A classified TSA facial recognition audit identified several findings. An unclassified version didn’t reveal the details.
But here’s what we do know from the Department of Homeland Security Office of the Inspector General (OIG):
“[W]e conducted covert tests at airport checkpoints to evaluate facial recognition and identification technology and observed how officers responded to and used results during screenings. We assessed the effectiveness of TSA technology, procedures, and personnel in identifying and preventing the use of fraudulent IDs. We issued three findings and six recommendations. TSA concurred with five recommendations and non-concurred with one; four recommendations are open and resolved, and two remain open and unresolved….”
There were details about one related issue:
“[W]e identified a significant weakness in that the CAT2 vendor was able to access and extract sensitive passenger information, including driver’s license and passport images, during system troubleshooting and enhancements, without TSA’s knowledge.”
No idea what the originally referenced findings are about. Are they confidential because they allow bad people to enter and exit the country, or are they confidential because they embarrass DHS and TSA? Note that the OIG had no problem throwing the vendor under the bus (or the plane, I guess).
Janice Kephart is known for her work as a key contributor to the 9/11 Commission. She’s now talked about 9/11 25 years later.
I’ve mentioned Kephart a couple of times in the Bredemarket blog. Her YouTube documentary on 9/11. Her company ZipID addresses whether people can legally work in the United States.
But I’ve never addressed the quarter century view of what has happened in the last 25 years.
“In this episode, Kephart joins the Biometric Update Podcast to connect the evolution of terrorist travel policy with identity theft, Real ID, biometric border systems, artificial intelligence and emerging debates over how border biometrics are used, as well as threats to critical infrastructure.”
A knowledgeable view of where we’ve been and how far we’ve come…and haven’t come.
Do we remember 9/11 25 years later? Google Gemini.
“The Transportation Security Administration (TSA) launched its Families on the Fly initiative to make the security screening process less stressful for parents traveling with young children.”
Specifically, young children under the age of 12.
“Dedicated family lanes are now available at 13 airports across the U.S. and Puerto Rico, with more locations expected to join the program.”
Among the 13 airports are Charleston International Airport in South Carolina, recently ranked as the best mid-sized airport. The second place airport, Ontario International Airport, doesn’t have the program yet. (John Wayne does.)
Families on the Fly. Google Gemini.
Someday we’ll catch up, and people will respect us.
The Buy American statute doesn’t really affect sole source justifications for specialized biometric systems. But it potentially could.
Sole source justifications for IDENT and HART
On Thursday, SAM.gov published the Department of Homeland Security’s Notice ID SSJ_FY26_0190 for Enterprise Biometrics Matching Support. This covers fingerprint matching hardware and software licenses and associated maintenance for the IDENT and HART systems.
DHS intends to make a sole source award to Thales DIS USA, the corporate successor to Cogent Systems (original biometric matching provider in 1994).
It makes sense for DHS to hold a sole source procurement, because most biometric systems are not multi vendor. You can’t plug an NEC or IDEMIA matcher into a Thales system. Even if IDEMIA is kinda sorta French also (French headquarters, majority U.S. owners, potential future Spanish owners).
When you can’t “buy American”
But as part of the paperwork to approve this sole source, DHS and Thales had to make the following certification:
“The exception to the Buy American statute permitting the purchase of articles that are not domestic end products is RFO 25.103(b)(2) Nonavailability.”
But can a DHS system have non-American components, bought from a foreign-controlled entity?
Although Thales DIS USA is NOT a FOCI-mitigated subsidiary of Thales (other portions of Thales are FOCI-mitigated), it provides commercial components to U.S. prime contractors. Thales DIS USA itself is isolated from the classified operations of DHS. The prime contractors for IDENT and HART handle the classified operations.
So the only question that remains is whether these French commercial components meet the exceptions of the Buy American statute. Because of the (necessary) exception, they can.
Or can you “buy American”?
But DHS could save one minor step if it selected a U.S. vendor. But can any U.S. vendor handle a huge system of HART’s size?
The irony here is that when IDENT began, Cogent Systems was a U.S. company, located just down the interstate from me in South Pasadena. And when 3M acquired it, it remains a U.S. firm. But once the Dutch company Gemalto entered the picture, the Cogent software and hardware became “foreign.”
