What Does The Common Access Card Contain

The Common Access Card (CAC) is the standard identification card for active duty United States Uniformed Services personnel, Selected Reserve, United States Department of Defense (DoD) civilian employees, and eligible contractor personnel. More than just a simple ID, the CAC is a multifaceted tool containing a wealth of information and serving several critical functions within the DoD. Understanding what the Common Access Card contains, both physically and digitally, is essential for anyone who carries one, as well as for those who interact with CAC holders.

Physical Attributes and Visible Information

The Common Access Card is designed to be durable and easily recognizable. Its physical attributes are standardized to ensure uniformity across all branches and agencies of the DoD.

• Card Material and Dimensions: The CAC is made of durable plastic, similar to a credit card. Its dimensions are standardized to fit in wallets and card readers.
• Card Front: The front of the CAC displays several key pieces of information:
  • Photograph: A color photograph of the cardholder is prominently displayed. This is the primary visual identifier.
  • Rank/Grade: The cardholder's rank or grade is clearly indicated. For military personnel, this is their official rank (e.g., Sergeant, Captain). For civilians and contractors, this may be their equivalent grade or job title.
  • Last Name, First Name, Middle Initial: The cardholder's full name is displayed for identification purposes.
  • DoD ID Number (EDIPI): The DoD ID Number, also known as the Electronic Data Interchange Personal Identifier (EDIPI), is a unique, non-personally identifiable information (PII) number assigned to each individual. It serves as a primary key for accessing records and systems within the DoD.
  • Expiration Date: The expiration date indicates when the card is no longer valid. CACs must be renewed periodically to ensure the information is current and the cardholder's affiliation with the DoD is still active.
  • Uniformed Services Affiliation: This indicates the branch of service (e.g., Army, Navy, Air Force, Marine Corps, Coast Guard) for military personnel. For civilians and contractors, it may indicate the specific agency or organization they are affiliated with.
• Card Back: The back of the CAC also contains important information:
  • Magnetic Stripe: The magnetic stripe contains information used for various purposes, such as physical access control and timekeeping.
  • Two-Dimensional (2D) Barcode: The 2D barcode, often a PDF417 barcode, contains digitally encoded information about the cardholder. This can be read by specialized scanners for rapid identification and verification.
  • Card Number: A unique card number is assigned to each CAC. This number is different from the DoD ID number and is used for internal tracking and security purposes.
  • Signature Block: A space is provided for the cardholder's signature, which is required to validate the card.
  • Contact Information: Contact information for reporting lost or stolen CACs is typically printed on the back of the card.
  • U.S. Government Seal: Indicates the card's official status and authority.

Digital Components and Embedded Certificates

Beyond the visible information, the Common Access Card contains sophisticated digital components that enable secure access to DoD systems and facilities. These components include embedded certificates that provide cryptographic authentication and authorization.

• Integrated Circuit Chip (ICC): The ICC is the heart of the CAC's digital functionality. It is a small microchip embedded in the card that stores digital certificates and other sensitive information.
• Public Key Infrastructure (PKI) Certificates: PKI certificates are digital credentials that verify the cardholder's identity and allow them to securely access DoD resources. The CAC typically contains several PKI certificates, each with a specific purpose:
  • Identity Certificate: This certificate is used to authenticate the cardholder's identity when logging into computer systems, accessing secure websites, and digitally signing documents.
  • Email Certificate: This certificate is used to encrypt and digitally sign email messages, ensuring confidentiality and authenticity.
  • CAC Authentication Certificate: Used for general authentication purposes.
• Personal Identification Number (PIN): The PIN is a secret code known only to the cardholder. It is required to activate the ICC and use the PKI certificates. This adds an extra layer of security, ensuring that only the authorized cardholder can access the digital functions of the CAC.
• CHIP Data: The CHIP data can contain various other types of information, such as medical data, personnel records, and security clearances. The specific data stored on the CHIP can vary depending on the cardholder's role and responsibilities.

Functions and Uses of the Common Access Card

The Common Access Card serves a wide range of functions within the DoD, providing secure identification, access control, and authentication for military personnel, civilian employees, and contractors.

• Identification: The CAC serves as a primary form of identification for DoD personnel. It verifies their affiliation with the DoD and their authorization to access military facilities and resources.
• Physical Access Control: The CAC is used to control access to military bases, buildings, and other secure facilities. Card readers at entry points verify the cardholder's identity and authorization before granting access.
• Computer and Network Access: The CAC is used to authenticate users logging into DoD computer systems and networks. The PKI certificates on the card provide strong authentication, ensuring that only authorized personnel can access sensitive information.
• Email Encryption and Digital Signatures: The CAC's email certificate enables users to encrypt and digitally sign email messages. This protects sensitive information from unauthorized access and verifies the sender's identity.
• Digital Signatures: The CAC can be used to digitally sign documents, providing a secure and legally binding way to authenticate electronic records.
• Access to Online Resources: The CAC provides access to a wide range of online resources, including military portals, training websites, and personnel databases.
• Point of Sale Transactions: In some cases, the CAC can be used for point-of-sale transactions at military exchanges and other facilities.
• Medical Information: The CAC can be used to access and update medical information for military personnel.

