Do We Truly Need All Available Facial Data? Maybe, maybe not.

In the ideal world, forensic face specialists benefit from having all available facial data to perform their examinations.

But what if they don’t have a full view of the faces?

And do they even need it?

When masks were the rage

The biometric world encountered this issue a few years ago, when a worldwide COVID epidemic caused people to wear the newest cool accessory. Face masks that, when worn properly, covered the nose and the nouth.

The facial recognition algorithms at the time assumed the continued visibility of unchangeable facial features. The eyes. The nose. The mouth. Take some of those away, and accuracy decreased.

So NIST sprung into action and began a new test. Beginning in March 2020, NIST took existing facial images, superimposed face masks on them, and tested the accuracy (1:1) with the face masks. As expected, newer algorithms developed after COVID were more accurate with masked faces. NIST discontinued this particular test in February 2024.

When parts of a face are covered

After NIST’s face mask testing ended, researchers performed a different test in which “participants matched an occluded probe image to one of two target identities by selectively revealing isolated facial features (e.g., ears, eyes, nose).” Kinda like slowly revealing the pieces of a puzzle.

“We focused on nine facial features: cheeks, chin, ears, eyes, eyebrows, forehead, neck, nose, and mouth. These align with parts of the face described in FISWG [Facial Identification Scientific Working Group] guidelines and prior research.”

To conduct the test, the researchers obscured the probe image completely, and test participants “were allowed to reveal one feature at a time on the probe image until they were ready to make their decision.” Kinda like “I can identify this person with 2 of 9 features visible.” The goal was to keep the number of features revealed as low as possible.

After the participants had finished, the researchers examined the resuilts. They found: “Trials where only a single feature was revealed were the most frequent occurrence, comprising 396 out of a total of 648 trials.”

Read that again.

Of all nine features (cheeks, chin, ears, eyes, eyebrows, forehead, neck, nose, and mouth), over half of the tests completed after the participants had revealed only a single feature.

And which single features were used for many of these identifications? The forehead and the ears.

“Foreheads were associated with the highest accuracy (probability of success = 0.94), though the lower bound of the 95% confidence interval reached a comparatively low value of 0.71. In contrast, ears showed a similarly high probability of success (0.93), but with a tighter confidence interval (lower bound: 0.88).”

Now let me caution that these were people and not algorithms, so this is not really comparable to NIST’s face mask testing. But it suggests some ways to improve algorithms. If they’re not already doing so, perhaps the algorithms should more thoroughly analyze foreheads and ears. The eyes are apparently less important when real people do the work. And all available facial data may not do the job.

Carefree Biometrics

We often think of enforcement biometrics. What about carefree biometrics?

Fingerprinting and facial recognition in particular were heavily associated with law enforcement and intelligence applications that welfare recipients feared their biometrics would immediately go to the police. It’s wasn’t until Apple used fingerprints (Touch ID) and faces (Face ID) to unlock phones that people stopped thinking of Big Brother privacy-violating biometrics. Well, partially.

But what if we thought of biometrics as our friend? Maybe the Big Three could show carefree scenes of biometrics as the gateway to fun.

Well, some people would buy it. Others would not.

Carefree biometrics?

Negative Findings in TSA Facial Recognition Audit

A classified TSA facial recognition audit identified several findings. An unclassified version didn’t reveal the details.

But here’s what we do know from the Department of Homeland Security Office of the Inspector General (OIG):

“[W]e conducted covert tests at airport checkpoints to evaluate facial recognition and identification technology and observed how officers responded to and used results during screenings. We assessed the effectiveness of TSA technology, procedures, and personnel in
identifying and preventing the use of fraudulent IDs. We issued three findings and six recommendations. TSA concurred with five recommendations and non-concurred with one; four recommendations are open and resolved, and two remain open and unresolved….”

There were details about one related issue:

“[W]e identified a significant weakness in that the CAT2 vendor was able to access and extract sensitive passenger information, including driver’s license and passport images, during system troubleshooting and enhancements, without TSA’s knowledge.”

No idea what the originally referenced findings are about. Are they confidential because they allow bad people to enter and exit the country, or are they confidential because they embarrass DHS and TSA? Note that the OIG had no problem throwing the vendor under the bus (or the plane, I guess).