But as of now it’s very French.
Sole source justifications for iDENT and HART. Google Gemini.
Having first worked for Printrak in 1994, I know all the major players in the biometrics industry, and many of the not-so-major ones. Heck, I remember when Digital Biometrics and Identix were fierce competitors…until they merged.
If you need my help to market your products against “the Big 3,” or if you are with “the Big 3” and need my help, learn about Bredemarket and book a meeting at https://bredemarket.com/watch-book/.
When the land is dry, you irrigate. As threats mushroom, the Department of Homeland Security (DHS) is proposing a RIVR expansion.
Google Gemini.
RIVR is the current name for the DHS’ Remote Identity Validation Rally, addressing ways to know who you’re dealing with. The “rally” format allows participants to test new technologies. Perhaps those technology will eventually meet Identity Assurance Level 3 (IAL3).
To encourage participation, the test results from participants are anonymized, and the identities are only revealed if participants choose to reveal them because of stellar performance. Here’s what Microblink said:
“Microblink was evaluated under the anonymized identifier DVS6. Among all participating vendors, Microblink was the only provider to meet RIVR “high performing” system benchmarks across every measured accuracy metric.”
Just a warning that RIVR tests are kind of like NIST tests. They’re sliced and diced in so many ways that almost everyone can claim to be the “winner” of the test. But as I mentioned before, this particular test resulted in a bunch of losers.
Google Gemini.
In the past, RIVR concentrated on basic identity document validation to ensure that a California driver’s license really was a California driver’s license. The rallies concentrated on topics such as basic document validation, the “selfie to ID” facial recognition matching process common in identity verification, and both active and passive presentation attack detection (liveness).
The 2026 RIVR expansion adds deepfake detection. Google Gemini.
“To build more robust evaluations, DHS S&T is calling on organizations that can produce or share examples of identity deepfakes attacks and the methods used to create them. Identity deepfakes, which may include face-swap videos or digitally generated or altered identity documents. This data will help the S&T develop a more complete and rigorous dataset for testing.”
This data-gathering exercise is a prelude for additional testing.
“December 2026: Applications open for companies developing presentation attack detection (detecting physical spoofing like masks or photos) and Biometric Deepfake Detection (detecting AI-generated impersonations, such as in video chats or teleconferencing).”
At the same time, DHS is also gathering “a broader set of real and fraudulent passports and driver’s licenses.”
Why? Because security of the homeland doesn’t just include keeping planes from flying into buildings. It also includes digital attacks to our infrastructure.
I try to fill the biometric news FOMO gaps for you at Bredemarket. Not just with breaking stories, but items that will be stories in the future.
A huge biometric bid. A not-so-huge biometric book. Changes in bank identification. Changes (maybe) in New Jersey courts. Tyranny trees. Identity Day.
Did you miss any of these stories? Read on.
Conquer biomertric news FOMO. Google Gemini.
Biometric bid due date FOMO
Take the Department of Homeland Security biometric capture device procurement (70RDA126R00000001): $440 million for finger, face, iris, palm, and multi-modal devices. So potentially up to five proposals, two volumes per proposal, two tabs per volume. That’s a lot of tabs.
Google Gemini.
Originally released Thursday September 10, the published due date was Friday, September 18 at 7:00 am Pacific. All the bidders waited for an extension announcement, which finally arrived less than half an hour before proposals were initially due. As I write this, bidders don’t have the real due date yet, other than it wasn’t due last Friday after all.
Biometric book FOMO
That last story was covered by Biometric Update. This next one understandably wasn’t.
Because Biometric Update concentrates on the biometric factor of identity verification and authentication. It occasionally touches on other factors, but not all six.
My book.
I do, which is why I plugged my book again. “Proving Humanity: The Six Factors of Identity Verification and Authentication” is for sale.
Banking digital identity FOMO
For a variety of reasons, ranging from detecting fraud to detecting terrorism, your bank or financial institution often asks you for your government identification. For example, your driver’s license.
Yes, banks can now accept mobile driver’s licenses, making things easier for banking customers. After all, we may leave our wallets at home, but we tend to keep our smartphones with us.
