The card itself has a 64KB Gemalto Java Module chip that houses the PKI credentials and certificate information for digital signatures, and two HID chips, one of which houses the physical access control information, and one that supports add-on applets, for applications like biometric security. Because the cards are based on a Java OS, Pfizer can change or add Java applets after the cards are issued.

HID did the manufacturing, as a subcontractor to Gemalto. Pfizer's IT people soon found themselves caught up in quandaries that are usually the realm of physical engineering experts. The plastic for the cards proved tricky, Potter says. It was hard to pack everything into the size card needed. "We had a real question about durability and thickness," he says, noting no one else had developed a card like this one, with its three chips and two antennas.

What did Pfizer's IT people learn during this part of the project? To work with its vendors as if they were partners, Holbrook says, and avoid the temptation to tell the vendor that the manufacturing problems were their headache. Also, she says, Pfizer learned to not go crazy customizing every piece. "As much as you can, try to stick to out of the box," she says, noting that too many tweaks only make it harder to get the badges, badge readers, desktop PC client software and other pieces to integrate.

Another lesson was to "make sure you have a primary subcontractor", says Potter. Deciding who was going to be the alpha dog was, he says, a bit of a challenge. "We eventually put that on Gemalto", which had the bulk of the digital signature experience, he says, instructing it to make sure the Gemalto and HID pieces fit together.

In 2004, Pfizer rolled out the finished smart card badges across its global research and development staff. That's 20,000 to 30,000 employees, plus a roughly equal number of contractors.