Or, Facebook consumes reels.
Repurposed from the post “Is a 0.0001% EES Border Threat Level Meaningless?”
Tag Archives: passport
Is a 0.0001% EES Border Threat Level Meaningless?
I just reshared Tom Topol’s latest LinkedIn article to my Bredemarket Identity Firm Services readers on LinkedIn and Facebook, focusing on this quote:
“Between October 2025 and April 2026, the EES registered over 52 million border crossings. Entry was refused more than 27,000 times, including to almost 700 people who were identified as posing a security threat to the EU. Several thousand additional travelers were flagged for overstaying the Schengen 90/180-day rule…”
Is Europe over-emphasizing the threat?
But that isn’t how he begins the article.
“Europe’s Biometric Border and the Price of 700 Threats in 52 Million Crossings”
I did the math, and if you only count ACTUAL security threats, rather than visa overstays that COULD become security threats, you’re talking about a very small percentage: 0.0013461538%.
Topol asks:
“The question is not whether the EES caught anything. It is whether what it caught justifies what it costs: in financial terms, in operational disruption, and in the permanent erosion of informational privacy for hundreds of millions of innocent travelers.”
Let’s look at operational disruption. Topol cites GDPR Article 35’s requirement that “a Data Protection Impact Assessment must justify the necessity, suitability, and proportionality of any system processing biometric data at scale.” Topol cites a Spanish case that failed to obtain the required assessment (covered by Biometric Update), then extrapolates that EES is a net burden.
Topol acknowledges the deterrent effect—if fraudsters know their biometrics will be captured, they won’t attempt the fraud—but then notes that the argument “is also entirely unverifiable, and it has historically been used to justify the expansion of every surveillance system ever built.”
Bringing it all back home
Take the experience in my own country.
This isn’t a border issue, but when I joined the biometric industry in 1994, Los Angeles County was beginning to use fingerprint biometrics to ensure that the right people received government benefits—and the wrong people didn’t. Back in those pre-iPhone days only criminals gave their fingerprints, so this and other programs had an unsavory taint in the public’s eye. Yes the county saved money, but was this because fraudsters stayed away, or because legitimate users feared their fingerprints would go to the LAPD? The use of fingerprints for welfare benefits has disappeared today.
Returning to border crossings, our own entry-exit system has been justified by statements such as Senator Lindsey Graham’s 2015 claim about the 9/11 terrorists:
“All the hijackers who attacked — attacked us on 9/11 were visa overstays. So it’s more than just the border. You have got to control your visa program.”
According to FactCheck, Graham was off by 89%. Only two of the 19 terrorists were visa overstays. While the terrorists took advantage of flaws in the visa system, they had the visas.
Emotionally, I’m not convinced
Having spent over 30 years in this industry, I’m not about to chuck security out the window.
Emotionally I can’t do it.
And not because of the OVERLY emotional arguments, the “Jane never celebrated her seventh birthday because a cold-blooded smelly killer took her life.”
I’m talking about run-of-the-mill emotion.
And I have a challenge for you.
Tonight, when you go to bed, leave the front door of your house unlocked. After all, the chances of harm from an unlocked front door are minuscule.
I bet Topol locks HIS door at night.
No “Neutral Expression” When Free Lyria Songs Go Full Length
My latest Google Lyria song experiment surprised me.
I was playing back the song I had created when I noticed that the new song was longer than the standard 30 seconds. In fact, it was a full length three minute song, something only previously possible with paid versions of Lyria.
So I adjusted my prompt to take advantage of the length.
It’s probably no surprise that my latest Lyria song doesn’t touch on a couple who is never ever ever getting back together. Instead, I focused on the ICAO Doc 9303 “neutral expression” requirements I discussed in passing in this October 2025 post.
“But in one of those oddities that fill the biometric world, you can have TOO MUCH expression. Part 3 of International Civil Aviation Organization (ICAO) Document 9303, which governs machine readable travel documents, mandates that faces on travel documents must maintain a neutral expression without smiling. At the time (2003) it was believed that the facial recognition algorithms would work best if the subject were expressionless. I don’t know if that holds true today.”
That should make for a catchy song, shouldn’t it? Judge for yourself in the song “Neutral Expression.”
Wonder if the woman liked it.
She did!
Using LLMs for KYC. What Could Go Wrong?
The title of this post uses acronyms for brevity, but the full version is “Using Large Language Models for Know Your Customer. What Could Go Wrong?”
Biometric Update links to a TrendAI post that demonstrates how the use of a large language model to analyze document data is a vulnerability to prompt attacks.