New Jersey court fingerprint acceptance FOMO
Unlike the stories above, there were NOT any updates on Judge Carmen Messano’s forthcoming evidentiary hearing. This hearing, when held, regards the acceptability of fingerprints as evidence in New Jersey courts. It was mandated as part of State v. French G. Lee.
Google Gemini.
Nothing yet; Messano just officially started this month. But something will happen, so I’m tracking it.
Tyranny trees FOMO
If you haven’t noticed, Flock Safety cameras are unpopular. So unpopular that people are bringing them down. Take Jevon Martinez, who brought some “tyranny trees” (his term for automated license plate recognition cameras) down and helpfully returned them to the sheriff.
Google Gemini.
And was arrested. Two words: dumb crime.
Lacking identity FOMO
Then on (as the Africans say) 16/9 ID4Africa and many others observed Identity Day 2026. 16/9 isn’t just a date; it’s a reference to United Nations Sustainable Development Goal Target 16.9 to “[p]rovide legal identity for all, including birth registration, by 2030.”
Identity Day 2026.
Avoiding biometric news FOMO
And there’s more, but rather than going back an entire week, I stopped at Wednesday.
But how can you conquer your fear of missing out on biometric news?
Because it will take time to complete fingerprint Tab A and Tab B, face tab A and tab B, iris tab A and tab B, and so forth.
As experienced biometric pros know, that’s a lot of Tab.
Lots of Tabs. Google Gemini.
I argue with a bot
And in related news, I argued with Gemini.
It argued that any due date extension would be short because the Government must receive proposals before the end of the fiscal year.
I replied that even with the original due date, there’s no way they’d make awards before September 30.
Gemini begged to differ.
The September 30 fiscal year-end (EOFY) deadline is critical for procurement teams even when final task-order awards won’t occur until the next fiscal year:
Obligating the Minimum Guaranteed Spend: Under FAR requirements for IDIQ contracts, the government must obligate funds to satisfy the “minimum guarantee” at the time the umbrella IDIQ contract is executed. For this vehicle, Section B.3(a) specifies a $250.00 minimum guarantee per awarded contractor per track. To count those base IDIQ execution actions against FY2026 appropriated funds before they expire on midnight September 30, the Contracting Officer must sign the base IDIQ contracts on or before September 30.
Accelerated HTRO Evaluation Model: The evaluation structure for 70RDA126R00000001 uses Highest Technically Rated Offerors with Fair and Reasonable Price (HTRO-FRP). Because this is a pass/fail-style technical evaluation without complex cost-realism trade-offs, DHS specifically designed the evaluation strategy to execute initial IDIQ base contract awards within 7 to 10 days of the September 18 submission.
Prepositioning Vehicle Seats for Day-1 FY2027 Task Orders: Establishing the master GWAC IDIQ base awards in FY2026 allows participating DHS components and external agencies to issue task order solicitations immediately when new FY2027 funding arrives on October 1.
Avoiding Anti-Deficiency Act Complications: Funding to stand up the administrative vehicle itself (such as setting up track minimums) must be committed using current-year funds. Letting the vehicle slip into October without awards could create procurement administrative delays or require re-justification under the incoming fiscal year’s budget.
The September 18 deadline isn’t aimed at completing task-order hardware purchases before September 30; it exists so the Contracting Officer can execute the base IDIQ master contracts and obligate the $250 minimums before FY2026 funds expire on September 30.
Lots of awards. Google Gemini.
Could you imagine asking Google Bard a similar question in 2023?
Multiple incidents, including the substitution of underage gig workers for qualified ones, have made it clear that “one and done” identity authentication risks fraud. The preferred method is continuous authentication to confirm that the originally authenticated person is still there.
As Bredemarket well knows, continuous monitoring applies beyond biometrics, and also applies to my analysis work for clients.
Date of last update
I often use Microsoft Excel in my analysis work, and my common practice (tip 1 here) is to insert a “date of last update” at the end of every row.
Why?
“Let’s say that you perform a ton of research and store it all in an Excel workbook. A few months later, someone questions you on a particular row of data.
“‘”John, you said that Agent Eikos didn’t support voice, but I just saw a press release from Anaheim Biometrics that talked about Agent Eikos’ new voice capabilities. When did you obtain your data?’
