used for two-factor authentication on DOD systems and to control physical access to DOD facilities, most of the civilian agencies of the US federal government still hadn’t implemented their own smartcard (Personal Identity Verification, or PIV) systems at the time of the OPM breach.
What a real smartcard ID looks like: the DOD’s Common Access Card. (credit: Department of Defense)
The Government Accountability Office repeatedly warned of gaps in federal information security, including the lack of two-factor authentication on critical federal systems like those at OPM. And during President Barack Obama’s “cyber-sprint,” many more agencies did roll out smartcards for authentication.