Click here to close now.


News Feed Item

Recent Trade Press Articles Inaccurately Depict TWIC Program

WASHINGTON, DC -- (Marketwire) -- 01/17/13 -- The International Biometrics & Identification Association (IBIA) strongly disagrees with recent media articles that conclude that the Transportation Worker Identification Credential (TWIC) program "doesn't work" or is "broken."(1) Several recent media articles have cited a public notice by the Department of Defense (DOD) as evidence supporting their conclusion.

According to Tovah LaDier, IBIA's Managing Director, "What appears to have happened is that people who are not familiar with the intricacies of the TWIC program or have not thoroughly investigated the subject matter have taken a simple DOD announcement out of context, thereby undermining a valuable, successful, and important national security program." She further stated, "Several analysts interpret the DOD policy statement to mean that TWIC cards are not secure and have painted TWIC as a 'failed' program. This could not be further from the truth."

As background, the TWIC program is a maritime security program that is jointly managed by the Transportation Security Administration (TSA) and the U.S. Coast Guard. The U.S. Army Military Surface Deployment and Distribution Command (SDDC) issued a notice(2) in the Federal Register (FR) on December 10, 2012 that rescinded a previous policy that permitted commercial users to use their TWIC cards to access a DOD website providing defense logistical transportation applications. The FR notice states that "TWIC does not meet DOD security standards and cannot be used as of January 29, 2013."

The TWIC card is a highly secure and tamper-resistant "smart" card identification credential with sophisticated features such as an integrated circuit chip, digital certificates, and biometric identifiers. The TWIC card was mandated by Congress through the Maritime Transportation Security Act of 2002. Congress always intended for TWIC cards to be used to enhance the security of the nation's maritime infrastructure by confirming the identity of transportation workers seeking unescorted access to secure areas of regulated maritime facilities and vessels. TWIC cards were never intended to be used for on-line access.

It is not clear why DOD allowed access to one of its computer systems using a TWIC card in the first place. However, if the writers of the previously referenced articles had researched the background of the DOD FR notice, they would have learned that the reason behind the DOD policy change was that DOD realized that the TWIC card was not cross-certified with the Federal Public Key Infrastructure (FPKI) as required by DOD policy. The FPKI is administered by an interagency body set up to enforce digital certificate standards for trusted identity authentication across federal agencies and between federal agencies and outside bodies, like universities, state and local governments, and commercial entities. The TWIC card was never intended for use in this type of on-line federated identity authentication infrastructure.

TWIC digital certificates have always been based on TSA's own self-managed Certificate Authority (CA) for issuing and revoking the digital certificates contained on the TWIC card. The TWIC card did not suddenly change or become "weak" in terms of its security. In IBIA's view, DOD simply realized that the TWIC card was not in compliance with its own policy that digital certificates used to access DOD web applications be cross-certified with the FPKI.

DOD recognizes that the TWIC is a secure credential and that the TWIC issuance process, with its rigorous background screening and vetting, is trustworthy for determining eligibility for physical access to DOD military facilities and installations. In its recently updated DOD Directive (DTM 09-12)(3), DOD declares that the TWIC card meets DOD access control standards for non-DOD personnel seeking physical entry to DOD installations and facilities. The Directive states that "The Transportation Worker Identification Credential (TWIC) holders vetting, adjudication, and issuance process is comparable to the NACI and/or National Agency Check with Law and Credit or, when implemented, OPM Tier I standard, and shall be considered identity proofed."

IBIA believes that the TWIC program is an important contributor to the security of the nation. The TSA has conducted a thorough background check and security threat assessment on 2.4 million TWIC card holders. Those individuals who had disqualifying criminal offenses or who represented a threat to our security have been screened out and are no longer welcome in the most sensitive areas of our critical transportation infrastructure. The hard-working people of the TSA and Coast Guard deserve our thanks and appreciation for their efforts in making our nation safer.

ABOUT IBIA. IBIA is a non-profit trade group that advocates and promotes the responsible use of technologies for managing human identity. It fulfills its mission through advocacy, education and outreach. For more, please visit

(1) For an example article, see
(2) See Federal Register Vol. 77, No. 237, Page 73455
(3) Department of Defense Directive-Type Memorandum (DTM) 09-012, "Interim Policy Guidance for DoD Physical Access Control" dated December 8, 2009 and re-issued on September 9, 2012.

Tovah LaDier
Tel: (202) 587-4855

More Stories By Marketwired .

Copyright © 2009 Marketwired. All rights reserved. All the news releases provided by Marketwired are copyrighted. Any forms of copying other than an individual user's personal reference without express written permission is prohibited. Further distribution of these materials is strictly forbidden, including but not limited to, posting, emailing, faxing, archiving in a public database, redistributing via a computer network or in a printed form.

