WASHINGTON, DC -- (Marketwire) -- 01/17/13 -- The International Biometrics & Identification Association (IBIA) strongly disagrees with recent media articles that conclude that the Transportation Worker Identification Credential (TWIC) program "doesn't work" or is "broken."(1) Several recent media articles have cited a public notice by the Department of Defense (DOD) as evidence supporting their conclusion.

According to Tovah LaDier, IBIA's Managing Director, "What appears to have happened is that people who are not familiar with the intricacies of the TWIC program or have not thoroughly investigated the subject matter have taken a simple DOD announcement out of context, thereby undermining a valuable, successful, and important national security program." She further stated, "Several analysts interpret the DOD policy statement to mean that TWIC cards are not secure and have painted TWIC as a 'failed' program. This could not be further from the truth."

As background, the TWIC program is a maritime security program that is jointly managed by the Transportation Security Administration (TSA) and the U.S. Coast Guard. The U.S. Army Military Surface Deployment and Distribution Command (SDDC) issued a notice(2) in the Federal Register (FR) on December 10, 2012 that rescinded a previous policy that permitted commercial users to use their TWIC cards to access a DOD website providing defense logistical transportation applications. The FR notice states that "TWIC does not meet DOD security standards and cannot be used as of January 29, 2013."

The TWIC card is a highly secure and tamper-resistant "smart" card identification credential with sophisticated features such as an integrated circuit chip, digital certificates, and biometric identifiers. The TWIC card was mandated by Congress through the Maritime Transportation Security Act of 2002. Congress always intended for TWIC cards to be used to enhance the security of the nation's maritime infrastructure by confirming the identity of transportation workers seeking unescorted access to secure areas of regulated maritime facilities and vessels. TWIC cards were never intended to be used for on-line access.

It is not clear why DOD allowed access to one of its computer systems using a TWIC card in the first place. However, if the writers of the previously referenced articles had researched the background of the DOD FR notice, they would have learned that the reason behind the DOD policy change was that DOD realized that the TWIC card was not cross-certified with the Federal Public Key Infrastructure (FPKI) as required by DOD policy. The FPKI is administered by an interagency body set up to enforce digital certificate standards for trusted identity authentication across federal agencies and between federal agencies and outside bodies, like universities, state and local governments, and commercial entities. The TWIC card was never intended for use in this type of on-line federated identity authentication infrastructure.

TWIC digital certificates have always been based on TSA's own self-managed Certificate Authority (CA) for issuing and revoking the digital certificates contained on the TWIC card. The TWIC card did not suddenly change or become "weak" in terms of its security. In IBIA's view, DOD simply realized that the TWIC card was not in compliance with its own policy that digital certificates used to access DOD web applications be cross-certified with the FPKI.

DOD recognizes that the TWIC is a secure credential and that the TWIC issuance process, with its rigorous background screening and vetting, is trustworthy for determining eligibility for physical access to DOD military facilities and installations. In its recently updated DOD Directive (DTM 09-12)(3), DOD declares that the TWIC card meets DOD access control standards for non-DOD personnel seeking physical entry to DOD installations and facilities. The Directive states that "The Transportation Worker Identification Credential (TWIC) holders vetting, adjudication, and issuance process is comparable to the NACI and/or National Agency Check with Law and Credit or, when implemented, OPM Tier I standard, and shall be considered identity proofed."

IBIA believes that the TWIC program is an important contributor to the security of the nation. The TSA has conducted a thorough background check and security threat assessment on 2.4 million TWIC card holders. Those individuals who had disqualifying criminal offenses or who represented a threat to our security have been screened out and are no longer welcome in the most sensitive areas of our critical transportation infrastructure. The hard-working people of the TSA and Coast Guard deserve our thanks and appreciation for their efforts in making our nation safer.

ABOUT IBIA. IBIA is a non-profit trade group that advocates and promotes the responsible use of technologies for managing human identity. It fulfills its mission through advocacy, education and outreach. For more, please visit www.ibia.org

(1) For an example article, see http://www.wnd.com/2013/01/420-million-tsa-program-doesnt-work/
(2) See Federal Register Vol. 77, No. 237, Page 73455
(3) Department of Defense Directive-Type Memorandum (DTM) 09-012, "Interim Policy Guidance for DoD Physical Access Control" dated December 8, 2009 and re-issued on September 9, 2012.