Creating uniform security across the police force

Identity and access management (IAM) remains a huge challenge for police forces throughout the country, as Holly Sacks explains.

Enabling employees to quickly and securely access data and facilities has always been a high priority. The growing number of data sources now available to police is making it more critical than ever that the right people have access to the information they need, and that this data can be assessed and monitored in a secure way.

However, a legacy of disparate IT systems with little ability to work together means that this is no small undertaking. Police forces in different regions currently have different levels of access to different systems, each of which has its own IT platform and its own access control platform.

The National Policing Improvement Agency (NPIA) has launched a review of identity and access management (IAM) processes within the police force that is designed to bring these systems together in the best way possible. As a core part of the review, the NPIA is aiming to provide every police officer in the UK with a multi-application smart card that can combine logical and physical security.

The project focuses on authenticating the identity of officers and civilian staff who access police systems via a single user identity that can work across all police systems. With police increasingly accessing confidential data via mobile devices, in-car units and station-based PCs, the ability to safely access systems from any location will also cut costs incurred through travel, while boosting the time available for frontline policing.

A nationally-aligned smart card system would also reduce the IT and administrative costs associated with resetting forgotten usernames and passwords, and it would conserve man hours spent on these tasks.

The police face constant demands to be a more visible presence on our streets and the ability to access IT systems with a single smart card minimises downtime spent on administrative tasks, and freeing up officers to get on the beat.

Another interesting potential application for smart card technology is in securely checking out firearms from a police station. Every time a police officer takes a weapon out of the police station, he or she has to show a warrant card to the person in charge of the armoury; that person will inspect the warrant card and sign a piece of paper; the paper is countersigned by the officer in charge; and only then does the requesting officer take receipt of the weapon. When the weapon is returned, the process is repeated.

This kind of convoluted process is a prime example of one that could be handled electronically with a combination of radio frequency identification (RFID) tags on the firearms themselves, a contactless smart card for the officer and a contactless card smart reader at the checkout point.

As forces across the country look to combine their logical (IT) security and physical access control into one multi-purpose system, there are several options open to them.

The most basic form of secure access control is the magnetic stripe – or ‘mag-stripe’ – card, where magnetic data is stored on the back of the card. While mag-stripe cards are inexpensive to produce, they can be more costly in terms of maintenance. Magnetic stripe cards come in contact with the reader when inserted, and any debris that collects on the card inevitably ends up inside the reader and on its contact pins. They are also susceptible to magnetic interference and wear and tear: constant swiping through the card reader causes the stripe to deteriorate and eventually fail. This type of card is also extremely restricted in terms of its data storage capacity compared to that of smart cards, some of which now have up to 164K of memory.

But perhaps their biggest disadvantage is that they are very easy to clone. You can even buy a mag-stripe reader from a high-street store that will let you take data off one of these cards and use it to create an unlimited number of clo