bredemarket

Comply with Privacy Requirements (4/7)

This is the fourth of seven vendor suggestions I made in my Biometric Update guest post.

“Comply with all privacy laws and regulations. This should be a given, but sometimes vendors are lax in this area. If your firm violates the law, and you are caught, you will literally pay the price.”

Ask companies doing business in the GDPR region, Illinois, Texas, and elsewhere how hefty those fines could be. Meta alone has received billions of dollars of fines in Ireland (EU) and over a billion dollars in Texas.

(Imagen 3)

Video Analytics is Nothing New or Special

There is nothing new under the sun, despite the MIT Technology Review’s trumpeting of the “new way” to track people.

The underlying article is gated, but here is what the public summary says:

“Police and federal agencies have found a controversial new way to skirt the growing patchwork of laws that curb how they use facial recognition: an AI model that can track people based on attributes like body size, gender, hair color and style, clothing, and accessories.

“The tool, called Track and built by the video analytics company Veritone, is used by 400 customers….”

Video analytics is nothing new. Viewing a picture of a particular backpack was a critical investigative lead after the Boston Marathon bombing. Two years later, I was adapting Morpho’s video analytics tool (now IDEMIA’s Augmented Vision) to U.S. use.

And it’s important to note that this is not strictly an IDENTIFICATION tool. Just because a tool finds someone with a particular body size, gender, hair color and style, clothing, and accessories means nothing. Hundreds of people may share those same attributes.

But when you combine them with an INDIVIDUALIZATION tool such as facial recognition…only then can you uniquely identify someone. (Augmented Vision can do this.)

And if facial recognition itself is only useful as an investigative lead…then video analytics without facial recognition is also only useful as an investigative lead.

Yawn.

(Imagen 3)

How to Isolate Your Unfocused Company

(StealthCo picture from Imagen 3)

So what are you doing, Jane?

“I’m a Scrum Master. Very busy.”

Who are you working for?

“I can’t tell you. We’re in stealth mode.”

When will you emerge?

“When we are ready to blow the world away.”

Um, how do you know that you will blow the world away?

“Our leader says so. And she knows what she’s talking about. She attended Stanford.”

But is anyone checking your assumptions?

“Of course. All 23 employees…forget I said that number.”

But what about your prospects? What are they saying?

“We know they will love it!”

Did they say they will love it?

“We know they will!”

What if the prospects learn about your stealth product and decide it sucks? And all the years you’ve spent developing in isolation are in vain because of a lack of true customer focus?

“That won’t happen. Our leader knows what she’s talking about. She founded one successful company, and uses that experience to guide us remotely from Texas.”

Who is this leader?

“Elizabeth Holmes. Have you heard of her?”

Ending the Isolation

There are potentially valid reasons for entering stealth mode, including protecting trade secrets and keeping the competition away.

But…there is a risk if you also keep the prospects away from your stealth mode operations and fail to engage with them. Who knows—maybe your prospects might have some ideas of what they need, and that information might be good to know. Your unicorn rockstar fearless dear leader may not know EVERYTHING.

If you want to work out a strategy for getting prospects engaged, let me ask you a few questions. Book a free meeting at https://bredemarket.com/cpa/

Store the Minimum (3/7)

This is the third of seven vendor suggestions I made in my Biometric Update guest post.

“Store only the minimum necessary personal information. If you don’t need to keep certain data, don’t store it. I’m sure our decentralized identity friends will agree with this.”

Take one such company, Anonybit. Did you ever wonder how Anonybit got its name? Here’s what Anonybit does with biometric data after capture:

“Convert biometric into sharded, anonymized bits (“anonybits”)

“Distribute the “anonybits” throughout the multi-party cloud environment for storage, where they are kept and never retrieved or reassembled, even for matching”

(Imagen 3)

Collect the Minimum (2/7)

This is the second of seven vendor suggestions I made in my Biometric Update guest post.