Security Considerations and Best Practices

The Common Access Card is a valuable asset that must be protected from loss, theft, and unauthorized use. Cardholders are responsible for following security best practices to safeguard their CAC and the information it contains.

• Protect Your PIN: Never share your PIN with anyone. Treat it like a password and keep it secret.
• Do Not Leave Your CAC Unattended: Always keep your CAC in a safe place and never leave it unattended.
• Report Lost or Stolen CACs Immediately: If your CAC is lost or stolen, report it immediately to your security manager or other appropriate authority.
• Do Not Loan Your CAC to Others: Your CAC is for your use only. Do not loan it to anyone else, even for a short period of time.
• Be Aware of Phishing and Social Engineering Attacks: Be cautious of emails, phone calls, or other communications that ask for your CAC information or PIN. These could be phishing or social engineering attacks designed to steal your identity or gain unauthorized access to DoD systems.
• Keep Your Contact Information Up to Date: Ensure that your contact information is up to date in the Defense Enrollment Eligibility Reporting System (DEERS). This will help ensure that you receive important notifications about your CAC and other benefits.
• Comply with All Security Regulations: Follow all security regulations and guidelines related to the use of the CAC.

Common Access Card (CAC) and the Future

The Common Access Card continues to evolve as technology advances and security threats become more sophisticated. The DoD is constantly working to improve the security and functionality of the CAC to meet the changing needs of the military and civilian workforce.

• Mobile CAC: The DoD is exploring the use of mobile devices as a replacement for the physical CAC. Mobile CACs would offer the same functionality as the physical card, but would be stored on a smartphone or other mobile device.
• Enhanced Security Features: The DoD is constantly adding new security features to the CAC to protect against fraud and identity theft. These features may include biometric authentication, such as fingerprint scanning or facial recognition.
• Integration with Other Systems: The CAC is being integrated with other DoD systems to provide a seamless and secure user experience. This includes integration with cloud-based services and mobile applications.

Frequently Asked Questions (FAQ) about the Common Access Card

• What is the purpose of the Common Access Card (CAC)?

  The CAC serves as the standard identification card for U.S. Department of Defense personnel, providing secure identification, access control, and authentication for military personnel, civilian employees, and eligible contractors.

• Who is eligible to receive a CAC?

  Active duty United States Uniformed Services personnel, Selected Reserve, United States Department of Defense (DoD) civilian employees, and eligible contractor personnel are eligible to receive a CAC.

• What information is displayed on the front of the CAC?

  The front of the CAC displays the cardholder's photograph, rank/grade, full name, DoD ID Number (EDIPI), expiration date, and Uniformed Services affiliation.

• What information is stored on the ICC chip of the CAC?

  The ICC chip stores digital certificates (identity, email, and CAC authentication), and potentially other data like medical or personnel information.

• How is the CAC used for computer access?

  The CAC's PKI certificates provide strong authentication for logging into DoD computer systems and networks. Users insert their CAC into a card reader and enter their PIN to verify their identity.

• What should I do if my CAC is lost or stolen?

  Report the loss or theft immediately to your security manager or other appropriate authority.

• Can I use my CAC for personal transactions?

  In some cases, the CAC can be used for point-of-sale transactions at military exchanges and other facilities, but its primary purpose is for official DoD business.

• How often do I need to renew my CAC?

  CACs must be renewed periodically, typically every few years, to ensure the information is current and the cardholder's affiliation with the DoD is still active. Check the expiration date on your card.

• What is the EDIPI number?

  The Electronic Data Interchange Personal Identifier (EDIPI) is a unique, non-personally identifiable information (PII) number assigned to each individual. It serves as a primary key for accessing records and systems within the DoD.

• What is a PIN used for with the CAC?

  The PIN (Personal Identification Number) is a secret code known only to the cardholder. It is required to activate the ICC and use the PKI certificates, adding an extra layer of security.

• Where can I get help with CAC issues?

  Contact your local IT support, security manager, or visit a RAPIDS (Real-time Automated Personnel Identification System) site for assistance.

Conclusion

The Common Access Card is a critical component of the DoD's security infrastructure. It provides a secure and reliable way to identify and authenticate personnel, control access to facilities and systems, and protect sensitive information. By understanding what the Common Access Card contains and how it is used, cardholders can help ensure the security of the DoD and its mission.