Shortly after the terror attacks of September 11, 2001, the Canadian government created the Canadian Air Transport Security Authority (CATSA) to provide security screening services at airports. The organization was then handed the challenge of finding a better way to ensure that people working in airports and for airlines — about 110,000 of them — were properly authorized and identified when they walked in the doors at Canada’s 29 major airports.
The system that was developed to meet this security challenge, called RAIC (Restricted Area Identity Card), has been a resounding success, winning the Exceptional Innovation Award at the 2006 Canadian Information Productivity Awards. CATSA CIO Kevin McGarr accepted the award, along with Rob Durward, director of technical programs.
The first stage of the RAIC project was completed at the beginning of 2007, after investment of four years and C$40 million ($34 million). Success means that there will be a second phase. If the project had failed, the political costs would have been high and public confidence in airport security could have been shaken.
That’s pressure, and it would have been felt even by CIOs with long experience in the aviation industry. When McGarr was appointed to lead the project in January 2003, however, he was a first-time CIO and had no previous industry experience.
But he knew about pressure. He had been a police officer in Montreal for 26 years and retired in 1997 as lieutenant-detective in charge of organized crime investigations. “There’s enough work to keep you busy,” he says dryly about that experience.
After retirement McGarr began a new career as a consultant in Montreal with KPMG Investigation and Security. When he left after 6½ years to develop the RAIC project, he was confronted with a daunting technology challenge. The new security system had to unify 19 different access-control systems already in use at airports, and it had to use new biometric technology — that is, to identify airport workers using fingerprints and iris scans, along with unique numerical identifiers, all imbedded on chips in plastic ID cards carried by workers with Transport Canada security clearances.
No such system existed before. RAIC is the world’s first dual biometric smart-card program to be deployed on a national scale in an airport environment.
Tackling the RAIC project
McGarr, however, didn’t approach RAIC as an IT project, or even as a security project. He saw it as a business project. “Our success comes from keeping our business needs as the focus of our activities and taking a modular approach to building a system,” he says.
“We were mindful of project creep — being distracted by the very attractive add-ons that become available from time to time during a project. We had to stay focused on our two primary business objectives in order that we remain within budget. And that is exactly what we did.”
The business objectives were defined from January through May 2003. Using a consultation methodology developed by Transport Canada, McGarr and his team travelled the country to talk to every kind of organization connected with airports and airlines. They determined that the objectives of their project should be to develop an identity and authentication credential that would:
* Ensure that a person presenting the credential is in fact the same person who is enrolled in the airport pass system;
* Ensure that, at the moment of presentation of the RAIC card, there is a valid transportation security clearance issued to the cardholder.
In May 2003 the project team gave IBM Canada the task of developing the specific technologies to achieve these objectives. CATSA had already decided on the unprecedented step of using iris and fingerprint readers, based on its consultations and on research conducted in partnership with Transport Canada.
Another primary decision was to use an existing wide-area network operated by TELUS that connected the airport sites. This was so that updates from Transport Canada’s database on security clearances could be transmitted in real time to each airport’s security system.
“That was one of the cornerstones of the whole project,” McGarr says. “We didn’t want to throw out existing systems to replace them with new ones, when we could build upon what was already there.”
Project governance
While technologies were being designed to these principles in readiness for a pilot project, McGarr built the project governance mechanisms — two of them, in fact. There was a Steering Committee within CATSA, which met every two weeks to review every aspect of the project. In addition there was a Technical Working Group, with representatives from airports, airlines, related industries and Transport Canada.
It was McGarr’s job to get everybody reading from the same page within these groups and among all of the 29 airport authorities as well as unions, airlines and technology suppliers. It might have been easier in the command-and-control environment of a police force, but CATSA is not a regulatory body, and McGarr was not in a position to lay down the law. He says that didn’t trouble him.
“In police work it’s exactly the same dynamic,” he says. “You can force people for a very few minutes to do something that maybe they don’t want to, while they’re standing right in front of you. But you don’t really change their behavior once you turn your back. So it makes a lot more sense to try to define what is the right thing to do and get people to move toward that.
“We listened to the airports, we listened to the industry. When we thought we were right we tried to persuade our partners to accept our point of view. And if we honestly believed that they were right, we tried to rally to their point of view. We tried to do the right thing, not what we wanted to do.”
