FAA Turns To Smart Cards To Increase Airport Security

The Federal Aviation Administration said last week it will develop standards for airport security based on smart-card, encryption, and biometric technologies.

The FAA will release specifications and technology details for the smart cards by next month. It wants to distribute the cards to all airline, airport, and FAA employees, as well as cargo shippers and food-service personnel, by 2004. It has settled on Java as the programming language for coding the cards but is still assessing two-dimensional bar codes, biometrics, magnetic stripes, encryption and authentication, and radio-frequency transmitters that would be put on the cards, says Phillip Loranger, chief of the Access Enabling Technology Team in the FAA's Information Systems Security unit. The cards, embedded with 32-bit or 64-bit chips, will contain an individual's photo, personal demographic information, and biometric data such as facial recognition or fingerprint identification.

The FAA hasn't determined the types and locations of databases that would contain airport-access information. "They could be local databases at each airport, or it could be one centralized database," says Mike Brown, the FAA's director of information security. A local database would store all information about employees at that airport, including cargo shippers and food-service personnel. A centralized database, which would be tougher to maintain, could store information for all airports.

Airlines may roll out smart cards to travelers, but the FAA would have to link the smart-card databases to government databases containing criminal and terrorist records. Within three weeks, airlines at John F. Kennedy Airport in New York, Washington-Dulles International Airport, and others, will work with biometric-and security-systems provider Securcom International to test a biometric program, BioPass. Under the program, select frequent fliers will bypass security hassles by using their boarding pass and a smart card that contains their fingerprints. To protect the airlines' passenger data, each airline will have its own database, a decision that made the project more complex and costly than operating a single database.