Biometric Identifier: Data Point Intelligence Guide

Biometrics are the only identifier a person cannot change after it leaks. That single property should govern every decision you make about collecting, matching or storing them.

Understanding the Biometric Identifier as an intelligence artifact

A biometric identifier is a machine-processable representation of a physical or behavioural characteristic used to recognise a person: face, fingerprint, iris, palm vein, gait, keystroke dynamics or voice. Analysts rarely handle raw images. What actually moves through systems is a template, a vectorised feature extraction produced by a specific algorithm and stored in formats defined by standards such as ISO/IEC 19794 and its successor ISO/IEC 39794, or ANSI/NIST-ITL exchange packages. A template is not reversible to the original image in the naive sense, but it is still biometric personal data.

Templates are algorithm-bound. A face vector produced by one model will not match against another model's gallery, so cross-system comparison requires either a shared algorithm or re-extraction from source media. Matching returns a similarity score against a threshold, never a boolean. Modalities differ sharply in stability and error profile: iris and fingerprint are high-entropy and stable, gait and voice are behavioural, contextual and considerably noisier.

Why it matters

Biometrics resolve identity where documents fail. They link a person across aliases, forged papers and jurisdictions, which is why they carry weight in trafficking, missing persons and organised crime casework. A confirmed biometric hit converts a set of unconnected pseudonymous personas into one physical human being. That is also precisely why the collection and matching of biometrics is legally constrained in most democracies and why an unlawfully obtained hit is worse than no hit at all.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Match score relative to the operating threshold, with the false match rate that threshold implies at the gallery size actually used.
• Modality and algorithm version, which determine whether a score is comparable to any historical result in the case.
• Capture metadata: device, resolution, illumination and pose, all of which drive error rates far more than the subject does.
• Liveness and presentation attack detection outcome, distinguishing a live capture from a printed photo, mask, replay or synthetic sample.
• Sample quality scores such as NFIQ for fingerprints, which bound how much confidence any downstream match can carry.
• Demographic differential performance, since documented error-rate variation across groups changes how a borderline score should be read.
• Provenance and media integrity signals in the source file, including C2PA manifests, encoder artefacts and generative-model traces.
• Enrolment history: when and under which identity the template entered the gallery, which is often more probative than the match itself.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• NIST FRVT / FRTE / FATE — Independent benchmark results for face and other recognition algorithms, including demographic error-rate analysis
• ISO/IEC 39794 and 19794 — International standards defining biometric data interchange formats and template structures
• ANSI/NIST-ITL 1-2011 — Exchange standard used by law enforcement for fingerprint, face and other biometric transactions
• NIST NFIQ — Open fingerprint image quality metric that predicts downstream matching performance
• INTERPOL biometric systems — Face and fingerprint databases accessible strictly via National Central Bureau channels, not open query
• EDPB guidance and national DPA rulings — Binding interpretation on lawful basis, necessity and proportionality for biometric processing in Europe
• C2PA specification — Content provenance manifests that help establish whether source imagery has been edited or synthesised

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Confirm authority before touching the sample — Biometric processing without a documented lawful basis is unlawful in most jurisdictions regardless of how useful the result would be.
2. Assess the source media — Check resolution, compression, pose and provenance. Poor input produces confident-looking scores that mean nothing analytically.
3. Test for synthesis and presentation attack — Evaluate liveness, provenance manifests and generative artefacts before treating any sample as a genuine capture of a real person.
4. Extract and match within one algorithm — Run comparison inside a single algorithm and gallery, recording model version, threshold and gallery size alongside the score.
5. Interpret the score statistically — Convert the threshold into an expected false match rate at that gallery size and state the result as a probability, never as identity.
6. Corroborate independently — Treat a hit as a lead requiring non-biometric confirmation from documents, travel records, communications or human sources.
7. Minimise and expire — Delete raw media and templates once the authorised purpose is served, retaining only the decision record and its justification.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

• Human Intelligence — Information from People, Ethically Obtained
• Identity Intelligence — Resolving and Verifying Who Someone Is
• Social Media Intelligence — Intelligence from Social Platforms and Networks
• Government Intelligence — Government Structures, Policy, and Officials
• Legal Intelligence — Law, Litigation, and Regulatory Intelligence
• Disinformation Intelligence — Detecting and Analyzing Information Manipulation

Investigated in these domains

• Transnational Repression
• Border Security & Migration

Pivots to these data points

• Person / Name — A named individual — the subject of identity resolution and profiling.
• Email Address — Electronic mail address tied to an individual or organization.
• Username / Handle — Screen name or handle used across online platforms and services.
• Phone Number — Telephone number for voice, SMS, or messaging identification.
• Physical Address — A physical or mailing address tied to a person, company, or registered entity.
• Social Profile — A social media profile or online account page tied to a persona or identity.

