Biometric Update https://www.biometricupdate.com Biometrics News, Companies and Explainers Tue, 06 Oct 2026 16:48:57 +0000 en-US hourly 1 66434804 IAD from Idemia PS blocks all biometric bypass attempts in BixeLab evaluation https://www.biometricupdate.com/202610/iad-from-idemia-ps-blocks-all-biometric-bypass-attempts-in-bixelab-evaluation https://www.biometricupdate.com/202610/iad-from-idemia-ps-blocks-all-biometric-bypass-attempts-in-bixelab-evaluation#respond Tue, 06 Oct 2026 14:30:44 +0000 https://www.biometricupdate.com/?p=358381 A global leader in biometrics has joined the ranks of technology providers confirmed compliant with the European standard for biometric injection attack detection (IAD) to defend against deepfakes, with Idemia Public Security passing an evaluation by BixeLab. Independent validation of vendor claims about IAD effectiveness is increasingly crucial in a market where biometric bypass checks are expected to rise at a CAGR of nearly 100 percent, according to the 2026 Injection Attack Detection Market Report and Buyer’s Guide from Biometric Update and Goode Intelligence. Idemia PS submitted version 3.38 of its WebCapture SDK to the Australia-based lab, where it went through 900 attempts and met the requirements of Level 2 (Substantial) protection. None of the attacks attempted during the assessment by BixeLab were successful, and Idemia’s software made only two classification errors among the 300 legitimate user transactions, for a false rejection rate (FRR) of 0.67 percent. The evaluation was carried out in alignment with CEN/TS 18099 on both Android and macOS devices, and used 10 different injection attack instrument species including deepfakes, face swaps, replay attacks, face morphs and avatar reenactments. “As deepfakes and injection attacks become more sophisticated and accessible, independent testing is increasingly important to ensure biometric systems can withstand real-world threats,” says Ted Dunstone, CEO of BixeLab, in the company announcement. “Testing against recognized standards such as CEN/TS 18099 provides organizations with objective evidence that these protections work in practice.” Idemia PS SVP and Global Head of Smart Biometrics Virginie Flam emphasizes the importance of delivering the simple experience for legitimate users that the assessment shows while keeping pace with evolving AI-powered fraud. The company has consistently placed among the leaders in face biometrics accuracy in independent assessments like NIST’s FRTE. There are still less than a dozen IAD providers in the world who have publicly announced independent assessments to the EU standard. The number is rising quickly, however, even ahead of the finalization of ISO/IEC 25456.]]> https://www.biometricupdate.com/202610/iad-from-idemia-ps-blocks-all-biometric-bypass-attempts-in-bixelab-evaluation/feed 0 358381 Pakistan’s Super App ambition faces gaps in digital foundations https://www.biometricupdate.com/202610/pakistans-super-app-ambition-faces-gaps-in-digital-foundations https://www.biometricupdate.com/202610/pakistans-super-app-ambition-faces-gaps-in-digital-foundations#respond Tue, 06 Oct 2026 14:07:37 +0000 https://www.biometricupdate.com/?p=358371 Pakistan is racing to design a unified “Super App” that promises citizens one gateway to government and private-sector services, but the latest signs indicate the underlying digital public infrastructure is struggling to keep pace. Pakistan’s Ministry of IT extended the deadline for proposals on the national Super App from March 31 to April 10 after limited initial interest, according to ProPakistani. The Super App sits within the Digital Economy Enhancement Project (DEEP), backed by the World Bank. Lawmakers have also pressed for secure national messaging platforms, with BEEP already in use and a broader Super App envisioned to integrate identity, communication and third-party services like ride‑hailing. At a recent meeting chaired by Senator Palwasha Mohammad Zai Khan, lawmakers stressed the need for sensitive government communication to be kept within national systems. The Ministry of IT told the committee that BEEP, a government communications app, is already being used in place of WhatsApp and Zoom, and that secure phones for senior officials have been approved. Senators raised concerns over project costs, citing figures of $74 million for BEEP and $20 million for the Super App, and directed the ministry and Pakistan Telecommunication Authority (PTA) to present detailed progress reports at the next meeting, according to Minute Mirror. Progress on the Digital Economy Enhancement Project (DEEP) remains slow. Only $8.36 million of its revised $69.16 million financing, around 12 percent, had been disbursed more than two years after the project became effective, according to Business Recorder’s account of a World Bank review. Just six entities were integrated with the National Data Exchange Layer against a target of 40. Approved in March 2024 and set to close in July 2028, the project is rated “Moderately Satisfactory” overall, but the World Bank highlighted gaps in implementation. Key aims include strengthening digital governance, building the Pakistan Business Portal, and expanding citizen services. Private-sector participation remains limited, with only one private-sector entity integrated with the National Data Exchange Layer. The Pakistan Business Portal has yet to process registrations or payments. While NADRA has issued 2.3 million digital IDs, transactions through the National Data Exchange Layer stood at 650,000 in August 2026, against a closing-period target of 13.333 million. Adoption gaps remain. Women account for only 9.2 percent of users of digitally enabled services, below the 30 percent target. The Enterprise Architecture Framework has been completed but still needs to be published with an adoption roadmap, while the Data Governance Policy and Interoperability Framework await formal adoption and operationalization. The review calls for a time-bound strategy to prioritize services and bring more agencies onto the platforms. The potential for a super app remains. Writing in Dawn, chairman of the Pakistan Fintech Network, Nadeem Hussain, argues that many foundational pieces of a digital ecosystem are already in place — with digital identity via NADRA and electronic payments through Raast, for example. “The additional benefit of a super app is that, given the depth of individual data available, a personal credit score can be built quite easily,” Hussain claims. “Based on the data available on WeChat, Chinese financial institutions can provide a credit limit of up to 200,000 yuan on the spot. Instant credit online or offline.” Hussain also cautions against concentrating sensitive data and services in a single platform, favoring an open public-private model. The Super App is planned to integrate with NADRA’s digital ID system for secure authentication and feature single sign‑on, personalized dashboards and a protected digital vault. Its microservices‑based architecture is intended to allow future expansion, third‑party integration and workflow automation. For now the Super App represents an ambitious digital front door, a tantalizing vision, but one that arguably risks opening out onto corridors where identity, exchange and governance remain under construction.]]