“In a real-world stack built with FastAPI, Claude Code, and a SQLite MCP backend, his team embedded malicious instructions inside a passport so that the AI agent followed them and leaked other customer records directly into the verification page.”
What does this mean?
“The takeaway here is that if your AI can read documents and call tools, your documents can potentially become executable attack surfaces even when guarded with strict schemas.”
Something a human wouldn’t do.
Identity Document Validation is a Toxic Dumpster Fire
I may have misjudged Biometric Update.
Most technology publications, with the notable exception of IPVM, are at least partially funded by the companies they cover. Therefore there’s an unavoidable tension between keeping the advertisers happy and casting a critical eye on the industry.
I accept this tension because it applies to Bredemarket itself. Although my clients are absolutely wonderful, there may emerge a future situation where they may be less than perfect. So naturally I have to watch my tongue.
As does Biometric Update.
Remember when IDloop asserted it offered “the world’s first FBI-certified 3D contactless fingerprint scanner,” and Biometric Update reported the claim with no comment? I said at the time:
“Biometric Update reports news as reported, and I don’t think it’s Biometric Update’s purpose to poke holes in vendor claims.”
But then Biometric Update ran a more recent story.
They said that?
Bear in mind that Biometric Update’s advertisers include vendors who offer identity document validation solutions: either their own, or from a third party.
And Biometric Update’s recent story basically said that these solutions are a toxic dumpster fire.
OK, not in those words. Biometric Update is Canadian owned, and if the publication used the words “toxic dumpster fire” it would never stop apologizing.
But the true title is eye-catching in context:
“DHS RIVR results suggest most ID document validation disastrously ineffective”
Not just ineffective, DISASTROUSLY ineffective. Ouch.
For those not up in their acronyms, the Department of Homeland Security’s (DHS) latest annual round of tests was called the Remote Identity Validation Rally (RIVR).
DHS set performance goals for the submitted entries and publicized the (anonymous) results.
“Four of the seven subsystems tested met the goal for system error rate. Four did not meet the threshold for FRR, and five fell short in FAR. In other words, most systems let too few legitimate IDs through, even more passed too many fraudulent IDs, and six of seven fell short on one or both sides of the assessment.”
Biometric Update didn’t reveal the…um…identity of the one vendor that performed acceptably. But that vendor may self-reveal soon enough.
On anonymity
Why do testing entities sometimes allow participants to remain anonymous?
Because they want participants.
Some biometric tests are NOT designed to identify the best algorithms, but are instead designed to view the state of the industry. And that’s what this test performed with document validation.
Presumably a future test—POND, or Performance Of Notable Documents—will measure the future state-of-the-art of identity document validation.
Hopefully the results won’t be disastrous.
For My U.S. Readers Interested in Visiting Uzbekistan
When using your passport to travel internationally, sometimes you need a visa to enter a country.
And sometimes you don’t.
“The country of Uzbekistan will lift visa requirements for U.S. travelers starting Jan. 1, 2026, offering Americans another country to visit visa-free. The police change, which was recently confirmed by the government, will allow U.S. citizens to enter visa-free for up to 30 days.”
Just don’t bring your surfboards. Uzbekistan is double-landlocked.
Why Smart Turkeys Are Flying Away from the U.S. by Thursday Afternoon
Some turkeys are not staying for dinner Thursday. They’re flying away. Yes, turkeys can fly…if they have a valid passport.
California Voter Proof of Identity AND Citizenship: How?
(Imagen 4)
This post provides an update on election integrity, which I haven’t discussed since March.
The update? Assemblymember Carl DeMaio wants to put a proposition on the 2026 California ballot that achieves three purposes:
- “[R]equire the state to verify proof of citizenship when a person registers to vote.”
- Require voters to “provide identifications at the polls.”
- “Those who vote through mail-in ballots would have to give the last four digits of a government-issued ID such as a Social Security number.”
Let’s go through these…backwards.
Mail-in ballots
The third proposal about authenticating mail-in ballots is silly.
The mere fact that someone knows the last four digits of a Social Security Number does NOT prove that the person is the valid holder of the Social Security Number in question.
Frankly, I’m surprised that DHS released Leonardo Garcia Venegas just because he knew a Social Security Number. Of course, I’m also surprised that they determined his REAL ID was fake.
In-person ballots
Which brings us to the second proposal about requiring a government ID for in-person voting.
I’ve already addressed why this is silly. The short version? Election precinct workers have neither the equipment nor the training to tell whether a government ID is real or fake.