Inside the platform: where Biometric Identifier lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• datapoint.php?dp=dp_biometric — Data point hub
• domain.php?d=repression — Transnational Repression dashboard
• domain.php?d=border — Border Security & Migration dashboard
• search.php — Advanced search, filter and pivot
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Enrichment Runner
• Enrichment → Local
• Correlate Infrastructure
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Confirm authority before touching the sample is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Test for synthesis and presentation attack turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Minimise and expire feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Biometric Identifier

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Defence biometrics sit inside mandated programmes: base access control, local national vetting, detainee enrolment, personnel recovery and identification of the deceased. The decision supported is access, adjudication or identity confirmation, not targeting, and using a biometric match as the sole basis for a kinetic decision is indefensible under both law of armed conflict proportionality and the error characteristics of the technology. Constraints are heavy: status of forces agreements, host-nation law, and the acute risk that an enrolment database of local staff becomes a persecution list if the mission ends or the site is overrun. Products feed a vetting adjudication or a J2 identity assessment, always with algorithm, threshold, gallery size and expected false match rate stated alongside the score.

🕵 National intelligence

National services use biometrics for identity resolution across aliases, forged travel documents and pseudonymous personas, feeding requirements-driven identity intelligence rather than bulk collection. The finished product is an assessment with a stated probability, not an assertion of identity. Handling is dominated by compartmentation: galleries acquired under one authority frequently cannot be searched on behalf of another, and cross-service sharing runs through specific legal gateways rather than analyst convenience. Classification usually derives from the collection method and the existence of the gallery, not from the template. Dissemination should carry the match score, the algorithm and version, the gallery size and the corroboration obtained, so a recipient can judge the claim rather than inherit it.

👮 Law enforcement

For law enforcement, biometrics are simultaneously an investigative lead generator and a forensic exhibit, and the two must not be confused. A face recognition search returns candidates for human review; it is not identification evidence and in a growing number of jurisdictions cannot be put before a court as such. Fingerprint and DNA comparison performed by an accredited examiner under a documented methodology is different and is admissible. Legal process requirements vary from a custody power for enrolment to a warrant for retrospective search of a database. Record the algorithm, version, threshold, gallery and examiner, preserve the probe image, and make sure the charging decision rests on corroborated evidence rather than on the candidate list.

🔍 Private investigation and corporate security

Private actors have the narrowest lane here. Corporate security may run biometric access control over employees with proper notice, consent where required and a documented retention schedule. It may not scrape faces from social media to build a gallery, may not run recognition against members of the public, and may not process biometric data of a subject without a lawful basis that survives an Article 9 or BIPA analysis. Illinois BIPA in particular carries a private right of action and has produced very large settlements against employers and vendors. Where identity verification is genuinely needed, use a regulated identity verification provider with a contractual processing basis rather than building a gallery in house.

📰 Journalism and OSINT media

Journalists should treat facial recognition output as an unpublishable lead. It can point you toward a hypothesis; it cannot verify one. Verification must come from named sources, documents, geolocation or the subject's own confirmation. Publishing an identification derived from an algorithm exposes you to a serious defamation risk because you cannot explain the false match rate at the gallery size involved, and it endangers innocent lookalikes. Never upload a source's or a victim's image to a commercial face search service, because that is disclosure to a third party with unknown retention. Where a story concerns biometric surveillance, document the system, the vendor and the legal basis rather than replicating the technique.

🌍 NGO, humanitarian and human rights

Humanitarian and human rights organisations use biometrics for beneficiary deduplication, family tracing and identification of the missing and the dead, and each of those uses carries real protection risk. A refugee biometric registry is an extraordinarily dangerous object if it is seized, shared with a host government or leaked, because it cannot be revoked the way a document can. Apply strict necessity, prefer non-biometric alternatives where they work, obtain genuinely informed consent in the subject's language including what happens if consent is refused, hold templates encrypted with keys outside the country of operation, and set destruction dates. Duty of care extends to staff who may be pressured to hand galleries over.

