Tag Archives: biometric update

This is From Gemini, Not Muse

The bots are everywhere. See their stories below.

  • Smart-ID gains EU recognition for high-assurance remote biometric onboarding (Biometric Update): SK ID Solutions announced that its Smart-ID scheme achieved EU recognition at Level of Assurance High. This recognition covers its fully remote biometric onboarding capabilities.
  • Canada plans national travel biometrics strategy, expanded biometric screening (Biometric Update): Canada’s federal budget proposes C$90 million over four years to expand biometric screening for immigration. The plan includes the implementation of remote facial verification.
  • Deepfake CEOs, stolen lawyer identities fuel alleged $129M fraud (Biometric Update): A sprawling fraud operation allegedly used AI-generated voices and images to impersonate corporate executives. The criminals also stole the identities of lawyers to facilitate an alleged $129 million fraud.
  • Treasury seeks identity security contractor as Login.gov mandate takes hold (Biometric Update): The U.S. Treasury is seeking contractor support for the security and administration of its shared authentication systems. This search aligns with the shifting of federal policy toward Login.gov.
  • Akhilesh Yadav demands Aadhaar-linked voting, with metal cards replacing PVC and paper (ANI News): Akhilesh Yadav demanded the implementation of Aadhaar-linked voting alongside the use of metal cards instead of paper or PVC. These measures are proposed to prevent poll rigging and secure the electoral process.

I Guess Envoc Remains Relevant On My Radar

Despite my prior assumption, Envoc remains relevant to those of us in the identity/biometric universe. Farewell LA Wallet, hello FaceLock.

When I first heard of Envoc

I worked for IDEMIA from 2017 to 2020, back when mobile driver’s licenses were starting to enter productive use. IDEMIA was pursuing the market, and Gemalto (later Thales) was also pursuing it with several proofs of concept. And of course Apple, Google, and Samsung would enter the market later.

But none of these big or really big companies was the first with a mobile driver’s license.

The first mobile driver’s license came out of Louisiana, from a company called Envoc.

“Envoc was founded in Baton Rouge to ship software that regulated institutions can bet on. Not consultancy decks. Not prototypes that rot in a drawer. Shipped systems with named owners and runbooks.”

Envoc worked on a variety of projects since its founding in 2003, but I didn’t hear about it until it launched LA Wallet (where the “LA” stands for Louisiana, not Los Angeles).

At which point I admit I turned up my nose.

“IDEMIA has been producing driver’s licenses for years. Gemalto has been producing driver’s licenses for years. What can this Envoc do?”

Well, Envoc could beat the big companies at their own game. Available for both iOS and Android, LA Wallet was the first state mobile driver’s license in the United States, allowing residents (according to my private research for a Bredemarket client) to access numerous government services (unlike California and some other states, where the number of entities accepting its mobile driver’s license is still limited).

The divestiture

But in December 2025, Envoc divested its LA Wallet business.

At which point I admit I turned up my nose.

“Well, Envoc will now go on doing whatever else it does, but I won’t ever encounter them again.”

I was wrong.

FaceLock: what Envoc is doing today

To learn how wrong I was, listen to ID Tech’s latest ID Talk podcast.

“In the latest episode of ID Talk, founder and CEO Calvin Fabre joins Tony Bitzionis and Alex Perala to recount launching the [LA Wallet] app in 2018…

“The conversation then turns to FaceLock, the identity verification platform Envoc launched this year. FaceLock compares a live 3D face scan, captured with FaceTec’s liveness technology, with the photo on a government-issued ID, then lets an organization issue a signed credential carrying a FaceTec UR Code that can be printed and checked without a network connection.”

Or if podcasts aren’t your thing, read what Biometric Update wrote.

“Fraud typically happens after onboarding, Fabre says, during a transaction like wire transfer, an account change or a remote enrollment. FaceLock credentials are issued with a comparison of a government-issued ID document with a selfie using FaceTec’s face biometrics and liveness detection.

“’FaceLock brings ongoing authentication to those high-stakes moments, using liveness and real-time challenges,’ the CEO says.”

Also see Envoc’s page on FaceLock.

In conclusion, Envoc remains relevant.

“Universal” Login.gov Access Within Two Years

Well, Memorandum M-26-18 is out.

“SUBJECT: Scaling Use of Login.gov to Deliver a Universal Sign-on for Public Services”

That pretty much says it all. More details on the problem:

“Agencies currently use a range of distinct digital identity solutions. This results in members of the public often needing to maintain multiple sign-ons to interact with agencies and services. It also results in agencies needlessly reverifying an individual’s identity, often at a significant cost, where an existing verification could satisfy operational requirements. Further, agencies often pay commercial vendors to verify identity attributes for which the Federal Government may itself maintain an official data source.”