Does Your 1:N Facial Algorithm Meet Minimum 1:1 Accuracy?

Starting November 30, NIST is enforcing a minimum 1:1 accuracy requirement for developers who wish to participate in 1:N testing.

As a reminder, NIST conducts a Face Recognition Technology Evaluation (previously known as the Face Recognition Vendor Tests). This testing comes in two flavors: 1:1 verification and 1:N identification, known as FRTE 1:1 and FRTE 1:N, respectively.

The 1:1 testing is conceptually less difficult than 1:N, though it’s difficult enough. For 1:1 testing, you simply compare one biometric sample against another biometric sample to determine if they came from the same person. For 1:N testing, you compare a single biometric sample against an entire database of biometric samples. Up to 12 million in one of the NIST tests. Many, many more in the real world.

Would you rather compare against one biometric sample, or 12 million?

Changes to minimum 1:1 accuracy (time may change you)

For years, NIST allowed anyone to submit their algorithms for NIST testing, no matter how inaccurate they were. The results would be publicly displayed for all to see, so there was a disincentive to apply if you know your algorithm is poor.

But inaccurate algorithm providers submitted anyway. To those not familiar with NIST test results, an False Negative Identification Rate (FNIR) of 1.0000 is not good. As of this year, NEC has achieved an FNIR on the visa-bordrt test of 0.0012, which is…much better.

But as facial recognition algorithms improve in accuracy, NIST has decided to enforce some minimum standards on 1:N test participation. Specifically, you need to reach a minimum accuracy in the 1:1 test.

“Prerequisite Requirement (New Participants): Participants must first submit at least one algorithm to the FRVT 1:1 track, and its accuracy must exceed at least one of the following:

“Visa-Border dataset: FNMR of 0.025 or less at FMR=0.000001”

Yes, there was an editing error somewhere along the way, since there is ONLY one accuracy requirement. But there is a timing requirement that does not concern me here.

And this minimum requirement only applies to new participants. So the assumed workflow is that a new participant submits to 1:1 first, then once they clear the accuracy hoop they can submit to 1:N.

Minimum 1:1 accuracy enforcement. Google Gemini..
Minimum 1:1 accuracy enforcement. Google Gemini..

The relationship between 1:1 and 1:N

Years ago, a Bredemarket client asked me to review its (then) FRVT 1:1 results. I reviewed them; they performed excellently. But I pointed out to the client that for its particular market 1:1 was meaningless, and the company REALLY needed to submit to FRVT 1:N.

The company then revealed that it had also submitted its algorithm for 1:N testing. Eventually NIST released those results, and the company performed excellently for 1:N as well.

But today, even though 1:1 and 1:N address different problems, new NIST test participants must pursue 1:1 accuracy first to make sure they can participate in 1:N.

Reach for the stars

So if you’re new to this industry, set your priorities. Get your 1:1 house in order.

Of course, some “new” participants aren’t that new. Omnigarde had never written a facial recognition algorithm before, the principal having specialized in fingerprint algorithms through decades of corporate life. But that experience helped Omnigarde develop its facial recognition algorithm, which is in the upper tier of providers. (2025 1:N results here.)

But what will happen to facial accuracy in the future? Yes, it’s been improving substantially over the past two decades. But it may get much better.

Self-Excluded from Commodities Trading? Not Likely.

No one thought of being self-excluded from commodities trading…until now. But let me explain what self-exclusion is.

Self-exclusion from gambling

It’s a term that applies to problem gamblers who ask the state to voluntarily self-exclude them from casinos. There are technologies, such as facial recognition, that can flag any attempt by a self-excluded person to enter a casino. And of course there are other ways to identify people and keep them out of casinos. Or out of the online versions of casinos.

Because gambling is regulated by states and/or Indian tribes, these self-exclusion lists are usually maintained at that level.

And they work for gambling. Take the story of “Thomas” (last name not given) who developed a problem with DraftKings and FanDuel.

“I could have ten drinks one night and then be fine with not drinking again for a year,” said Thomas, 35, who asked to be identified by his middle name fearing his problem gambling history could affect his career. “But sports gambling was different. It really got me.”