> https://www.biometricupdate.com/202610/pakistans-super-app-ambition-faces-gaps-in-digital-foundations/feed 0 358371 Vietnam expands VNeID into securities sector https://www.biometricupdate.com/202610/vietnam-expands-vneid-into-securities-sector https://www.biometricupdate.com/202610/vietnam-expands-vneid-into-securities-sector#respond Tue, 06 Oct 2026 13:32:50 +0000 https://www.biometricupdate.com/?p=358361 VNeID is making opening a securities account in Vietnam that much simpler. Vietnamese citizens who hold level‑2 electronic identity accounts can now use verified information, which is stored in the national digital ID app, to complete account registration directly on their smartphones. With reduced paperwork and fewer repeated identity checks, securities firms report rapid uptake, according to Vietnam.vn. The report cites one securities firm as saying more than 70 percent of its new trading accounts are now opened via VNeID. Reported benefits include stronger protection against fraud, faster verification and greater convenience for customers. VNeID’s expansion follows Decree 320/2026/ND-CP, which came into effect on September 28. According to the report, many online accounts across banking, telecoms, e-commerce and healthcare must be linked to and authenticated through electronic identity accounts. The aim is to reduce fake accounts and improve trust in digital transactions. Vietnam is rapidly expanding VNeID. A sweeping draft Law on Electronic Identification and Authentication would expand digital identity beyond people and organizations to physical objects, intangible assets and data, events and transactions, and locations. The draft law would position identity as the trust layer for much of Vietnam’s digital economy. Vietnam is also moving to assign every land parcel a unique digital ID as it shifts from paper “red books” to data‑based management integrated with VNeID. The system has been piloted in Thanh Hoa Province as it standardizes and cleans parcel records, enabling electronic land‑use certificates and reducing paperwork. Vietnam’s government has ambitions for VNeID that would turn it into a national “super app.” The plans set out a roadmap that stretches from 2026 to 2045 and places the platform at the center of the country’s digital government ambitions. Linkages would also cross borders. Vietnam has formalized plans to connect its VNeID digital identity system with Singapore’s Singpass and Laos’ LAeID, starting with airport pilots before potentially expanding the model across ASEAN. The move gives firmer shape to Vietnam’s push for regional digital identity interoperability as ASEAN governments work toward deeper digital integration.]]> https://www.biometricupdate.com/202610/vietnam-expands-vneid-into-securities-sector/feed 0 358361 Libyan officials get EU-backed biometrics training to improve border management https://www.biometricupdate.com/202610/libyan-officials-get-eu-backed-biometrics-training-to-improve-border-management https://www.biometricupdate.com/202610/libyan-officials-get-eu-backed-biometrics-training-to-improve-border-management#respond Tue, 06 Oct 2026 13:17:53 +0000 https://www.biometricupdate.com/?p=358350 Officials from three Libyan government ministries and the country's Customs Authority have undergone specialist training on biometrics and document security at the Italian State Police Academy (CAPS) in Cesena as part of an EU-backed initiative aimed at strengthening the country's integrated border management. Through the initiative, the EU Border Assistance Mission in Libya (EUBAM Libya) is supporting Libyan authorities through technical advice, specialized training and the exchange of expertise on border management. EUBAM Libya is a civilian, non-executive EU mission. Participants from the Ministries of Interior, Defense and Foreign Affairs, together with those from the Customs Authority, received training on document production and security features, electronic documents, biometrics, and the detection of fraudulent and manipulated documents, according to EUBAM Libya. The training was followed by a visit to Ancona International Port, where participants observed Italian authorities conducting live document and identity checks, using interoperable databases, and carrying out currency checks and risk-based customs inspections, including scanner use. Libya is a major transit country for migrants from Africa seeking to reach Europe, including Italy, via the central Mediterranean. The training in Italy comes at a time when Tripoli is discussing the modernization of physical security and inspection infrastructure at its airports, seaports and land crossings. During a recent visit to the United States, Libya's Interior Minister, Maj. Gen. Imad Trabelsi, met with representatives of Rapiscan Systems and S2 Global to discuss border and entry-point security, Libya Herald reports. Those discussions covered non-intrusive screening technologies for vehicles, containers, cargo, luggage and individuals, as well as systems for detecting explosives, narcotics, radioactive materials and contraband. They also discussed X-ray image analysis and screening data management. The parties also discussed linking screening results with shipment information, operational data and security databases to provide a broader view of inspection operations, support risk assessment and identify cases requiring further scrutiny. The proposed approach could allow for comprehensive screening or multi-stage risk-based processes. Libya’s efforts reflect developments in a number of countries where governments are taking measures to build integrated border management systems, including through biometrics, partnerships and coordination. Salah Sakli, former central director of the Tunisian Border Guards, highlights the importance of coordination and cooperation across agencies and between countries in an opinion piece published by Africa Defense Forum. Sakli argues that stronger coordination is needed to tackle terrorism, trafficking, irregular migration and other transnational threats. He also emphasizes interoperability and information sharing, modern equipment, electronic surveillance, risk prevention, coordination with neighboring states, and the need to balance security with the legitimate movement of people and goods. These developments point to a broader shift in border management toward technology and data, with biometrics, document verification, interoperable databases, non-intrusive screening and risk assessment increasingly working together.]]> https://www.biometricupdate.com/202610/libyan-officials-get-eu-backed-biometrics-training-to-improve-border-management/feed 0 358350 Where commercial value can actually be created around the EUDI Wallet https://www.biometricupdate.com/202610/where-commercial-value-can-actually-be-created-around-the-eudi-wallet https://www.biometricupdate.com/202610/where-commercial-value-can-actually-be-created-around-the-eudi-wallet#respond Tue, 06 Oct 2026 12:33:32 +0000 https://www.biometricupdate.com/?p=358338 Much of the discussion around the European Digital Identity (EUDI) Wallet has focused on its stakeholders and their roles. Once the trust infrastructure is in place, the commercial questions go further: what value does each participant create, who benefits and how does the participant get paid? Dock Labs explored these questions in its webinar, Building a Business Model Around EUDI Credentials, featuring Richard Esplin and Agne Caunt. This analysis draws on that discussion to assess which models have the strongest commercial case. The examples below illustrate how those models work. The strongest near-term opportunities involve reducing existing verification costs, incorporating credentials into established services and supplying acceptance technology. New payment flows require additional evidence of demand.

