Tag Archives: Thales

Sole Source Justifications, the Buy American Statute, and IDENT/HART

The Buy American statute doesn’t really affect sole source justifications for specialized biometric systems. But it potentially could.

Sole source justifications for IDENT and HART

On Thursday, SAM.gov published the Department of Homeland Security’s Notice ID SSJ_FY26_0190 for Enterprise Biometrics Matching Support. This covers fingerprint matching hardware and software licenses and associated maintenance for the IDENT and HART systems.

DHS intends to make a sole source award to Thales DIS USA, the corporate successor to Cogent Systems (original biometric matching provider in 1994).

It makes sense for DHS to hold a sole source procurement, because most biometric systems are not multi vendor. You can’t plug an NEC or IDEMIA matcher into a Thales system. Even if IDEMIA is kinda sorta French also (French headquarters, majority U.S. owners, potential future Spanish owners).

When you can’t “buy American”

But as part of the paperwork to approve this sole source, DHS and Thales had to make the following certification:

“The exception to the Buy American statute permitting the purchase of articles that are not domestic end products is RFO 25.103(b)(2) Nonavailability.”

But can a DHS system have non-American components, bought from a foreign-controlled entity?

Although Thales DIS USA is NOT a FOCI-mitigated subsidiary of Thales (other portions of Thales are FOCI-mitigated), it provides commercial components to U.S. prime contractors. Thales DIS USA itself is isolated from the classified operations of DHS. The prime contractors for IDENT and HART handle the classified operations.

So the only question that remains is whether these French commercial components meet the exceptions of the Buy American statute. Because of the (necessary) exception, they can.

Or can you “buy American”?

But DHS could save one minor step if it selected a U.S. vendor. But can any U.S. vendor handle a huge system of HART’s size?

The irony here is that when IDENT began, Cogent Systems was a U.S. company, located just down the interstate from me in South Pasadena. And when 3M acquired it, it remains a U.S. firm. But once the Dutch company Gemalto entered the picture, the Cogent software and hardware became “foreign.”

But as of now it’s very French.

Sole source justifications for iDENT and HART. Google Gemini.
Sole source justifications for iDENT and HART. Google Gemini.

Having first worked for Printrak in 1994, I know all the major players in the biometrics industry, and many of the not-so-major ones. Heck, I remember when Digital Biometrics and Identix were fierce competitors…until they merged.

If you need my help to market your products against “the Big 3,” or if you are with “the Big 3” and need my help, learn about Bredemarket and book a meeting at https://bredemarket.com/watch-book/.

Watch and book. Revised 10/28/2026.

My Algorithm is American Made

The United States of America, like many other countries, displays patriotism. One example is the Oak Ridge Boys song “American Made.”

And the United States of America, like many other countries, commercializes patriotism. One example is the Miller commercial “Made the American Way.”

At the time this commercial was filmed, Miller WAS American made, under the ownership of Philip Morris. Today, of course, Miller is NOT solely American made, with the company owned by Molson Coors with headquarters and executive offices in Chicago, Montreal, and Golden Colorado. Its brand competitor Budweiser is Belgian made.

I am very familiar with cross-border ownership, having worked for Safran (French headquarters) and IDEMIA (French headquarters, but primarily owned by a U.S. investment firm). So when someone asks whether IDEMIA is a U.S. company or a French company, the proper answer is “yes.”

IDEMIA’s major competitors, NEC and Thales, are non-U.S. owned.

And if the Amadeus deal goes through, an American investment firm will NOT own the new entity.

But there are U.S. biometric firms. Bredemarket works or has worked for multiple U.S.-owned/headquartered biometric companies.

One company that is not (yet) a Bredemarket client is ROC (a/k/a Rank One Computing). Since it works with U.S. security agencies, you can bet that ROC echoes the Oak Ridge boys in its marketing. Josh Engelsma:

“For decades, large-scale U.S. biometric identity systems have relied heavily on foreign fingerprint providers. ROC’s performance in the NIST FRIF TE E1N evaluation, including #1 global ranking in Class B slap fingerprints, a critical capture format for high-scale civil and government identity programs, proves that American technology can now lead at the highest levels of global biometric performance.”

It’s hard to predict whether U.S. government agencies will become “more patriotic,” since there are so many good foreign algorithms out there. But don’t count on DHS implementing a system with a Chinese algorithm.