The solution is “universal” adoption of Login.gov within one year for some sites, within two years for others.

But does universal mean that it is available, or that it is the sole supported method? I was just at a federal website this week that allowed me to authenticate with either Login.gov or ID.me. Other websites apparently use Clear. Will the alternate options disappear in the future?

Maybe not. The Memorandum allows use of other solutions, but agencies should continuously re-evaluate if they are still needed. Or as Biometric Update put it:

“That makes the final policy more than an instruction to add Login.gov alongside existing systems. It establishes an explicit presumption in favor of consolidating federal authentication and identity verification around the government-operated platform while preserving exceptions for services and users Login.gov cannot adequately accommodate.”

Technically not a rebuke of private enterprise, since Login.gov works with some private vendors as technology partners.

Let’s see how this plays out.

International Data Sharing With CARICOM

Local and state governments cooperate, and national and multinational agencies do also.

Anthony Kimery at Biometric Update:

“The Department of Homeland Security (DHS) and the Caribbean Community’s (CARICOM) regional security agency, Implementation Agency for Crime and Security (IMPACS), signed an agreement to create the first multilateral biometric information sharing arrangement established by DHS, extending U.S. immigration vetting and border security checks across participating Caribbean countries.”

Because once someone has data, there is no TECHNICAL reason why they can’t share it with anyone else.

My Out-of-schedule Appearance in Biometric Update in 2026

This was NOT supposed to happen.

I broke the rule that I would only appear in Biometric Update every ten years.

  • While with MorphoTrak, I appeared in the publication in 2015.
  • While with Bredemarket, I wrote a guest post in 2025.
  • So I wasn’t supposed to appear until 2035.

But I did appear early…in 2026. 9 years early. You’d think I was a North Korean spy or something. (Again, I’m not.)

Google Gemini. It’s a long story.

My outreach, and my listing

Back to my breaking the ten year rule.

I contacted Biometric Update this morning and asked to be added to Biometric Update’s list of biometrics consulting solutions. And they answered.

Bredemarket’s entry is here.

Bredemarket
Bredemarket, biometrics consulting solution.
From Biometric Update.

So there I am, along with Acuity Market Intelligence, Goode Intelligence, and Liminal.

And yes, I privately disclosed—although I guess now it isn’t private any more—my self-centered motivation for appearing with other leading biometric product marketing consultants on this page, and elsewhere.

The first company named in Gemini’s answer is Acuity Market Intelligence, C. Maxine Most’s company. I definitely can’t argue with that.

Next is Goode Intelligence. Can’t argue with that either.

Third is Liminal. Ditto….

Guess who Gemini did NOT explicitly mention?

The biometric product marketing expert.

I want to be “me too” when this question is asked.

“Revealed,” Google Lyria, Public Domain.

“Always Be Selling”

As I previously noted, I can provide consulting clients with discussions of privacy, algorithmic bias, and both business-to-government (B2G) and business-to-business (B2B) issues.

If I can help your identity/biometric firm in these and other biometric product marketing areas, including content, proposals, and analysis, schedule a meeting with me.

Google Gemini.

All the Cool Kids Are Performing Injection Attack Detection Testing

I talk endlessly about presentation attack detection independent testing, but I occasionally discuss injection attack detection independent testing also, who performs the test (as more entities do so), and who has been tested.

The testing entities perform the test according to the European Committee for Standardization (CEN) standard CEN/TS 18099:2025.

“This document provides an overview of: 

– Definitions of biometric data injection attacks; 

– Use cases for injection attacks with biometric data on essential hardware components of biometric systems used for enrollment and verification; 

– Tools for injection attacks on systems using one or more biometric modalities. 

This document provides guidance for: 

– Injection Attack Instrument Detection System (defined in 3.12); 

– adequate risk mitigation for injection attack tools; 

– Creation of a test plan for the evaluation of an injection attack detection system (defined in 3.9).”

And Ingenium and BixeLab have developed their own testing methods.

iBeta and Injection Attack Detection Testing

And if you need a third choice of a testing lab, there is one. Via a sponsored post, iBeta joined the party.

“A new testing solution from iBeta Quality Assurance meets a growing need for evaluations of injection attack detection (IAD) products. The lab’s IAD testing launches today, and will be part of what iBeta showcases at Identity Week 2026 in Amsterdam next week. It includes testing up to Level 3, against the European standard CENS/TS 18099: 2025, across multiple platforms. And it presages the planned 2027 publication of the ISO/IEC standard dedicated to injection attack testing. iBeta will release a IAD testing solution for the ISO standard when it is released.”