The regulation settles three things before any business model does

Basic identity is free. The wallet arrives with state-backed identity data, and its issuance, use and revocation must be free for natural persons. Private issuers cannot build a business on selling core identity. Their opening is in attributes the state does not supply: qualifications, income, membership and professional authorization. Some acceptance is mandatory, on a separate timetable. Certain private relying parties must accept EUDI wallets, including covered services requiring strong user authentication and very large online platforms under specified conditions. The obligation is distinct from the end-of-2026 wallet availability deadline. Article 5f gives covered private relying parties a 36-month timetable from the relevant implementing acts, excludes micro and small enterprises from that provision, and requires acceptance upon the user’s voluntary request. Mandatory acceptance creates an implementation requirement; it does not guarantee usage or savings. Usage tracking is heavily constrained. Selective disclosure lets users prove an attribute, such as an age threshold, without sharing a full document. The regulation also limits how wallet providers can collect and combine usage data. Business models that depend on following identifiable holders across services or linking credential presentations over time therefore face significant constraints. These rules explain most of the assessments that follow. Models that need no new payment flow and no usage data are the easiest to build.

Verifiers: the strongest near-term case

Verifiers gain first because their return needs nobody else’s payment. Today a business may pay repeatedly for document checks, biometric comparison or database verification each time a new customer is onboarded. For example, a lender accepts an income credential in place of collecting and assessing supporting evidence. The return is indirect: lower verification costs, less manual work, faster onboarding, better completion rates and lower fraud exposure. The condition is that the credential replaces a process. A verifier that keeps every existing check and adds credential acceptance on top has added cost, with little saved. Direct revenue is less certain. Illustrative examples include a stadium charging a small fee for fast entry or a retailer charging monthly for express checkout, with a credential proving entitlement. In both cases the customer pays for the time saved, and the credential is only one way to deliver it. Referral models sit in between. A hotel could verify a guest’s loyalty credential and pass that guest to partner restaurants or spas for a fee. That works only if partners value the customers they receive.