Latest Stories
Cloud computing delivers on-demand resources that provide businesses with flexibility and cost-savings. The challenge in moving workloads to the cloud has been the cost and complexity of ensuring the initial and ongoing security and regulatory (PCI, HIPAA, FFIEC) compliance across private and public clouds. Manual security compliance is slow, prone to human error, and represents over 50% of the cost of managing cloud applications. Determining how to automate cloud security compliance is critical...
Today air travel is a minefield of delays, hassles and customer disappointment. Airlines struggle to revitalize the experience. GE and M2Mi will demonstrate practical examples of how IoT solutions are helping airlines bring back personalization, reduce trip time and improve reliability. In their session at @ThingsExpo, Shyam Varan Nath, Principal Architect with GE, and Dr. Sarah Cooper, M2Mi’s VP Business Development and Engineering, explored the IoT cloud-based platform technologies driving t...
As organizations shift towards IT-as-a-service models, the need for managing & protecting data residing across physical, virtual, and now cloud environments grows with it. CommVault can ensure protection & E-Discovery of your data - whether in a private cloud, a Service Provider delivered public cloud, or a hybrid cloud environment – across the heterogeneous enterprise.
In his General Session at DevOps Summit, Asaf Yigal, Co-Founder & VP of Product at, explored the value of Kibana 4 for log analysis and provided a hands-on tutorial on how to set up Kibana 4 and get the most out of Apache log files. He examined three use cases: IT operations, business intelligence, and security and compliance. Asaf Yigal is co-founder and VP of Product at log analytics software company In the past, he was co-founder of social-trading platform Currensee, which...
The Internet of Things (IoT) is growing rapidly by extending current technologies, products and networks. By 2020, Cisco estimates there will be 50 billion connected devices. Gartner has forecast revenues of over $300 billion, just to IoT suppliers. Now is the time to figure out how you’ll make money – not just create innovative products. With hundreds of new products and companies jumping into the IoT fray every month, there’s no shortage of innovation. Despite this, McKinsey/VisionMobile data...
Culture is the most important ingredient of DevOps. The challenge for most organizations is defining and communicating a vision of beneficial DevOps culture for their organizations, and then facilitating the changes needed to achieve that. Often this comes down to an ability to provide true leadership. As a CIO, are your direct reports IT managers or are they IT leaders? The hard truth is that many IT managers have risen through the ranks based on their technical skills, not their leadership ab...
Just over a week ago I received a long and loud sustained applause for a presentation I delivered at this year’s Cloud Expo in Santa Clara. I was extremely pleased with the turnout and had some very good conversations with many of the attendees. Over the next few days I had many more meaningful conversations and was not only happy with the results but also learned a few new things. Here is everything I learned in those three days distilled into three short points.
DevOps is about increasing efficiency, but nothing is more inefficient than building the same application twice. However, this is a routine occurrence with enterprise applications that need both a rich desktop web interface and strong mobile support. With recent technological advances from Isomorphic Software and others, rich desktop and tuned mobile experiences can now be created with a single codebase – without compromising functionality, performance or usability. In his session at DevOps Su...
As organizations realize the scope of the Internet of Things, gaining key insights from Big Data, through the use of advanced analytics, becomes crucial. However, IoT also creates the need for petabyte scale storage of data from millions of devices. A new type of Storage is required which seamlessly integrates robust data analytics with massive scale. These storage systems will act as “smart systems” provide in-place analytics that speed discovery and enable businesses to quickly derive meaningf...
In his keynote at @ThingsExpo, Chris Matthieu, Director of IoT Engineering at Citrix and co-founder and CTO of Octoblu, focused on building an IoT platform and company. He provided a behind-the-scenes look at Octoblu’s platform, business, and pivots along the way (including the Citrix acquisition of Octoblu).
In his General Session at 17th Cloud Expo, Bruce Swann, Senior Product Marketing Manager for Adobe Campaign, explored the key ingredients of cross-channel marketing in a digital world. Learn how the Adobe Marketing Cloud can help marketers embrace opportunities for personalized, relevant and real-time customer engagement across offline (direct mail, point of sale, call center) and digital (email, website, SMS, mobile apps, social networks, connected objects).
The buzz continues for cloud, data analytics and the Internet of Things (IoT) and their collective impact across all industries. But a new conversation is emerging - how do companies use industry disruption and technology enablers to lead in markets undergoing change, uncertainty and ambiguity? Organizations of all sizes need to evolve and transform, often under massive pressure, as industry lines blur and merge and traditional business models are assaulted and turned upside down. In this new da...
In recent years, at least 40% of companies using cloud applications have experienced data loss. One of the best prevention against cloud data loss is backing up your cloud data. In his General Session at 17th Cloud Expo, Sam McIntyre, Partner Enablement Specialist at eFolder, presented how organizations can use eFolder Cloudfinder to automate backups of cloud application data. He also demonstrated how easy it is to search and restore cloud application data using Cloudfinder.
The Internet of Everything is re-shaping technology trends–moving away from “request/response” architecture to an “always-on” Streaming Web where data is in constant motion and secure, reliable communication is an absolute necessity. As more and more THINGS go online, the challenges that developers will need to address will only increase exponentially. In his session at @ThingsExpo, Todd Greene, Founder & CEO of PubNub, exploreed the current state of IoT connectivity and review key trends and t...
Two weeks ago (November 3-5), I attended the Cloud Expo Silicon Valley as a speaker, where I presented on the security and privacy due diligence requirements for cloud solutions. Cloud security is a topical issue for every CIO, CISO, and technology buyer. Decision-makers are always looking for insights on how to mitigate the security risks of implementing and using cloud solutions. Based on the presentation topics covered at the conference, as well as the general discussions heard between sessi...