Changes

The Biometric Update quote about the forthcoming ISO/IEC standard illustrates the challenge in testing when standards change, and new standards are adopted.

Something the Kantara Initiative recently addressed:

“Kantara Initiative announces the formal publication of the Kantara Initiative International Assurance Program: SP 800-63A-4 Service Assessment Criteria (SAC) & Statement of Criteria Applicability (SoCA), aligned to NIST Special Publication 800-63A Revision 4 – Identity Proofing.

“Following completion of the public review process and consideration of community feedback, the assessment criteria have been finalized and are effective immediately.”

NIST Special Publication 800-63A Revision 4 is the successor to Revision 3. Kantara Initiative previously offered assessments against the older standard, and can now assess against the newer one.

This illustrates the ripple effect of standards revisions…and in the case of injection attack detection, upcoming new standards.

You CAN Modernize…But Should You?

In the past, I have said:

“[T]he technology is easy. The business part is the difficult part.”

But Chris Burt of Biometric Update phrased it more succinctly:

“[P]olicy chases modernization”

As Burt notes, examples of policy chasing modernization include:

  • Digital sovereignty, a topic of discussion with everyone from ID4Africa to an organization called the World Ethical Data Foundation. (As an aside, a Bredemarket client and I were recently discussing the pros and cons of managing digital identities in the cloud vs. peer-to-peer synchronization.)
  • Cybersecurity and digital identity, a topic of discussion in government (the White House, NIST) and industry (Jordan Burris of Socure).
  • Other topics, including police facial recognition policy. (Hmm…I recall that both government and vendor biometric policies were the topic of a Biometric Update guest article last year.)

All of you recall Pandora’s Box. I’ve used the story multiple times, including when discussing my creation of Bredebot and its nearly-instantaneous hallucinations. Yes, I do have “policies” regarding this “modernization,” including full disclosure.

But are policies enough?

On Intent

I’ve been playing with the idea of intent (what I call “somewhat you why”) as a factor of identity verification and authentication. And although most people aren’t willing to go that far, intent analysis is becoming more important.

Biometric Update’s Chris Burt quoted RealSense Chief Marketing Officer Mike Nielsen on the company’s ID Pro. In this case, intent detection is used in a non-biometric fashion.

“We now have the ability to detect a person — not just a face — on the module.  Meaning, we can classify body parts (legs, arms, hands, feet) and estimate pose in real time, without any additional external software.  This includes which direction they are walking, how far away they are, and how quickly they are moving. This opens up an enormous opportunity for next-gen applications where you need to know the intent of a person beyond identifying their identity.  And you still get the ability to authenticate faces on the same platform.”

This is definitely NOT identity verification or authentication, but is certainly useful.

If accurate. If a system misreads intent, it can be disastrous.

Me the Loudmouth

Remember when we all used to perform vanity searches?

Now we perform vanity prompts, asking LLMs questions and hoping we come up as the answers.

So I recently performed the Google Gemini vanity prompt “Name five biometric content marketing specialists” and received this reply, in part.

“John is arguably the most vocal specialist specifically using the title ‘Biometric Content Marketing Expert.'”

In other words, my 1,800+ Bredemarket blog posts mean that I can’t shut up.

Oh, and Google, David Benini left Aware six years ago. But Chris Burt is still at Biometric Update.

If the City Fails, Try the County (Milwaukee and Biometrica)

The facial recognition brouhaha in southeastern Wisconsin has taken an interesting turn.

According to Urban Milwaukee, the Milwaukee County Sheriff’s Office is pursuing an agreement with Biometrica for facial recognition services.

The, um, benefit? No cost to the county.

“However, the contract would not need to be approved by the Milwaukee County Board of Supervisors, because there would be no cost to the county associated with the contract. Biometrica offers its services to law enforcement agencies in exchange for millions of mugshots.”

Sound familiar? Chris Burt thinks so.

“Milwaukee Police Department has also attempted to contract Biometrica’s services, prompting pushback, at least some of which reflected confusion about how the system works….

“The mooted agreement between Biometrica and MPD would have added 2.5 million images to the database.

“In theory, if MCSO signs a contract with Biometrica, it could perform facial recognition searches at the request of MPD.”

See Bredemarket’s previous posts on the city efforts that are now on hold.

And counties also.

No guarantee that the County will approve what the City didn’t. And considering the bad press from the City’s efforts, including using software BEFORE adopting a policy on its use, it’s going to be an uphill struggle.