Issuers: value where the cost fits an existing fee or budget

Issuers create value by turning information they have already established into evidence others can rely on. Whether they can charge for it depends on who benefits. The models most likely to work attach the credential to money that already moves: A university bundles a digital diploma into an existing administrative fee; an employer funds staff credentials out of lower administrative costs; a hotel group treats loyalty credentials as a customer acquisition cost; governments can fund credentials they are already responsible for issuing, such as digital driving licences. Charging the holder directly is plausible for narrow cases, such as a professional paying for a qualification credential that employers ask for. Verifier-pays-issuer faces a harder question: why would a verifier pay for a credential the holder already possesses and presents? A lender compensates an income-credential issuer each time an applicant presents its credential. It faces two open questions. The holder already has the credential, so the verifier needs a reason to pay for it. And billing per use has to be done without revealing which holder presented which credential. Credential type adds a cost decision. Electronic Attestations of Attributes (EAAs) cover information such as membership or qualifications. Qualified attestations (QEAAs) come from qualified trust service providers and carry specific legal effects. Qualification pays for itself only where a relying party needs that assurance, such as a regulated transaction. For a loyalty program, qualified issuance needs an additional justification. Issuers should confirm which credentials businesses will accept before investing in them. A credential nobody accepts has no commercial value.

Ecosystem providers: large value, but only after both sides join

Ecosystem providers establish shared credential formats, trusted issuers, participation rules and commercial terms. Their value lies in reducing separate negotiations and integrations between participants. Certification bodies, technology integrators and referral partners also contribute to these networks. The likely value is not the wallet itself, but reducing the cost of connecting issuers, verifiers and credential types. Revenue models include governance, certification, membership, revenue-sharing and marketplace fees. Their analogies are Visa and Mastercard scheme fees, card interchange, SWIFT’s KYC Registry and app stores. The card analogy shows both the prize and the obstacle. Card schemes earn fees because merchants and cardholders are both already present in large numbers. A new credential network cannot assume either side is already present: issuers need a reason to join, and verifiers need useful credentials. Sector networks with committed participants have the stronger early case. Open marketplaces face greater coordination and adoption costs.

Wallet providers: the most constrained role

Wallet providers have the least room to charge. Notified EUDI wallets must be free for natural persons to obtain, use and revoke, and providers are barred from observing transactions. Charging natural persons simply for obtaining, using or revoking the notified wallet is not available as a business model. Illustrative examples include a pathology laboratory wallet whose test-result credentials patients share with hospitals and healthcare providers, reducing repeated forms and transcription when receiving systems import the results, or a bank wallet combining customer credentials and payment cards. The value depends on acceptance and workflow integration. Neither example establishes demand for a separate consumer subscription. The speakers discuss user subscriptions, premium features, issuer fees, verifier fees and business-wallet functionality. Business offerings have the clearest case because organizations already pay for integration, management and support. The free-service requirement for natural persons does not apply in the same way, although relevant regulatory obligations remain. Wallet providers also have no automatic claim on revenue they enable. A stadium’s fast-lane fee belongs to the stadium unless an agreement shares it.

What models outside the EUDI framework show

U.S. mobile driver’s licences support a cautious commercial reading. California offers a free wallet and supports major phone wallets, while AAMVA provides free access to its issuer certificate list. These arrangements demonstrate value for verifiers and downstream services without establishing a payment to the issuer for every presentation. Issuance alone does not create utility: acceptance varies by wallet and service. EUDI’s acceptance obligations offer an advantage, but working integrations determine the benefit. Online credentials have a clear process to replace—document-and-selfie collection—while in-person savings depend on volume, staff effort and assurance needs. Free wallets and basic readers also raise the bar for paid offerings. The stronger opportunity is helping businesses use credentials through integration, management and specialized workflows, rather than charging consumers simply to hold them. Bank-led schemes. Nordic BankID systems have banks issue the identity and relying parties pay per transaction. They are the clearest proof that verifier-pays can work, and they worked only after issuers covered nearly the whole population. Australia’s ConnectID follows the same design.