The MOSIP “Standard”

I’ve previously discussed the false impression that standards achieve recognition via a free, fair, universal consensus. In truth, standards are bullied through the process by one or more interested parties, who then shut out competitors that don’t comply with their…I mean, the industry’s standard.

Meanwhile, companies that don’t comply with the standard ridicule it and say how the standard stifles innovation and brings the whole industry down.

For example, in a few years smartphone manufacturers will complain that the EU’s adoption of USB-C as a universal common charger standard will cause the EU to lag behind when new charging technologies emerge.

Which brings us to MOSIP.

What is MOSIP?

So what does this acronym stand for, and what does it mean?

“The Modular Open Source Identity Platform was established in 2018 to support governments in providing its residents with an official form of the most important human asset – identity.

“As nations around the world proceed on their digital transformation journeys towards true digital economies, a robust and secure national ID system is the crucial first step. With a foundational national ID system in place, a government can build effective civil registries, and service delivery systems, serving the population in a myriad of ways. Among other benefits, robust systems like these enable faster disaster relief, climate resilience, ease of starting new businesses, and better access to financial inclusion, healthcare, and education.”

Established and incubated in Bangalore, India, MOSIP is aligned with the United Nations Sustainable Development Goals and supported by the Gates Foundation and others.

In case you didn’t get the drift, the MOSIP people aren’t regular visitors to Mar-a-Lago.

But their principles align with the goals of many biometric companies that have chosen to list their MOSIP-compliant products on the MOSIP Marketplace.

The marketplace categorizes MOSIP-compliant solutions into six categories:

  • Registration devices.
  • Authentication devices.
  • ABIS (Automated Biometric Identification Systems).
  • SDKs (Software Development Kits).
  • Print devices.
  • Labs.

I won’t list all the MOSIP-compliant solution providers, but there are many of them, including two of the “big three” biometric firms, NEC and Thales.

Any questions?

MOSIP but not MOSIP

I hear a question from the back row from a guy wearing a multicolored wig.

Falco in “Rock Me Amadeus.” From https://youtu.be/cVikZ8Oe_XA.

After all, the third of the “big three,” IDEMIA, has advertised that it provides MOSIP solutions.

“The Togolese Agency for Identification, ANID-TOGO, has partnered with IDEMIA and Atos to build a national biometric eID system based on the Modular Open Source Identity Platform (MOSIP). IDEMIA and Atos will design, build, test, and run a biometric national eID solution for Togo based on iris, face, and fingerprint recognition technology.”

Sounds impressive…until you scan the MOSIP Marketplace and find no listed solutions from IDEMIA or ATOS.

Because “based on” does not equal “compliant with.”

I can say that Bredemarket’s seven-question process is based upon some marketing standard or another, but that doesn’t mean that an independent third party has certified my compliance, or even stated its conformance.

So why doesn’t IDEMIA offer MOSIP-compliant solutions?

Honestly, I don’t know. I haven’t had regular official contact with IDEMIA in years, and the person that I know who just rejoined IDEMIA probably doesn’t know either.

So I have no authoritative answer, but Google Gemini provides this very unauthoritative answer as to IDEMIA’s MOSIP non-compliance:

“IDEMIA’s core business model historically relies on end-to-end, proprietary solutions. MOSIP, by contrast, is an open-source framework designed specifically to prevent vendor lock-in by letting governments mix-and-match components from different tech providers.”

Let’s assume for the moment that Gemini is right in this case. So while IDEMIA may be willing to speak about a solution in Togo “based on” MOSIP, when IDEMIA goes after a critically important opportunity in the FBI or the CIA or the BBC (you know the rest), it’s going to provide a solution based upon IDEMIA-authored components such as its own MorphoKit software development kit.

Knowing full well that the U.S. Federal Bureau of Investigation doesn’t give a hoot about MOSIP compliance.

Because it’s not critically important in that market.

Know Your Market

Some biometric vendors focus on the developing world, some adopt the developing world as a secondary opportunity, and others just don’t care because their real revenue comes from elsewhere.

Where should your company focus its attention?

Bredemarket can help your company with analysis, and provide focused content as the analysis progresses. (Analysis is never complete. Things change.)

If Bredemarket can help you decide if MOSIP compliance is worthwhile or worthless, schedule a free meeting.