Winning over the union
This approach succeeded in overcoming one of the project’s most difficult challenges, obtaining union acceptance of the new technology. Unions were particularly concerned about the iris readers, fearing that they could damage eyes.
Paul Devon, a project manager on the RAIC team, recalls, “One of the pieces of misinformation that we were consistently coming across was that people thought that the readers were retinal scanners — some strange beam that goes into the internal parts of your eye. They’re not. They simply take a digital picture of your iris. We’ve been doing a lot of work to remove the word ‘scan’ from people’s vocabulary.”
The project managers complied with the unions’ requests for information, presenting research reports to them from defense departments in Canada and the US. Now the RAIC system is accepted by the unions, and it elicits positive feedback from workers because they no longer have to stand around waiting for guards to look up their information on paper.
On the technology side, McGarr says the greatest challenge was to create interfaces between the biometric readers, which were designed as stand-alone machines, and the 19 different security systems in use by the 29 major airports.
“That technical challenge forced us really to remain focused on what we were trying to do,” he says. “Not to add bells and whistles to it; to stick to the commitment of the program and get it done.
“It was very important to rally the players to agree to that approach, and to give the airports comfort and assurance that we were not interfering with the autonomy of their operations at all. This is an enhancement to their existing systems, not a replacement.”
The RAIC team kept “plodding along,” in McGarr’s words, through a pilot project that began in September 2004 involving four airports, then through full implementation beginning in April 2005. Most demanding of the team’s time was, of course, Toronto Pearson International Airport, which accounts for one-third of all air traffic in the country and has an extremely complex telecommunications network that integrates 200 IT systems.
By the end of January, the RAIC system was fully operational at all 29 major airports. The system is a technological advance that leads the world and has achieved “an enormous jump forward for security at airports,” says Peter Burden, manager of the RAIC program.
“The worldwide industry trend is toward using a smart card with biometrics imbedded in the smart chip,” Burden says. “We’ve attended conferences and it was refreshing to see that the airport security industry is moving toward decisions that we made a long time ago.”
The next step will be phase 2, for which CATSA is now putting together a project plan. The RAIC technology will be extended to the wider perimeter of airports and to public terminal buildings. Travellers will see it in action as pilots, airline customer representatives and others will scan themselves into work alongside airline passengers in security lines.
Lessons learned
The lessons taught by the RAIC project, McGarr believes, are all about collaboration and communication.
“I think we could have spent more time with some of the more senior people at the airports and airlines,” he assesses. “Collaboration at the working level was 100% but I think that we could have spent more time helping the more senior-level understand the project as well as the people at the working level.
He added that success came from keeping focused on the business needs and involving everybody in the broader consultation process.
“We were very open and honest in communicating to our stakeholders what our ability to pay was, and our requirement to remain within the framework that we had developed for the project,” McGarr asserts. “And as long as you stick with ‘open and honest’, you can never go wrong.”
Sidebar: The RAIC system at work
Today, when a worker at an airport using the RAIC system approaches a restricted area at an airport, she carries a smart card with a chip containing templates of her fingerprint and iris, along with a unique numerical identifier. The worker waves the card in front of a reader, then verifies her identity either by touching a fingerprint reader or having a digital photo taken of her iris. This takes about three seconds.
It’s much faster than the previous method, which involved a guard flipping through printed pages to find and check off the worker’s ID number. In addition to being able to confirm a cardholder’s identity, the biggest benefit of RAIC is the ability to update the security clearance status of all 110,000 airport workers instantly at major airports across the country, replacing a system that provided weekly updates.
Before RAIC, individuals could have multiple cards at multiple airports. This made them difficult to track. Systems across the country are now consistent and linked, so one RAIC card serves the same person at all locations, producing significant cost and time savings for airports and airport personnel who need to have a multi-airport pass.
The system dramatically reduces the time that workers must take to pass through entrances to get to their jobs. Some airports have installed entrances with one door to be unlocked to approach the scanning machine and a second door to exit, so that one guard can monitor several of these automated entrances using video cameras. This has cut labor costs substantially.
Lawrence Moule is a Toronto-based freelance journalist.