What to watch as wallets launch

Three signals matter: verifiers retiring existing checks, businesses paying for acceptance infrastructure or valuable attributes, and sector networks securing fees that participants accept. Organizations must also choose between open and closed ecosystems. University qualifications accepted across industries gain wider reuse. Staff credentials restricted to an employer’s systems offer greater control and a clearer route to internal savings. Open networks expand reach but require broader interoperability and commercial coordination. The practical starting point is one existing customer journey: what information it needs, which issuers and credential types meet its requirements, and what work disappears when that evidence arrives through a wallet. That provides a firmer commercial foundation than introducing a fee simply because credentials can be exchanged.]]> https://www.biometricupdate.com/202610/where-commercial-value-can-actually-be-created-around-the-eudi-wallet/feed 0 358338 Sarawak links state digital ID with Malaysia’s MyDigital ID for cross-government service access https://www.biometricupdate.com/202610/sarawak-links-state-digital-id-with-malaysias-mydigital-id-for-cross-government-service-access https://www.biometricupdate.com/202610/sarawak-links-state-digital-id-with-malaysias-mydigital-id-for-cross-government-service-access#respond Tue, 06 Oct 2026 12:21:30 +0000 https://www.biometricupdate.com/?p=358328 SarawakPass, a state-level digital ID in Malaysia, has been integrated with the national MyDigital ID system, allowing users to access participating state and federal services through either credential by scanning a QR code. The integration was showcased at the International Digital Economy Conference Sarawak (IDECS) 2026 in Kuching on October 5, in the presence of Sarawak Premier Abang Johari Tun Openg, Dayak Daily reports. The move is another example of a subnational credential operating alongside a national identity layer. Tobago ID in Tobago offers a similar model for public-service access. According to a news release announcing the integration, SarawakPass users can now scan a MyDigital ID QR code to log into participating federal web services, while MyDigital ID users can do the reverse to access participating Sarawak services. Sarawak is a state located in East Malaysia on the island of Borneo. SarawakPass has also expanded beyond government services, with integrations including Sarawak Energy's SEB Cares, Sarawak Water and AirBorneo. The state government plans to develop SarawakPass further as a shared digital layer for consent-based data exchange and personalized services. The integration follows a memorandum of understanding signed last year between the Sarawak government and Malaysia’s National Cyber Security Agency. At the time, authorities said the integration of the subnational and national digital IDs would make authentication across state and federal platforms seamless. SarawakPass was launched last year as an evolution of the existing Sarawak ID. MyDigital ID CEO Nik Hisham Nik Ibrahim said the integration is a major step forward in building a national digital identity ecosystem that will facilitate access to a wide range of public services. He said the digital ID scheme has continued to expand, with about 14.1 million users now across 203 integrations and 82 million logins recorded since August last year. Nik Hisham added that the integration brings the trust of the national identity foundation closer to residents of Sarawak. Malaysia is also advancing a federal push to build a stronger digital ecosystem. In a written parliamentary reply in July, Deputy Prime Minister Ahmad Zahid Hamidi said 19 state-level online applications had been integrated with MyDigital ID, with 28 more in development. Hamidi put the number of integrated online government services at 114 as of June, noting that a January 2025 directive from the chief secretary to the government requires ministries, statutory bodies, state secretaries and local authorities to adopt MyDigital ID single sign-on, which he said would help its use, as reported by New Straits Times. Authorities have said MyDigital ID is voluntary, but its expanding integration into government and other services has raised questions about how voluntary it remains in practice. A recent analysis noted that while the credential remains formally optional, its growing use as an authentication layer for services means citizens could increasingly encounter situations where having a MyDigital ID becomes the practical route to accessing particular platforms. MyDigital ID is increasingly being required for some services, including MyJPJ (road transport) and prepaid SIM card registration, while it has also been promoted as an age-verification option for social media users. MyDigital ID is targeting 17 million registered accounts by the end of 2026. The SarawakPass integration therefore fits into a broader Malaysian push to make MyDigital ID interoperable across state, federal and eventually cross-border services.]]> https://www.biometricupdate.com/202610/sarawak-links-state-digital-id-with-malaysias-mydigital-id-for-cross-government-service-access/feed 0 358328 Japan sets October launch for My Number Card on Android https://www.biometricupdate.com/202610/japan-sets-october-launch-for-my-number-card-on-android https://www.biometricupdate.com/202610/japan-sets-october-launch-for-my-number-card-on-android#respond Tue, 06 Oct 2026 12:20:52 +0000 https://www.biometricupdate.com/?p=358393 Japan will launch My Number Card on Android on October 20, adding government-verified identity attributes to Google Wallet for in-person identity, age and residency checks. The Digital Agency has scheduled the service for October 20. It will initially support identity, age, and residency checks during face-to-face government and commercial services. Android phones have supported My Number electronic certificates since 2023. The certificates allow users to authenticate to My Number Portal, submit tax returns and moving applications, review medical expenses and pension information, and obtain government certificates at convenience stores. The new attribute function provides a different capability. It stores government-verified identity information on the phone and allows the user to present selected information to a public agency or business. The smartphone credential can contain My Number Card attributes including the holder’s name, address, date of birth, sex and facial photograph. Businesses and public agencies must add compatible reading software before they can accept the Android credential The Digital Agency says organizations can use its free My Number Card Face-to-Face Verification App. They may also obtain software from an approved vendor. Custom implementations can require an application to the Digital Agency, testing in its verification environment, and, depending on the software, government certification. My Number on smartphones can use the device’s biometric authentication, such as face or fingerprint recognition, instead of requiring a PIN for some functions. My Number Card for Android will require a phone containing a security chip that meets government specifications. The Digital Agency has not published the criteria or a list of supported devices. It says further compatibility information will be available by October 20. The Oct. 20 launch brings Android closer to feature parity with the iPhone version of My Number Card and extends Japan’s mobile identity system from online authentication into face-to-face credential presentation.]]> https://www.biometricupdate.com/202610/japan-sets-october-launch-for-my-number-card-on-android/feed 0 358393 DHS puts numbers behind RIVR-2, details new deepfake testing https://www.biometricupdate.com/202610/dhs-puts-numbers-behind-rivr-2-details-new-deepfake-testing https://www.biometricupdate.com/202610/dhs-puts-numbers-behind-rivr-2-details-new-deepfake-testing#respond Mon, 05 Oct 2026 22:01:03 +0000 https://www.biometricupdate.com/?p=358317 DHS Science and Technology Directorate announced RIVR-2 on September 21, emphasizing industry collaboration and the need for defenses to evolve faster than AI-generated documents and real-time impersonation attacks. A September 30 technical webinar provided the next layer: quantifying gaps from RIVR-1, detailing how the next four tracks will be evaluated, and outlining a faster, recurring testing model.