The Really Big Bunch Isn’t Afraid of Biometrics Any More

Are the major tech firms about to drive the relatively miniscule identity/biometric firms out of business?

Don’t be evil: stay away from surveillance

I’ve previously discussed the “big three” in biometrics: currently IDEMIA, NEC, and Thales (although IDEMIA may be replaced by Amadeus at some point). These companies are seemingly big, with billions of dollars in revenue…but they are dwarfed by the “really big bunch” of Google, Meta, and whoever else you throw in the category.

The Really Big Bunch could smash the Big Three in a heartbeat, if they wanted to.

Why haven’t they?

Because they have very active consumer sales that don’t affect IDEMIA and the like, and are terrified that any entry into biometric “surveillance” will adversely affect their lucrative consumer business. So they all concentrated on “don’t be evil.”

This is why Amazon withdrew Amazon Rekognition, Meta and others are cautious about adding facial recognition to consumer products, and Apple loudly proclaims its commitment to privacy.

But is this changing?

First, the mobile driver’s licenses

IDEMIA and Thales offer physical driver’s licenses, and moving into mobile driver’s licenses is a natural. I observed this during my time at IDEMIA, as (then) Gemalto pursued numerous mDL opportunities and IDEMIA responded in turn.

As part of my efforts to educate myself in the driver’s license market dominated by our new corporate overlords MorphoTrust, I attended an AAMVA regional conference several years ago. IDEMIA was obviously there, as was Gemalto. But also attending the conference was Apple. Why? I asked.

Apple wasn’t visible over the next few years as IDEMIA and Thales expanded their mobile driver’s license implementations. But all of a sudden, Apple was visible, as was Google, as was Samsung.

Why? Because these smartphone providers all had their own wallets, and they were adding mDLs to their offerings.

Which meant that someone who wanted a mobile driver’s license could use the convenient smartphone wallet they already had.

Were Apple and Google entering the surveillance state? Of course not, because Apple and Google were really nice people who were providing these wallets for our convenience and benefit. Never mind the facial recognition underpinning their use. There was nothing to worry about. Absolutely nothing.

Until they targeted the airports.

Second, TSA PreCheck

As a former IDEMIA employee, TSA PreCheck was near and dear to my heart. Well, until IDEMIA’s revenue tanked in 2020 when nobody flew or got driver’s licenses…and I lost my job.

But absent a worldwide pandemic, TSA PreCheck had been very very good to IDEMIA, since only IDEMIA offered it. Sure CLEAR had its program, but TSA PreCheck was much cheaper.

Until CLEAR also offered TSA PreCheck.

And Telos did also.

But who cares what these companies are doing? It’s not like a big company like Google is offering TSA PreCheck.

Fast forward to 2026.

“The Transportation Security Administration today announced a new partnership with Google Wallet, introducing a more seamless way for eligible travellers to opt in to TSA PreCheck® Touchless ID. Google Wallet is the first digital wallet to offer this innovative feature, making secure, efficient travel easier than ever.”

Yup, Google and the Department of Homeland Security are now best buddies. To some civil libertarians, this is evil indeed.

What’s next?

So how long until the really big bunch prime contracts for systems such as NGI and HART? They have a responsibility to their shareholders, after all.

The Big 3: Only the Names Change

In October 2023, on the occasion of the launch of the Prism Project, Bredemarket published a blog post entitled “The Big 3, or 4, or 5? Through the Years.”

Through many years.

The post discussed the evolution of the large Automated Fingerprint Identification System vendors, now large Automated Biometric System vendors that support face and other biometric modalities.

And the evolution will continue.

From 1986 to March 2009

Although I could have gone back to Autonetics in the 1960s, I didn’t. I started my version of the story in the 1980s, when the “big 3” were:

  • De La Rue Printrak.
  • Morpho Systems.
  • NEC.

The 2023 post detailed a number of changes over the next two decades, including the emergence of new companies, the results of a particular NIST test (FpVTE 2003) that put a temporary damper on my professional life, and some acquisitions.

A lot of acquisitions.

For our purposes I will fast forward to March 2009, when I argue there were a “Big 5”:

  • Cogent Systems.
  • L-1 Identity Solutions.
  • Motorola (my employer).
  • NEC.
  • Safran.