Eventually Thomas was tens of thousands of dollars in debt and declared bankruptcy. That prompted him to place himself on a self-exclusion list.

And all was fine…for a while.

Attempted self-exclusion from commodities futures trading

“Then one day, about two years later, I’m scrolling on Instagram and I came across an ad for Kalshi,” said Thomas. “I was bored and thought this could be fun…”

Well, Thomas fell into the same old habits again…with one big difference. Because Thomas was not gambling, but instead trading in commodity futures, the sites “do not follow state-mandated protections for people with gambling addictions who are most vulnerable to relapsing.”

Because while it is theoretically possible for someone to become addicted to trading hog futures, it’s fairly unlikely.

Hog futures addiction. Google Gemini.
Hog futures addiction. Google Gemini.

And the CFTC isn’t going to force the companies it regulates to perform self-exclusion. When Thomas tried to self-exclude from Kalshi, the company sent him a weakly worded message.

An automated response from Kalshi noted that “self-exclusion is a responsible trading safeguard designed to be irreversible.” It offered other solutions: “Three different responsible risk-management actions can be taken: trading break, voluntary opt-out, and a personalized funding cap.”

Thomas insisted he wanted to be banned from the app. Two days later, he also made three separate requests to Kalshi over email for his account to be permanently closed, correspondence he shared with NPR show.

Eventually Kalshi relented, but it was a hard fight. A fight in which casinos regulated by Nevada and other gaming authorities would not engage.

And so far the CFTC has exhibited no interest in mandating self-exclusion, and no respect for the need to do so. And why would they?

Self-excluded from commodities trading? Google Gemini.
Self-excluded from commodities trading? Google Gemini.

Add FR to Flock: Another Meaning for TPRM

What happens when a third party proceeds to add FR to Flock? Another meaning for third party risk management.

I intentionally used abbreviations in my title for letter count purposes, so I should explain that “FR” means facial recognition, and “TPRM” is third-party risk management. The latter usually refers to managing data that third parties process for your company (or mismanaging it). But what if it meant that the third parties do something to your software that you refuse to do yourself?

Flock Safety and facial recognition

Take Flock Safety, a company that has its own controversies. But there are some things that Flock Safety will NOT do.

“No. Flock cameras do not use facial recognition.

“They are built to identify vehicle information, not personal biometric data.”

Add FR to Flock via VIDIZMO

But before you breathe a sigh of relief, remember that just because Flock Safety doesn’t incorporate facial recognition doesn’t mean that third parties can’t do it either. 404 Media:

“A company called VIDIZMO is advertising the capability to export footage from FlockOS to its own platforms that do facial recognition, behavior prediction, and racial and gender analysis on live camera feeds.”

This is not some great fault of Flock Safety, because ANY program that allows export (or a screenshot) can pass its data to some other program.

Any third party can add FR to Flock. (And this isn't my real license plate number.) Google Gemini.
Any third party can add FR to Flock. (And this isn’t my real license plate number.) Google Gemini.

I can take a screenshot of something that displays on a religious website and feed it into a porn generator. That’s not the religious website’s fault.

Oh, and just to confuse the issue: VIDIZMO advertises this capability, but doesn’t have it yet.

“VIDIZMO’s CEO, Nadeem Khan, told 404 Media on a video call that the company has not yet started running facial recognition tech on footage from Flock cameras, and that it has not actually built the specific tool that would export data from Flock’s system to its own platform.”

Add FR to Flock via Clearview AI

But VIDIZMO isn’t the only game in town. The DeFlock folks note that at least one jurisdiction has both Flock Safety and Clearview AI software.

“As WECT reported on August 10, 2026, in a July email to county leaders Sheriff Ed McMahon wrote that the county’s [Flock Safety] system does not use facial recognition, is not used for traffic enforcement, and is not a live surveillance system, collecting only what he called ‘limited’ vehicle information.”

But…

“The Sheriff’s Office…purchased Clearview AI — ‘Clearview Search PRO,’ $12,995 per year (plus a $500 setup fee), County Contract #24-0236 — procured through Carahsoft and set to auto-renew. Facial recognition is not something New Hanover might acquire; it is software the Sheriff’s Office already owns.“

At the same time, DeFlock makes it very clear that it has no evidence that the agency HAS linked the two software programs. Just that it COULD.