RIVR-1 shows different convenience and security bottlenecks

DHS used the webinar to present RIVR-1 results through the separate lenses of convenience for legitimate users and security against fraud. On convenience, DHS reported that about one in four legitimate users failed to complete the full remote identity workflow. The component results show differences across the three technologies: median success was 99 percent for selfie-to-document matching (SMTD) and 96 percent for presentation attack detection (PAD), compared with 79 percent for identity document validation (IDV). Security produced a different set of results. Selfie matching detected 99.99 percent of impostors across more than 7.8 million attempts, while the median IDV system detected 87 percent of fraudulent IDs across more than 1,900 IDs representing all 50 states. The median PAD system detected 53 percent of presentations using the attack instrument that was most successful against the tested systems. The results put the RIVR-2 tracks in context: document validation recorded the lowest legitimate-user success rate, while PAD recorded the lowest detection rate against the attack highlighted by DHS.

RIVR-X creates a track for emerging technologies

IDV, SMTD and PAD remain the main RIVR tracks, while biometric deepfake detection (BDD) becomes the first evaluation under RIVR-X, an experimental series for emerging technologies. DHS also outlined plans to move toward approximately twice-yearly evaluations, creating opportunities to identify areas for improvement and test updated technologies in subsequent rounds.

IDV expands the evidence and sets benchmarks

RIVR-2-IDV is open to commercial technologies currently in deployment, rather than systems still in pilot. Maryland Test Facility (MdTF) technical requirements specify a sequestered dataset, with no sample images provided, containing genuine and fraudulent U.S. driver’s licenses and state IDs from multiple issuing authorities, along with international passport face pages. Images include rotation, optical blur, perspective distortion and captures from different smartphone makes and models. Evidence validation examines document format and completeness, expected security features, and signs of tampering or counterfeiting, including deepfakes. The technical requirements set a 10-second processing threshold and five-second goal. System error, document false reject and document false accept rates each have a 10 percent threshold for high performance and a 1 percent goal for excellent performance. Results can be disaggregated by factors including issuing authority and imaging smartphone. RIVR-2-IDV also uses what DHS calls a “failure is suspicious” policy. A system error on a genuine document counts as a false rejection, while an error on a fraudulent document is treated as a fraudulent-document detection. A system therefore does not have to successfully process and explicitly classify a fraudulent document for that transaction to count as detected under the methodology. Deepfake testing also intersects with IDV. Providers can opt into RIVR-X testing against digitally generated or manipulated document images, extending the evaluation to how IDV technologies respond to this type of document evidence.

Selfie matching gets tougher images

SMTD recorded the highest legitimate-user success and impostor-detection rates among the RIVR-1 results DHS presented. RIVR-2 adds image conditions intended to examine performance with more challenging inputs. MdTF says the sequestered dataset includes selfies varying in pose, expression and illumination, along with rotation, optical blur, perspective distortion and images from different smartphone makes and models. New for RIVR-2 are common selfie-quality degradations, including photos taken in low light. The addition allows matching performance to be measured when selfie illumination is less favorable than under well-lit conditions. SMTD is measured through failure-to-extract, false non-match and false match rates, with biometric comparison evaluated at a system-provided operating threshold corresponding to a false match rate of one in 10,000.

