GSA awards first PKI pact

The General Services Administration last week awarded the first in a series of contracts for public-key infrastructure services and products that will provide a way for all federal agencies to conduct business securely via the Internet.

GSA awarded Digital Signature Trust Co. a contract under the Access Certificates for Electronic Services program to provide encryption and digital signature technology and services. Other contracts could be awarded as early as Sept. 17.

ACES is intended to allow agencies to choose from several vendors' PKI solutions for programs and initiatives that will move agencies to a World Wide Web-enabled government. The solutions include not only encryption to ensure the confidentiality of information being processed but also the digital signatures that provide authentication of the identity of the sender and recipient.

Several agencies reportedly have been waiting for ACES to provide security for programs already under development.

"We can now show [agencies] an actual ACES offering and open those doors that had been closed for so long, and they can now start making concrete plans," said Judith Spencer, director of GSA's Center for Governmentwide Security.

PKI technology, which has many steps and functions, is considered one of the most complex security solutions on the market. Several larger federal agencies, in particular the Defense Department, are going their own way to procure PKI solutions. But the contract is intended to provide a way for other agencies to access the technology without going through the full procurement process.

The Social Security Administration has been working with GSA from the start, and although the agency is evaluating the contract and determining whether it will use ACES for any of its programs, this first award is a good sign, said Tony Trenkle, director of electronic services at SSA.

"I think it's a significant step forward because it provides a governmentwide contract for agencies to use," he said. "I know [GSA] has been very responsive to our concerns and needs...and we're pleased to see it awarded."

GSA still has to give the final accreditation for the Digital Signature Trust PKI product, but the ACES team is working with agencies to prepare them.

"We are working with agencies to get their applications going and get their house in order so that when the OK is going forward, there are applications to use [the contract]," Spencer said.

Many forces are coming together that are pushing federal interest in the contract, Trenkle said.

"I think there is stronger interest in using [ACES], and one of the reasons is the Government Paperwork Elimination Act.... But there is also increasing public interest in doing business over the Internet," he said.

GPEA requires all agencies to provide the public with the option of submitting government forms electronically whenever possible by October 2003. Congress also is working on several bills that will provide a legal basis for documents using electronic signatures, and that also is giving a push to agency feelings about ACES, Spencer said.