“Helpful hint: ‘Um, I dunno’ is not an acceptable answer.
“For years (even dating to my time at MorphoTrak and IDEMIA), I have ALWAYS included a “Date of Last Update” column in my Excel workbooks. It helps you know how old a particular piece (row) of data is. And it allows you to quickly select the rows with older dates so that you can revisit and update the data.”
Continuous monitoring
Let me give you a (heavily redacted) example. One of my analysis projects for a client involves a novel use of a current technology, and part of my work is to monitor others pursuing that same novel use.
So I may capture a data point that indicates that Red Widget Company conducted a pilot of the novel application in Belgium in 2024.
What happened to Red Widget Company’s pilot in Belgium in 2024? Was it shut down after the pilot completed, or did it transition to a production system?
Is anyone else piloting or deploying the novel technology in Belgium?
Is Red Widget Company pursuing pilots or deployments outside of Belgium?
Answering these questions adds more detail to a competitive analysis, making it richer as you fill in the blanks.
Ceasing continuous monitoring
But sometimes you don’t want to update things any longer.
I launched a client analysis project in the spring which required me, among other things, to monitor the Department of Homeland Security’s Silicon Valley Innovation Program. So I continuously monitored the opportunities list in the spring and the beginning of the summer.
When I talk about translation, I’m usually not talking about language translation. Trust me, my French, German, or Spanish isn’t good enough for that type of translation.
But I excel at other types of translation that help my client businesses run more smoothly.
Biometric translations
Bredemarket knows how different biometric systems “talk” differently…and how they can talk to each other.
I’m often talking about translating between different NIST-based biometric interchange standards. Because the FBI system doesn’t exchange biometric data in the same way as the DoD system, or the DHS system, or the RCMP system, or others.
“Luckily all the different standards have some basic similarities, but if you have a mobile biometric device that must submit to DOJ and DoD and DHS, you need to switch to the proper profile for each submission….
“But I’ve overcome this frustration over 30 years of immersing myself in all things biometric-translation related.”
And I may immerse myself some more. One of Bredemarket’s clients distributes software that submits to one system. What if that software has to submit to two systems? Or 20? Or 200?
But I deal with other translations too.
Stakeholder translations
Bredemarket knows the players in an identity, biometric, or technology system…and how they can talk to each other.
Any complex project will have a variety of stakeholders, each of whom speak their own “language.” My job at Bredemarket often entails allowing these people to communicate with each other.
To illustrate this, let me share a simplified example of something I shared before.
Engineers develop a biometric application.
The application has to conform to forensic standards.
The application is used by people in the field who may not know engineering or forensics, but who know conditions in the field better than engineers or forensic experts.
OK. Now write the user guide so that the field worker understands what the engineers created and captures what the forensic folks need.
This is where the inexperienced writer suffers from a failure of courage.
Let me tell you a little secret.
Most engineers can’t write the user manual. They’ll go into great detail about how the SDK references this particular process, but they can’t tell the field worker how to capture a fingerprint from a dead body that has been in the woods after a week of rain.
How has Bredemarket approached similar projects?
By asking the right questions of all the stakeholders—not just the three I mentioned here, but ALL of them including Ontario, California mayor Paul Leon (or whoever the political honcho is on YOUR project).
Then writing the draft. I won’t go into the “draft 0.5 – draft 1” mechanics here, since I’ve covered them elsewhere.
Then collaborating on the reviews, giving the draft to the stakeholders and insisting on getting timely feedback.
Then finalizing a document that allows the field worker to use the product in line with engineering and forensic advice (or advice from whoever) that the field worker understands.
I’ve performed this task—all the cool kids call this “cross-functional collaboration”—numerous times, working with everyone from sales to legal to a client’s own suppliers and end customers.
What do you need translated?
You know that your multi-department project won’t take off until someone glues the pieces together…and ensures that everyone is talking to each other.
At this moment Bredemarket is working on multiple client projects and delivering project management, strategy, writing, and other services.
This often involves translating between the different stakeholders. The outside business head doesn’t care what technical standards my client supports…but you can bet the outside technical head does.
Does your identity, biometric, or technology firm have a product marketing project that requires a lot of people to work together?
Let’s talk (for free) about how I can help. Set up a meeting below.