PAD gets regularly updated attack instruments

RIVR-1 results presented by DHS showed the median PAD system detecting 53 percent of the most successful presentation attack. RIVR-2 will evaluate active and passive PAD using multiple presentation attack instruments that DHS says will be updated regularly, with performance measured using BPCER and APCER.

RIVR-X combines deepfake detectors, datasets and generation methods

For biometric deepfake detection, DHS described an evaluation involving detectors, deepfake datasets and generation methods. The evaluation is intended to examine which generation methods are difficult to detect and whether detector performance generalizes across different methods. Participating detector providers will be asked to contribute 1,000 deepfake images representing attacks their own technology detects successfully but that may be difficult for other detectors. DHS is also seeking contributions of deepfake attack data from other organizations. The approach means participants can contribute both detection technologies and attack data to the evaluation. DHS said the contributed datasets will support comparisons involving different deepfake-generation methods. DHS is also planning a Biometric and Identity Deepfake Detection Technical Exchange involving government and industry experts. The exchange will address development of an ongoing evaluation framework, including how sources of genuine and deepfake media can change over time while protecting commercial intellectual property.

Testing runs into 2027

Applications for IDV and SMTD are due October 16, with acceptance notifications scheduled for October 30 and systems due for testing by November 20. PAD and BDD applications are expected to open in December, with testing extending into 2027.

From aliased results to a different buyer-vendor conversation

RIVR results can change the traditional vendor conversation. Instead of starting with claims such as “we have the industry’s best document validation,” “our face matching is highly accurate,” or “our technology stops sophisticated attacks,” buyers can start with independent test results. There is an important limitation in RIVR-2: results will be aliased by default, although participating companies can choose to identify themselves. Buyers will not automatically be able to associate every published result with a vendor. Buyers can still ask whether a vendor participated and, if so, whether it will disclose its alias and results. Where vendors identify themselves, the conversation can move to measured performance: Where did the technology trail stronger-performing systems? Why? What is the roadmap for addressing those gaps, and when will improvements be delivered? DHS expects this model to change with RIVR-3 and subsequent evaluations, when company names will be associated with results by default. If implemented as described, buyers would no longer depend on voluntary disclosure to connect performance with a provider, and participation in independent testing could become a qualification criterion for some procurements. For vendors, recurring evaluations provide measured results that can identify areas for further development and opportunities to demonstrate improvement in subsequent rounds. For researchers and standards organizations, the evaluations provide data on unresolved gaps across document validation, presentation attacks, degraded biometric imagery and deepfake detection. RIVR-2 expands the scope and frequency of that testing, while DHS’s planned move to named results in RIVR-3 would make vendor performance directly attributable by default.]]> https://www.biometricupdate.com/202610/dhs-puts-numbers-behind-rivr-2-details-new-deepfake-testing/feed 0 358317 Apple, Google lobby lawmakers to remove liability from draft online safety bills https://www.biometricupdate.com/202610/apple-google-lobby-lawmakers-to-remove-liability-from-draft-online-safety-bills https://www.biometricupdate.com/202610/apple-google-lobby-lawmakers-to-remove-liability-from-draft-online-safety-bills#respond Mon, 05 Oct 2026 21:44:02 +0000 https://www.biometricupdate.com/?p=358292 A new expose shows Apple and Google engaged in “a massive effort to press state lawmakers to adopt kids’ online safety laws that would shield the tech giants from some lawsuits tied to age-verification requirements.” The report from Politico offers more proof of what regulators and age assurance advocates have known for some time: when it comes to age assurance regulations, Silicon Valley's main goal is avoiding liability.  Here, draft legislation, internal emails and “interviews with seven people with knowledge of the effort” all show Apple and Google – which together control the bulk of the device and OS market – urging lawmakers to redraft versions of the App Store Accountability Act with alternative text that would remove the possibility of private lawsuits and assign enforcement entirely to state attorneys general.  The so-called Mobile Ecosystem Responsibility Act (MERA) dictates that “the Attorney General shall have exclusive authority to enforce,” and specifies that nothing in the bill “shall be interpreted to serve as the basis for a private right of action.”  This suggested law, and the lobbyists pitching it, followed versions of the App Store Accountability Act across Georgia, Arizona and Kansas, as Apple and Google aimed to limit accountability measures in the existing draft law. 