Voter registration…and re-registration
That only leaves the first one, proving citizenship at voter registration. This one is technically feasible; the feds do it all the time. The California Secretary of State could merely adapt the federal I-9 process to the state level; I’m sure Janice Kephart and her company ZipID would love to help the state with that.
Especially since the requirement for election integrity dictates that all of California’s existing voters would need to re-register to prove their citizenship.
All 22+ million of them.
Because if you DO NOT require all California voters to re-register, the whole exercise is pointless.
TSA Photo Requests: “The Current U.S. Government” Can Already Obtain Your Facial Image
There have been many recent stories about Transportation Security Administration (TSA) capture of the facial images of travelers, an outgrowth of the same post-9/11 concerns that resulted in REAL IDs in 2008…I mean 2025. (Maybe.)
One story from HuffPost clearly states its view on the matter. The title of the story? “Why You Can (And Should) Opt Out Of TSA Facial Recognition Right Now.”
I guess we know where HuffPost stands.
As to the “why” of its stance, here’s a succinct statement:
“Do you really want to be submitting a face scan to the current U.S. government?”
And perhaps there are good reasons to distrust the Trump Administration, or any administration.
After all, the TSA says it only retains the picture for a limited time: “Photos are not stored or saved after a positive ID match has been made, except in a limited testing environment for evaluation of the effectiveness of the technology,”
But maybe…something happens. Someone accidentally forgot to delete the files. Oops.
And if something happens, the federal government has just captured an image of your face!
Guess what? The federal government can probably already get an image of your face, even if you don’t allow TSA to take your photo.
After all, you had to show some sort of identification when you arrived at that TSA checkpoint. Maybe you showed a passport, with a picture that the U.S. State Department received at one point. No, they don’t retain them either. But maybe…something happens.
But who does retain an image of your face?
Your state driver’s license agency. And as of 2019:
“Twenty-one states currently allow federal agencies such as the FBI to run searches of driver’s license and identification photo databases.”
So if a federal agency wants your facial image, it can probably obtain it even if you decline the TSA photo request.
Unless you strictly follow Amish practices. But in that case you probably wouldn’t be going through a TSA checkpoint anyway.
But if you are with a facial recognition company, and you want your prospects and their prospects to understand how your solution protects their privacy…
Bredemarket can help:
- compelling content creation
- winning proposal development
- actionable analysis
Book a call: https://bredemarket.com/cpa/
(Security checkpoint picture generated by Imagen 3)
Looking at One Voter ID State
Back in 2023, I wrote “How to Vote Fraudulently in a Voter ID State.” But that only works if the voter ID state fails to protect its precincts from fake IDs.
Here is an example of voter ID legislation, this one from South Dakota.
12-18-6.1. Voters required to provide identification before voting.
When the voter is requesting a ballot, the voter shall present a valid form of personal identification. The personal identification that may be presented shall be either:
(1) A South Dakota driver’s license or nondriver identification card;
(2) A passport or an identification card, including a picture, issued by an agency of the United States government;
(3) A tribal identification card, including a picture; or
(4) A current student identification card, including a picture, issued by a high school or an accredited institution of higher education, including a university, college, or technical school, located within the State of South Dakota.
Source: SL 2003, ch 82, § 1; SL 2004, ch 108, § 3; SL 2006, ch 71, § 1.
As most people know, legislators only define the law in broad strokes. It is up to the executive to figure out the details of how to implement the law.
So how does the South Dakota Board of Elections determine that the presented identification is valid?
Does every precinct worker in South Dakota possess a copy of a guide (such as this one) that includes, among other items:
“Explanation of what the proper alphanumeric sequencing of a South Dakota ID or Driver’s License should be (how many letters, numbers, etc.).”
In addition, does every precinct worker in South Dakota have access to software and equipment (such as this one that uses “white, infrared, ultraviolet and coaxial lights”) that detects deepfake IDs? This one has a $1,600 list price. You can get cheaper ones that only support white light and can’t detect the other security features, but such readers would violate the law.
If the state can negotiate a discount of $1,000 per reader, then you can equip almost 700 precincts for less than $1 million (excluding training and maintenance, and assuming only 1 reader per precinct). A small price to pay for democracy.
Unfortunately, I could not find Regula in the list of certified South Dakota voting equipment. Perhaps South Dakota uses a competitor.
Of course voter ID fraud doesn’t just affect South Dakota, as I previously noted. But even if South Dakota doesn’t equip its precinct workers to reject voters with fake IDs, I’m sure the other states do.
Well, maybe not Alabama.
Bredemarket 