Sounds nice and neat, but I said to “hang on to your seats.”

From April 2009 to 2011

Because everything changed in the next two years. Here’s how I described it in the 2023 post:

From 2011 to 2023

So now there were just three again: 3M, NEC, and Safran. And that’s where we remain today, with some name changes: part of 3M was carved off to become part of Gemalto, part of Safran was carved off to become part of IDEMIA, and all of Gemalto was absorbed by Thales.

So by the time C. Maxine Most identified her “Big 3 ID,” they were:

  • IDEMIA.
  • NEC.
  • Thales.

Looking forward to 2027 or 2028

Why am I returning to my 2023 post? Because if all the required investment, regulatory, and government approvals move forward, and assuming no corporate changes that haven’t yet been announced, the 2027 or 2028 version of the “Big 3” will be:

  • Amadeus.
  • NEC.
  • Thales.

Today’s Acronyms Are NIST, FRIF, TE, E1N, and ROC

ROC (previously known as Rank One Computing) posted this about its latest resukts in the NIST Friction Ridge Image and Features Technology Evaluation Exemplar One-to-Many (FRIF TE E1N) evaluation.

“ROC’s performance in the NIST FRIF TE E1N evaluation, including #1 global ranking in Class B slap fingerprints, a critical capture format for high-scale civil and government identity programs, proves that American technology can now lead at the highest levels of global biometric performance….

“The NIST Friction Ridge Image and Features Technology Evaluation Exemplar One-to-Many evaluation, known as NIST FRIF TE E1N, evaluates one-to-many fingerprint identification at massive scale, testing how accurately algorithms can identify a subject from large enrollment repositories. Across the evaluation, ROC delivered top-tier performance in every category tested, including Class A, Class B, and Class C. “

As with every NIST biometric test, FRIF yields a massive amount of data. Just looking at the Class B slap data alone, here is what you can find, showing the top 7 entries out of 12 for the Class B Left Slap FNIR (another acronym: false negativce identification rate) at rank less than or equal to 10. Even this view excludes all other slap data and all other ranking data (1, 2, and 5).

(Data captured Friday, May 29, 2026 and may become outdated when new algorithms are tested.)

National Institute of Standards and Technology.

With this massive wealth of data, just about every vendor probably performed well in something, which is why ROC took the time to point out why Class B slap results are important.

“ROC’s most significant milestone came in Class B slap fingerprints. This performance is especially important for high-scale ABIS environments, including national ID programs, border management, civil enrollment, and high-stakes criminal justice workflows, where handling immense scale without sacrificing accuracy is mandatory.”

Although ROC may be the only entity trumpeting May results, other vendors have promotede earlier NIST FRIF TE E1N achievements, including IDEMIA, Identy.IO, Innovatrics, and Neurotechnology.

But they’re foreign. (As is Thales Group, for those keeping score.)

Is the Quantum Security Threat Solved Before It Arrives? Probably Not.

I’ll confess: there is a cybersecurity threat so…um…threatening that I didn’t even want to think about it.

You know the drill. The bad people use technology to come up with some security threat, and then the good people use technology to thwart it.

That’s what happens with antivirus. That’s what happens with deepfakes.

But I kept on hearing rumblings about a threat that would make all this obsolete.

The quantum threat and the possible 2029 “Q Day”

Today’s Q word is “quantum.”

But with great power comes great irresponsibility. Gartner said it:

“By 2029, ‘advances in quantum computing will make conventional asymmetric cryptography unsafe to use,’ Gartner said in a study.”

Frankly, this frightened me. Think of the possibilities that come from calculation superpowers. Brute force generation of passcodes, passwords, fingerprints, faces, ID cards, or whatever is necessary to hack into a security system. A billion different combinations? No problem.

So much for your unbreakable security system.

Thales implementation of NIST FIPS 204

Unless Thales has started to solve the problem. This is what Thales said:

“The good news is that technology companies, governments and standards agencies are well aware of the deadline. They are working on defensive strategies to meet the challenge — inventing cryptographic algorithms that run not just on quantum computers but on today’s conventional components.

“This technology has a name: post-quantum cryptography.

“There have already been notable breakthroughs. In the last few days, Thales launched a quantum-resistant smartcard: MultiApp 5.2 Premium PQC. It is the first smartcard to be certified by ANSSI, France’s national cybersecurity agency.