Meta, Apple eye each other across the age assurance divide

Long rumbling through industry conversations on age assurance, the faults separating two sides of the Silicon Valley power structure are increasingly exposed. The world is trying to make the internet and its flagship spaces less risky, and no company wants to get caught in the regulatory web; the result is a standoff between social media giants on one side, and device titans on the other.  Meta and other social media companies have spent significant time and money arguing against age checks at the platform level, and in favor of the ASAA. So says Politico: “social media companies, like Meta, have been supportive of the legislation, advocates say, partly because it shifts liability around age verification to app stores rather than the platforms themselves.” Meta, beset by lawsuits and bad press, will do what it can to make age assurance someone else’s problem.  Apple and Google, meanwhile, roll out declared age range models and hold them up as evidence of their commitment to compliance. At the same time, they pester lawmakers to alter draft legislation to protect them from legal consequences. 

Age assurance models at both levels face perpetual litigation machine

Whether intentional or not, the overall result is a legislative landscape in which complexity begins to look like a major obstacle to practical implementation, as states pass regulations and Big Tech meets them from both sides with lawsuits, lobbyists and lies.  Four states have enacted App Store Accountability Acts, while California has adopted a related but distinct operating-system age-assurance framework. So far, five states have enacted versions of the App Store Accountability Act or similar legislation. Utah and Louisiana have both enacted their own spins on the law. Texas passed SB 2420, but it’s currently enforceable following a Fifth Circuit Court decision – one in a growing list of rulings that have seen the law knocked about the U.S. courts willy-nilly. Alabama’s version of the ASAA is set to take effect January 1, 2027, as is California’s AB 1043, or Digital Age Assurance Act, an app store age-adaptation framework closely related to the ASAA.  Three more states – Arizona, Georgia and Kansas – have introduced versions of the law.  The legislative architecture of the U.S. means that these states all battle for themselves in the courtroom, even when a legal framework is shared. (On a federal level, the Kids Online Safety Act, or KOSA, stalled in the Senate last week.)  And they now face the competing interests of the world’s most powerful tech companies. In this context, the path to a consistent, clear age assurance regime in the states looks long, rocky and at constant risk of ambush by a team of relentless tech lawyers. ]]> https://www.biometricupdate.com/202610/apple-google-lobby-lawmakers-to-remove-liability-from-draft-online-safety-bills/feed 0 358292 Input wanted on draft standard update for operational biometric systems testing https://www.biometricupdate.com/202610/input-wanted-on-draft-standard-update-for-operational-biometric-systems-testing https://www.biometricupdate.com/202610/input-wanted-on-draft-standard-update-for-operational-biometric-systems-testing#respond Mon, 05 Oct 2026 21:06:16 +0000 https://www.biometricupdate.com/?p=358294 The functional requirements of operational biometric systems are evolving fast, but the standard that tests of those systems are based on dates from the era when convolutional neural networks were reframing what it was possible for those systems to do. An update of the ISO/IEC 19795-6 standard is not just in order, but on the way. A new working draft of the standard for “Information technology – Biometric performance testing and reporting” has been released by JTC 1/SC 37. SAIC Scientist Director and MdTF Researcher Yevgeniy Sirotin, who is also vice chair of the AI Subcommittee at the Intelligence and National Security Alliance, invited contributions from professionals who have experience with operational biometric systems in a LinkedIn post. The standard provides guidance on operational testing for biometrics, including performance metrics, the data that can be retained for performance monitoring and requirements for test methodology, data recording and results reporting. The current version was published in 2012 and last confirmed in 2024.

A shared language for operational biometric systems testing

The new version expands the standard’s scope to include vulnerability testing, and reframes the subject as “testing of operational systems” instead of “operational testing.” Vulnerabilities addressed include biometric presentation attack detection (PAD), morph attack detection (MAD) and deepfake attack detection. Working draft 3, seen by Biometric Update, shows work progressing on clarifying the terminology around testing. The editor has replaced “System identification rate” with “system acceptance rate” and “system rejection rate,” and added new terms “biometric attack sample” and “biometric bona-fide sample.” The WG seeks expert community feedback on whether false acceptance rate (FAR) and false reject rate (FRR) are the best performance metrics to use, and sets requirements for the metrics to use whether ground truth can be established or not, and what should go into those metrics. The editor would like the expert community to help clarify what constitutes “business rules,” which could end up being replaced by a term like “system policy.” The latest draft also adds guidance on data protection requirements for operational evaluations, appropriate treatment of test size and repeated transactions and introduces the term “tester biometric review,” but still needs guidance on how to perform such a review. “We need clear language regarding how to test operational biometric systems when perfect ground truth is not known,” says Sirotin on LinkedIn. BixeLab published a white paper earlier this year that discusses ISO/IEC 19795-6 in the context of how to understand the relation between testing and real-world results.]]> https://www.biometricupdate.com/202610/input-wanted-on-draft-standard-update-for-operational-biometric-systems-testing/feed 0 358294