This fits within the realm of the possible, but not necessarily the realm of the probable.

The Attack of the Realistic Fraud Bots

Realistic fraud bots are the new threat. The days of obviously spotting a deepfake have long since passed us by.

Pymnts reported on this in “When Fraud Becomes the Customer: The Next Battlefront for Issuers.”

In the past, enterprises defended themselves by analyzing voices (voice identification/speaker recognition and liveness detection), faces (facial recognition and liveness detection), and behaviors (behavioral biometrics).

But what happens when the fraud bots are able to convincingly fake voices, faces, and behaviors?

Realistic fraud bots. Google Gemini.
Realistic fraud bots. Google Gemini.

Or when attempts to detect fraud become so onerous that the real customers run away due to the increased friction?

One expert claims that voice identification is already useless.

“Tim Joslyn, Chief Technology Officer of Paymentology, told PYMNTS Intelligence that voice authentication has already reached the point of vulnerability. In his view, financial institutions that continue to rely heavily on this method could already be exposed. ‘I think voice has already failed,’ he said. ‘If you’re a bank and you’re aligned on voice, then potentially you’re already in trouble.'”

Not sure how the voice biometrics vendors would react to that….Actually, I do know. Here’s what Pindrop says:

“A person’s voice has distinct characteristics that deepfake AI struggles to replicate with 100% accuracy. By focusing on these unique aspects, voice authentication systems can differentiate between real human voices and AI-generated fakes.”

But is it good enough…and will it be good enough in the future?

And if you’re a biometric company, how do you convince your prospects of your solution’s value?

By partnering with a biometric product marketing expert. Find out more about Bredemarket’s capabilities at https://bredemarket.com/watch-book/.

Revised 10/28/2026.

The RIVR Expansion is Not a Flood, But an Irrigation

When the land is dry, you irrigate. As threats mushroom, the Department of Homeland Security (DHS) is proposing a RIVR expansion.

Mushrooms in the desert, symbolizing the need for the 2026 RIVR expansion.
Google Gemini.

RIVR is the current name for the DHS’ Remote Identity Validation Rally, addressing ways to know who you’re dealing with. The “rally” format allows participants to test new technologies. Perhaps those technology will eventually meet Identity Assurance Level 3 (IAL3).

To encourage participation, the test results from participants are anonymized, and the identities are only revealed if participants choose to reveal them because of stellar performance. Here’s what Microblink said:

“Microblink was evaluated under the anonymized identifier DVS6. Among all participating vendors, Microblink was the only provider to meet RIVR “high performing” system benchmarks across every measured accuracy metric.”

Just a warning that RIVR tests are kind of like NIST tests. They’re sliced and diced in so many ways that almost everyone can claim to be the “winner” of the test. But as I mentioned before, this particular test resulted in a bunch of losers.

Google Gemini.

In the past, RIVR concentrated on basic identity document validation to ensure that a California driver’s license really was a California driver’s license. The rallies concentrated on topics such as basic document validation, the “selfie to ID” facial recognition matching process common in identity verification, and both active and passive presentation attack detection (liveness).

The 2026 RIVR expansion adds deepfake detection. Google Gemini.
The 2026 RIVR expansion adds deepfake detection. Google Gemini.

But the 2026 RIVR expansion encompasses new testing related to deepfake detection.

“To build more robust evaluations, DHS S&T is calling on organizations that can produce or share examples of identity deepfakes attacks and the methods used to create them. Identity deepfakes, which may include face-swap videos or digitally generated or altered identity documents. This data will help the S&T develop a more complete and rigorous dataset for testing.”

This data-gathering exercise is a prelude for additional testing.

“December 2026: Applications open for companies developing presentation attack detection (detecting physical spoofing like masks or photos) and Biometric Deepfake Detection (detecting AI-generated impersonations, such as in video chats or teleconferencing).”

At the same time, DHS is also gathering “a broader set of real and fraudulent passports and driver’s licenses.”

Why? Because security of the homeland doesn’t just include keeping planes from flying into buildings. It also includes digital attacks to our infrastructure.