“The product uses new generation cryptographic signatures to protect electronic ID cards, health cards, driving licences and more from attacks by quantum computers.”

So what’s so special about the technology in the MultiApp 5.2 Premium PQC?

Thales used the NIST “FIPS 204 standard to define a digital signature algorithm for a new quantum-resistant smartcard: MultiApp 5.2 Premium PQC.”

Google Gemini.

The NIST FIPS 204 standard, “Module-Lattice-Based Digital Signature Standard,” can be found here. This is the abstract:

“Digital signatures are used to detect unauthorized modifications to data and to authenticate the identity of the signatory. In addition, the recipient of signed data can use a digital signature as evidence in demonstrating to a third party that the signature was, in fact, generated by the claimed signatory. This is known as non-repudiation since the signatory cannot easily repudiate the signature at a later time. This standard specifies ML-DSA, a set of algorithms that can be used to generate and verify digital signatures. ML-DSA is believed to be secure, even against adversaries in possession of a large-scale quantum computer.”

ML-DSA stands for “Module-Lattice-Based Digital Signature Algorithm.”

Google Gemini.

Now I’ll admit I don’t know a lattice from a vertical fence post, especially when it comes to quantum computing, so I’ll have to take NIST’s word for it that modules and lattice are super-good security.

Certification, schmertification

The Thales technology was then tested by researchers to determine its Evaluation Assurance Level (EAL). The result? “Thales’ product won EAL6+ certification (the highest is EAL7).” (TechTarget explains the 7 evaluation assurance levels here.)

France’s national cybersecurity agency (ANSSI) then certified it.

However…

…remember that certifications mean squat.

For all we know, the fraudsters have already broken the protections in the FIPS 204 standard.

Google Gemini.

And the merry-go-round between fraudsters and fraud fighters continues.

If you need help spreading the word about YOUR anti-fraud solution, quantum or otherwise, schedule a free meeting with Bredemarket.

Revisiting Amazon Rekognition, May 2025

(Part of the biometric product marketing expert series)

A recent story about Meta face licensing changes caused me to get reflective.

“This openness to facial recognition could signal a turning point that could affect the biometric industry. 

“The so-called “big” biometric players such as IDEMIA, NEC, and Thales are teeny tiny compared to companies like Meta, Alphabet, and Amazon. If the big tech players ever consented to enter the law enforcement and surveillance market in a big way, they could put IDEMIA, NEC, and Thales out of business. 

“However, wholesale entry into law enforcement/surveillance could damage their consumer business, so the big tech companies have intentionally refused to get involved – or if they have gotten involved, they have kept their involvement a deep dark secret.”

Then I thought about the “Really Big Bunch” product that offered the greatest threat to the “Big 3” (IDEMIA, NEC, and Thales)—Amazon Rekognition, which directly competed in Washington County, Oregon until Amazon imposed a one-year moratorium on police use of facial recognition in June 2020. The moratorium was subsequently extended until further notice.

I last looked at Rekognition in June 2024, when Amazon teamed up with HID Global and may have teamed up with the FBI.

So what’s going on now?

Hard to say. I have been unable to find any newly announced Amazon Rekognition law enforcement customers.

That doesn’t mean that nothing is happening. Perhaps the government buyers are keeping their mouths shut.

Plus, there is this page, “Use cases that involve public safety.”

Nothing controversial on the page itself:

  • “Have appropriately trained humans review all decisions to take action that might impact a person’s civil liberties or equivalent human rights.”
  • “Train personnel on responsible use of facial recognition systems.”
  • “Provide public disclosures of your use of facial recognition systems.”
  • “In all cases, facial comparison matches should be viewed in the context of other compelling evidence, and shouldn’t be used as the sole determinant for taking action.” (In other words, INVESTIGATIVE LEAD only.)

Nothing controversial at all, and I am…um…99% certain (geddit?) that IDEMIA, NEC, and Thales would endorse all these points.

But why does Amazon even need such a page, if Rekognition is only used to find missing children?

Maybe this is a pre-June 2020 page that Amazon forgot to take down.

Or maybe not.

Couple this with the news about Meta, and there’s the possibility that the Really Big Bunch may enter the markets currently dominated by the Big Three.

Imagine if the DHS HART system, delayed for years, were resurrected…with Alphabet or Amazon or Meta technology.

