Managing the safety, security and credentialing of employees and outside workers presents complex challenges for airport operators across the globe. U.S. airports, in particular, have found themselves swimming chin-deep in paperwork associated with post-9/11 security regulations.
About two years ago, Virginia's Richmond International Airport (RIC) took steps to streamline its paper-centric credentialing process by purchasing and installing identity management software. As is often the case for such transitions, personnel in the airport's security, operations and information technology (IT) departments teamed up for the project.
Project: Computerizing Identity Management Processes
Location: Richmond (VA) Int'l Airport
Software: SAFE for Aviation
Provider & Installer: Quantum Secure
Data Capture & Authentication: AssureID
Fingerprint System: Crossmatch
Scanners & Touchscreen Monitors: 3M ID; Hewlett Packard
Vetting Agency: Transportation Security Clearinghouse
Of Note: New system eliminated paper filing & storage; increased annual badging productivity by 27%; reduced badge audit time by 60%; reduced time to complete monthly financial reports by 75%
"Since going live in October 2014, we have transitioned to nearly 100% paperless," reports RIC Operations Manager Jim Nilo. "If you entered our badging office right now, you would see stacks of paper that
are being eliminated. Now, everything is stored digitally."
Saving Trees, Time & Money
In spring 2014, RIC contracted Quantum Secure to implement a new physical identity management system-SAFE for Aviation. The calculated payback period for the software suite was 23 months, and annual operational savings of approximately $200,000 are expected now that it is fully in use.
The new system, which went live in October 2014, manages the airport's worker identity and credentialing requirements with its existing security infrastructure. Saurabh Pethe, director of Aviation Vertical for Quantum Secure, describes the primary challenges RIC was facing.
• The manual processes used in the badging office were labor-intensive.
• Compliance audits took months to complete, primarily due to the paper-based systems being used, and required multiple reminders and rechecks.
• The access control system was outdated. (Any updates or changes to identity management and badging office procedures would consequently need to be compatible with the airport's future access control system, which had yet to be selected.)
Pethe was confident that updating and automating RIC's processes and procedures would yield operational and security benefits, not to mention produce better and faster results.
"The airport management team had a good understanding of the broader implications of the project, which helped make implementation go smoothly," he recalls. "They understood that the new system affected both security and IT, and both teams were deeply involved throughout the planning and implementation process."
By October 2015, after one year of live operation, the new system had proved its worth on a number of fronts, informs RIC Airport Security Coordinator Jonathan Searles. The badge approval process was 27% more productive than the previous best year. The time required to compile monthly financial reports had been cut by 75%-from one day to two hours. And the annual badge audit was more than 75% complete and projected to be completed one month earlier than the last one. Future audits were projected to take even less time.
"It's all about productivity," Searles notes. "The more we use it, the easier and more productive the system becomes. At the end of the day, one thing matters: Is the airport receiving complaints about how long the badging process is taking? The system allows us to use the resources we have much more efficiently and productively. Ultimately, the system translates into dollar savings because it takes fewer employees to manage the system."
Changing the Process
Under RIC's old identity management system, badge applications were "backend loaded." That is, an individual would enter the badging office with an application filled out and signed by a designated and vetted company signatory. A badging office employee would photocopy the required personal identification documents, then place the individual's application on a stack to be dealt with later. At the end of the day, several staff members would enter the biographical information from the applications into spreadsheets.
The time it took for staff to enter biographical data, the associated potential for human error and a growing backlog of applications led to a cumbersome and inefficient process, Nilo reflects. Sometimes, it took up to a month or longer to process a badge.
"One of the major benefits for the airport and its tenants is the time savings," says Nilo. "Before SAFE, we essentially entered the same data into four separate systems, which took longer while also significantly increasing the chance an error would slow the process for a new applicant. If a couple digits of a Social Security number were entered incorrectly, it could create tremendous problems, especially with vetting an applicant. The new system gives us an extra level of assurance that the information is accurate while reducing staff time significantly and enhancing security."
Under the new system, an applicant's biographical information is entered on the front end by a designated, fully vetted company signatory. When the applicant later goes to the airport's badging office, an employee verifies that the information entered by the signatory is correct and directs the applicant to the enrollment station for fingerprinting. A badging office employee also copies the required identification documents, which are turned into PDFs, and then transmits the information to Transportation Security Clearinghouse-RIC's vetting agency of choice.
The new system ties together the information and procedures required during the vetting process and allows airport security personnel to manage and track identity information and access control. In short, it determines what doors each applicant is allowed to open.
More specifically, the system:
• centralizes company and identity information across systems and departments into a single policy and privilege-based view;
• reduces dependence on operator training by managing the required steps for badge authorization and allowing operators to issue policy-driven badges;
• provides a portal that allows employer-authorized signatories to interact electronically with the airport (for new applicants, renewals, name and privilege changes, terminations, employee audits, training, etc.);
• eliminates paper files and photocopy storage;
• efficiently ties background checks to credentialing and monitors airport workers vetting and badge status in real time;
• provides a financial module for company-specific billing and invoicing for badging, background checks, penalties, violations, lost keys or cards, training, etc.; and
• simplifies compliance monitoring, reports and audits.
Doing More With Less
For Searles, the new system's greatest selling point is its person-centric orientation. A person can have multiple employers, multiple badges, different types of badges, leave the airport then come back years later, and still appear within the system. Each person has a unique personal identification number, which becomes the key that links all of the databases together.
"Once all the information is in the system, that's when the magic happens," Searles says enthusiastically.
Based on business rules, the system pushes information to the various places it needs to go. The software knows what is required, and specific document information must be satisfied before the system will continue processing an applicant. For example, the system knows it needs to have fingerprints and a threat assessment for a SIDA (security identification display area) badge-unless the applicant is exempt, as is the case with law enforcement officials. When an applicant enters the enrollment room for fingerprinting, the record is transmitted electronically, eliminating the chance for the information to be altered, notes Searles. As long as the information is entered correctly and validated at the beginning of the application process, it will be correct on the back end, which is very important in the fingerprint matching process, he emphasizes.
The new system also enhances the airport's ability to demonstrate its compliance with federal security requirements, adds Searles. Under the old system, a spot check from TSA on three names could take hours to address. Airport staff had to locate paper applications, I-9 documents, fingerprint cards, training records, etc. Now, all of an applicant's documents are in one easily accessible place, he contrasts. "That's what TSA likes-because it shows transparency," says Searles.
With the recent TSA regulation (Aviation Security Directive 1542-04-8K) requiring new fingerprinting every two years during two-year background checks, both Searles and Nilo agree that RIC's new system went live at just the right time.
"If we didn't have this system in place when this new fingerprint requirement came out last July, we would have been in real trouble," Searles reflects. "We have gone from doing 70 fingerprints per month to over 300 per month. If we didn't have a system that automatically pre-populates the fingerprint machine and we were having to manually match fingerprint records, it would have been a nightmare."
Nilo concurs: "Even though demand has increased, we're breaking even by being able to do more work with fewer people."