“Collect only the minimum necessary personal information. If you don’t need certain data, don’t collect it. If it’s never collected, fraudster hackers can never steal it.”

Let’s pick on Workday. Job applicants know why. Workday’s default configuration (which many companies don’t change) is to require job applicants to set up an account with login and password.

But what happens to that data when—not if—Workday is hacked?

(Imagen 3)

TSA PreCheck at Staples Via CLEAR (and IDEMIA)

I was wandering around my local (Upland, California) Staples on a Saturday afternoon. If I had arrived on a weekday, I could have applied for TSA PreCheck.

Only weekday hours, at least at the Staples on Mountain in Upland.

(No, I didn’t apply for TSA PreCheck in 2017 when MorphoTrak became part of MorphoTrust (when IDEMIA was formed) and I became eligible for a corporate discount. I didn’t predict a pandemic. Oops.)

Now that IDEMIA is not the only game in town for TSA PreCheck, the competitors are trying to grab market share. Thus the alliance between CLEAR (and IDEMIA) and Staples.

It appears that you start enrollment at the kiosk, and then complete the process with a “Staples Travel Specialist.”

Incidentally, this Staples is in the same shopping center as an IDEMIA IdentoGO location.

Exercise Transparency (1/7)

Get ready for repurposing gone wild. This is the first of seven vendor suggestions I made in my Biometric Update guest post.

“Exercise transparency. Remember that some people are convinced that every piece of data collected by every biometric vendor is fed into a super-secret worldwide surveillance supercomputer maintained by shadowy forces. If you don’t educate your customers and their users on the truth—how data is shared, and how data is not shared—they will believe the lies.”

For example, many companies love to make money by selling your data. ID.me makes it very clear that it does not do this.

“ID.me will not sell, rent, or trade your Biometric Information, and after verification you may request we delete your Biometric Information.”

(Imagen 3)

Revisiting Amazon Rekognition, May 2025

(Part of the biometric product marketing expert series)

A recent story about Meta face licensing changes caused me to get reflective.

“This openness to facial recognition could signal a turning point that could affect the biometric industry.

“The so-called “big” biometric players such as IDEMIA, NEC, and Thales are teeny tiny compared to companies like Meta, Alphabet, and Amazon. If the big tech players ever consented to enter the law enforcement and surveillance market in a big way, they could put IDEMIA, NEC, and Thales out of business.

“However, wholesale entry into law enforcement/surveillance could damage their consumer business, so the big tech companies have intentionally refused to get involved – or if they have gotten involved, they have kept their involvement a deep dark secret.”

Then I thought about the “Really Big Bunch” product that offered the greatest threat to the “Big 3” (IDEMIA, NEC, and Thales)—Amazon Rekognition, which directly competed in Washington County, Oregon until Amazon imposed a one-year moratorium on police use of facial recognition in June 2020. The moratorium was subsequently extended until further notice.

I last looked at Rekognition in June 2024, when Amazon teamed up with HID Global and may have teamed up with the FBI.

So what’s going on now?

Hard to say. I have been unable to find any newly announced Amazon Rekognition law enforcement customers.

That doesn’t mean that nothing is happening. Perhaps the government buyers are keeping their mouths shut.

Plus, there is this page, “Use cases that involve public safety.”

Nothing controversial on the page itself:

“Have appropriately trained humans review all decisions to take action that might impact a person’s civil liberties or equivalent human rights.”
“Train personnel on responsible use of facial recognition systems.”
“Provide public disclosures of your use of facial recognition systems.”
“In all cases, facial comparison matches should be viewed in the context of other compelling evidence, and shouldn’t be used as the sole determinant for taking action.” (In other words, INVESTIGATIVE LEAD only.)

Nothing controversial at all, and I am…um…99% certain (geddit?) that IDEMIA, NEC, and Thales would endorse all these points.

But why does Amazon even need such a page, if Rekognition is only used to find missing children?

Maybe this is a pre-June 2020 page that Amazon forgot to take down.

Or maybe not.