We are still in the time of uncertainty…and may never go back.

(Large and small wildebeests via Imagen 3)

Biometric Update: Thales wins $21m contract for Switzerland’s AFIS

Notable. I don’t know if IDEMIA provides the current Swiss AFIS (it used to), but Thales has locked this up for a long time.

Thales wins $21m contract for Switzerland’s AFIS
Biometric Update, https://www.biometricupdate.com/202503/thales-wins-21m-contract-for-switzerlands-afis

Oh, Florida (mobile driver’s licenses)

I should properly open this post by stating any necessary disclosures…but I don’t have any. I know NOTHING about the goings-on reported in this post other than what I read in the papers.

“I know NOTHING.” By CBS Television – eBayfrontback, Public Domain, https://commons.wikimedia.org/w/index.php?curid=73578107.

However, I do know the history of Thales and mobile driver’s licenses. Which makes the recent announcements from Florida and Thales even more surprising.

Gemalto’s pioneering mobile driver’s license pilots

Back when I worked for IDEMIA from 2017 to 2020, many states were performing some level of testing of mobile driver’s licenses. Rather than having to carry a physical driver’s license card, you would be able to carry a virtual one on your phone.

While Louisiana was the first state to release an operational mobile driver’s license (with Envoc’s “LA Wallet”), several states were working on pilot projects.

Some of these states were working with the company Gemalto to create pilots for mobile driver’s licenses. As early as 2016, Gemalto announced its participation in pilot mDL projects in Colorado, Idaho, Maryland, and Washington DC. As I recall, at the time Gemalto had more publicly-known pilots in process than any other vendor, and appeared to be leading the pack in the effort to transition driver’s licenses from the (physical) wallet to the smartphone.

Thales’ operational mobile driver’s license

By the time Gemalto was acquired by and absorbed into Thales, the company won the opportunity to provide an operational (as opposed to pilot) driver’s license. The Florida Smart ID app has been available to both iPhone and Android users since 2021.

From https://www.flhsmv.gov/floridasmartid/ as of July 12. No idea whether this image will still be there on July 15.

What just happened?

This morning I woke up to a slew of articles (such as the LinkedIn post from PEAK IDV’s Steve Craig, and the Biometric Update post from Chris Burt) that indicated the situation had changed.

One of the most important pieces of new information was a revised set of Frequently Asked Questions (or “Question,” or “Statement”) on the “Florida Smart ID” section of the Florida Highway Safety and Motor Vehicles website.

The Florida Smart ID applications will be updated and improved by a new vendor. At this time, the Florida Department of Highway Safety and Motor Vehicles is removing the current Florida Smart ID application from the app store. Please email FloridaSmartID@flhsmv.gov to receive notification of future availability.

Um…that was abrupt.

But a second piece of information, a Thales statement shared by PC Mag, explained the abruptness…in part.

In a statement provided to PCMag, a Thales spokesperson said the company’s contract with the FLHSMV expired on June 30, 2024.

“The project has now entered a new phase in which the FLHSMV requirements have evolved, necessitating a retender,” Thales says. “Thales chose not to compete in this tender. However, we are pleased to have been a part of this pioneering solution and wishes it continued success.”

Now normally when a government project transitions from one vendor to another, the old vendor continues to provide the service until the date that the new vendor’s system is operational. This is true even in contentious cases, such as the North Carolina physical driver’s license transition from IDEMIA to CBN Secure Technologies.

But in the Florida case:

  • Thales chose not to bid on the contract renewal.
  • The new vendor and/or the State of Florida chose not to begin providing services when the Thales contract expired on June 30.
  • Thales and/or the State of Florida chose not to temporarily renew the existing contract until the new vendor was providing services in 2025.

This third point is especially odd. I’ve known of situations where Company A lost a renewal bid to Company B, Company B was unable to deliver the new system on time, and Company A was all too happy to continue to provide service until Company B (or in some cases the government agency itself) got its act together.

Anyway, for whatever reason, those who had Florida mobile driver’s licenses have now lost them, and will presumably have to go through an entirely new process (with an as-yet unknown vendor) to get their mobile driver’s licenses again.

I’m not sure how much more we will learn publicly, and I don’t know how much is being whispered privately. Presumably the new vendor, whoever it is, has some insight, but they’re not talking.