Google Gemini.
Watch and book.

https://bredemarket.com/watch-book/

Does Your Consultant Offer Biometric Domain Fluency?

Considering the right consultant for your biometric firm often comes down to a single, make-or-break dynamic: biometric domain fluency.

But that’s just a fancy phrase for knowing what you’re talking about.

“The Longest Hour.” Google Lyria. Public Domain.

Consider what happens when a product marketing consultant at a biometric firm does NOT possess biometric domain fluency.

Off-target content

Imagine that you’re writing your first blog post for a biometric company. So you figure you’ll get educational by telling your prospects how “Gender Shades” identified huge accuracy problems, but your firm’s facial recognition algorithm has overcome them.

Consultants with biometric domain fluency know the difference between facial recognition and facial analysis.
Google Gemini.

Congratulations, novice. You just mixed two distinctly different things up.

I’ve addressed this before, but I’ll address it again. Do you know why that old study was called “Gender Shades”? Because it tested algorithmic ability to recognize gender and race. That is facial ANALYSIS (or categorization), not facial RECOGNITION (or individualization). The National Institute of Standards and Technology (NIST) draws a clear distinction between the two. And if you use a high-quality facial recognition application, the gallery of possible matching candidates may have a white woman next to a black man…because the facial recognition algorithm DOES NOT CARE about gender or race.

And that’s just one example of how someone who doesn’t know biometrics can make a grievous mistake that repels a firm’s prospects.

Losing proposals

Before I launch into this, let me explain that there are a number of reasons why a firm may lose a proposal.

  • Not submitting your proposal in Times New Roman 12 font with one-inch margins.
  • Submitting a 16-page proposal when the page limit is 15 pages.
  • Submitting your proposal Friday at 5:03 pm when it was due at 5 pm.

Here I want to talk about something different: getting the answers wrong.

Let’s say you’re tasked to answer a question about submitting your fingerprints at 500 pixels per inch (ppi). But you want to get some extra evaluation points, so you write this:

“The Super Duper Ridger fingerprint reader EXCEEDS THE REQUIREMENT by capturing fingerprints at 1000 ppi.”

Google Gemini.

Congratulations, novice. You’re non-compliant.

Granted, latent fingerprint examiners LOVE higher resolution tenprints and latent prints where they can see the finer detail. But for everyone else, high resolution prints can potentially cause huge problems. Longer time to display images on the screen. Longer network transmission time and higher network bandwidth. Oh, and four times as much storage space. If the agency specifies 500 ppi, they mean what they say.

You have to know your biometrics to answer the questions properly.

Flawed analysis

Sometimes, product marketing consultants need to strategically analyze the market. Or the products in the market. Or the competitors who sell the products in the market. Analysis is a minefield in which an inexperienced person can get blown up.

Let’s say you’re asked to identify the leading facial recognition algorithm providers for U.S. intelligence community agencies. Now you, being a smart person who knows the difference between face recognition and face analysis, hone in on NIST’s Face Recognition Vendor Test (FRTE) collection. You go to FRTE 1:N, identify the specific test that best meets the needs of the intelligence community, and sort the list with the most accurate algorithms at the top. You then report results for all the leading vendors…including CloudWalk, Megvii, and SenseTime.

Google Gemini or Imagen; I can’t remember which.

Congratulations, novice. The firm that contracted with you will NEVER get intelligence business.

All three of the firms I mentioned are Chinese firms. Just because NIST or the FBI tests an algorithm doesn’t mean that U.S. agencies will buy it. For legal and practical reasons, the CIA is not going to install a Chinese algorithm on one of its systems.

No point in performing a competitive analysis on firms that will never compete in your markets.

Avoid these problems by contracting biometric domain fluency

You can avoid these problems by contracting with a product marketing consultant who offers biometric domain fluency.

Such as Bredemarket.

My wife passed by me while I was drafting this post, and when I told her I was writing about biometric domain fluency, she was not impressed.

Then again, she is not an identity marketing leader.

But if YOU are an identity marketing leader, consider Bredemarket for your consulting needs.

Watch and book.

Learn about what I can do for your firm and schedule a free meeting.

https://bredemarket.com/watch-book/