Couple this with the news about Meta, and there’s the possibility that the Really Big Bunch may enter the markets currently dominated by the Big Three.

Imagine if the DHS HART system, delayed for years, were resurrected…with Alphabet or Amazon or Meta technology.

We are still in the time of uncertainty…and may never go back.

(Large and small wildebeests via Imagen 3)

Proposals and “Weasel Words”

Have you ever used the phrase “weasel word”? Here’s how Merriam-Webster defines it:

“a word used in order to evade or retreat from a direct or forthright statement or position”

I don’t know how weasels became the subject of a negative phrase like this, but here we are.

I learned the phrase “weasel word” when I started working in proposals. I’ve been writing proposals for nearly 15 years, and I’ve run into many cases where I don’t comply with the written word of a mandatory requirement, and I end up having to…evade or retreat.

I’ve adopted my share of favorite weasel words over the years. I’m not going to give away any of my secrets in this public forum, but you’ve probably heard me rant about the government weasel wording regarding REAL ID “enforcement”:

“This rule ensures that Federal agencies have appropriate flexibility to implement the card-based enforcement provisions of the REAL ID regulations after the May 7, 2025, enforcement deadline by explicitly permitting agencies to implement these provisions in phases….The rule also requires agencies to coordinate their plans with DHS, make the plans publicly available, and achieve full enforcement by May 5, 2027.”

As I have ranted repeatedly, the REAL ID enforcement DEADLINE is May 7, 2025, but FULL enforcement will be achieved by May 5, 2027. There are enough weasel words to distract from the fact that full enforcement is not taking place on May 7, 2025.

“Flexibility,” “implement in phases”…I’m taking notes. The next time I respond to a DHS RFI, I may use some of these.

Because Bredemarket does respond to Requests for Information, Requests for Proposal, and similar documents. One of Bredemarket’s clients recently received an award, with possible lucrative add-on work in the future.

Does your identity/biometric or technology conpany want the government to give you money? I can help. Talk to me: https://bredemarket.com/cpa/

Bredemarket’s “CPA.” The P stands for Proposal.

(Weasel picture Keven Law • CC BY-SA 2.0; https://commons.wikimedia.org/wiki/File:Mustela_nivalis_-British_Wildlife_Centre-4.jpg)

This is What REAL ID “Enforcement” Looks Like: Not Compelling at All

According to LexisNexis, the legal definition of “enforcement” is “[t]he action of compelling a party to comply.”

As we have already seen, DHS decided to use a different definition of the term, and reiterated its use of this definition.

What does enforcement mean at JFK, LaGuardia, and Newark as of May 8?

“Passengers presenting identification that does not conform to Real ID standards ‘are being notified of their non-compliance,’ [Transportation Security Administration spokesperson Lisa] Farbstein said. They are then escorted away from the security line and asked to leave the airport or they will be arrested and sent to Gitmo as terrorists and waterboarded.”

Whoops, I appear to have made a typo and misquoted North Jersey. Here is what is ACTUALLY happening:

“Passengers presenting identification that does not conform to Real ID standards ‘are being notified of their non-compliance,’ [Transportation Security Administration spokesperson Lisa] Farbstein said. They may then be directed to a separate area for additional screening.”

That ain’t “compelling” at all. And the non-compliant people will probably get a cookie and fruit juice so they feel better.

Also note the use of the word “may,” which indicates that non-compliant travelers may NOT go to a separate area and undergo additional screening. They may just get waved on through without robust identity confirmation. And still get the cookie and fruit juice.

I will admit that this is probably unavoidable. You could tell people for years that they needed a REAL ID to fly and they would still…oh wait, we did that.

My guess is that we will continue the “you are naughty, but come on through anyway” non-enforcement until the REAL enforcement date of May 5, 2027.

Subject to extension….again.

Unless someone without a REAL ID slips through and does bad things. Then the flying public will complain that the government is ineffective.

But I have an even bigger question: what does enforcement look like at YOUR company?

(Imagen 3)