DHS gets HSPD-12 extension

The Office of Management and Budget repeatedly has said it would not extend the Oct. 27, 2008, deadline for agencies to implement Homeland Security Presidential Directive 12. But four departments have convinced OMB to make exceptions. OMB has granted extensions to the Defense, Homeland Security, State and Veterans Affairs departments. Some experts say that DOD, State and possibly VA have a legitimate need for the delay but that DHS’ extension casts doubt on the Bush administration’s dedication to the HSPD-12 mandate. OMB’s decision also sends a message to other agencies that are struggling to comply with HSPD-12. “Why give the people who need this the most an extension?” asked a federal official who is involved in an HSPD-12 implementation. “It doesn’t make sense.”DOD, for instance, has issued more than 3 million cards under its old smart card standard, and it wouldn’t be cost-effective to issue new cards or fix all of them at once. State’s extension is only for its overseas facilities, sources say.“No agencies have received ‘extensions,’” said Karen Evans, OMB’s administrator for IT and e-government. “All agencies have mutually agreed-upon plans in place, including DHS. Implementation plans were reviewed and took into consideration key milestones as well as the factors involved in integrating their physical and logical access using the HSPD-12 credential.”OMB’s deputy general counsel confirmed to the DHS inspector general that OMB had granted the department an extension to implement HSPD-12. DHS must begin issuing HSPD-12-compliant cards next month, complete issuing 80 percent of the cards by December 2008 and issue the remaining 20 percent by December 2010.Even with the extension, DHS might not meet its 2010 deadline, according to a recent IG report. Although the department has taken steps to meet the mandate for issuing personal identity verification cards, DHS must better manage its HSPD-12 program, the IG said. The department has failed to give its components sufficient guidance on how to implement the directive, according to the audit. “OMB asked for a realistic time frame to meet the deadline, and we submitted a plan and they approved it,” said Cynthia Sjoberg, DHS’ HSPD-12 program manager, adding that DHS wanted an operational system. “We just didn’t want to issue cards.”Sjoberg said DHS will award a blanket purchase agreement in the near future that will be mandatory for all agency components to use to implement HSPD-12. “We will set up a card-management system and an identification-management system that will be mandatory for all components to use,” she said. She declined to comment further on the procurement because it is under evaluation. However, industry sources say DHS has asked for best and final proposals from BearingPoint, EDS and XTec. Even with DHS’ latest effort to comply with the HSPD-12 mandate, federal and industry experts criticized the department’s commitment. Among its missteps, DHS has not reported its implementation progress as required by OMB, according to the IDManagement.gov Web site.“It doesn’t surprise me, and I am disappointed,” said another federal official involved in an HSPD-12 implementation. DHS “should be leading the effort.”Sjoberg rejects the claim that DHS is not taking the initiative seriously. She said the department met all of its previous OMB-mandated milestones in 2005 and 2006. “We don’t put our numbers on the Web for security reasons,” she said. “We asked OMB if we could report our numbers directly to them. We don’t want to be vulnerable to data mining.”The government official added that the news of DHS’ extension would most likely inspire other agencies to r equest delays.OMB might have launched that conversation in an Oct. 26 memo from Evans. The memo asked agencies to “either confirm your current plan is still on target or update your plan with a revised schedule under which your agency will meet as soon as possible the requirements of HSPD-12 and associated policy memoranda.”The official said that once OMB backed off the deadline, agencies saw they could  wait for the end of the Bush administration and not have to implement HSPD-12.Another agency official said every agency probably needs an extension, for many of the same reasons that DHS does.