🎓 University and research

Biometric research requires ethics board approval, informed consent from data subjects and a data management plan that specifies storage, sharing and destruction. Use established public research corpora with documented consent provenance rather than scraped web images, which have produced retractions and dataset withdrawals across the field. Report algorithm, version, threshold, gallery composition and demographic breakdown of error rates, because aggregate accuracy figures conceal the differential performance that matters most. Preregister evaluation protocols where possible, publish code rather than only results, and treat any demonstration of re-identification or template inversion as a separate ethics application. Cite the NIST evaluation programmes as the comparison baseline rather than vendor-reported accuracy.

Playbook: working Biometric Identifier end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Necessity and lawful basis assessment

Establish before any sample is touched whether biometric processing is strictly necessary and what specific legal exemption permits it, because in most democracies the default is prohibition with narrow gateways. Document the necessity test, the alternatives considered and rejected, the proportionality argument and the residual risk. A good output is a completed DPIA with a named accountable owner, plus, where the residual risk is high, evidence of prior consultation with the supervisory authority. Stop entirely if the basis cannot be articulated, regardless of how valuable the match would be.

Phase 2 — Source media triage

Assess the probe material before extraction: resolution, compression history, pose angle, illumination, occlusion, and the provenance chain from capture to your hands. Poor input does not produce no answer, it produces a confident-looking score that means nothing, which is far more dangerous. Record an explicit quality judgement using a published metric where one exists, such as NFIQ for fingerprints. A good output is a written go or no-go decision on the probe with the reasoning. Stop if the media cannot support the modality's minimum quality requirement.

Phase 3 — Presentation attack and synthesis testing

Before treating a sample as a genuine capture of a real person, test for spoofing and generation. Check for liveness indicators where the capture pipeline supports them, examine provenance manifests under C2PA where present, and look for generative artefacts, resampling inconsistencies and metadata that contradicts the claimed capture. Synthetic faces are now good enough that visual inspection alone is inadequate. The output is a documented authenticity assessment. Where the sample fails, that failure is itself intelligence about the actor who supplied it.

Phase 4 — Algorithm and gallery selection

Choose the matcher and the gallery deliberately and record both, including version numbers. Templates are algorithm-bound: a vector produced by one model will not match another model's gallery, so cross-system comparison requires either a shared algorithm or re-extraction from source media. Gallery composition determines error behaviour, so record its size and, where known, its demographic distribution. A good output is a match configuration record that another analyst could reproduce exactly. Stop if you are asked to compare templates across incompatible systems.

Phase 5 — Threshold setting before search

Set the operating threshold before running the search and write down why, because choosing a threshold after seeing the candidate list is how confirmation bias enters biometric work. Derive the threshold from the algorithm's published operating characteristic and the consequence of a false match in this specific case: a watchlist alert and a criminal identification demand very different points on the curve. The output is a stated false match rate expectation at this threshold and this gallery size. Record it in the case file before the query runs.

Phase 6 — Search execution and score interpretation

Run the comparison inside a single algorithm and gallery and capture the full candidate list, not just the top hit. Convert the score into an expected false match rate at the gallery size involved, because a threshold safe at a thousand records generates routine false positives at ten million. Express the result as a probability with its assumptions, never as identity. A good output states the score, the threshold, the rank, the gallery size and the resulting confidence in one paragraph a non-specialist can read.

Phase 7 — Human adjudication

A candidate list is reviewed by a trained examiner, not accepted by an operator. For fingerprints this is a documented ACE-V comparison by an accredited practitioner. For face, it is trained morphological comparison with awareness of the well-documented error patterns in unfamiliar face matching, particularly across ethnic groups. Blind the reviewer to the algorithm's rank order where the process allows it. The output is a signed adjudication recording what features were compared, what agreed, what disagreed and the examiner's stated conclusion with its limits.

Phase 8 — Independent corroboration

Treat every biometric hit as a lead requiring non-biometric confirmation before it supports any consequential decision. Corroborate with documents, travel records, communications, financial activity, physical surveillance conducted under authority, or human sources. Where corroboration fails, the hit is discarded rather than downgraded and retained, because retained weak identifications resurface later stripped of their caveats. A good output is a corroboration table showing each independent line of evidence and its strength. Stop and reject the identification if no independent line exists.

Phase 9 — Demographic and error bias review

Check whether the match sits in a region of the algorithm's performance envelope with known elevated error, using the demographic differentials published by independent evaluation programmes rather than vendor marketing. Error rates for some algorithms vary by an order of magnitude across demographic groups, and a threshold calibrated on one population misbehaves badly on another. The output is an explicit note in the assessment stating whether known differential error applies to this comparison and how it was accounted for. This paragraph is what survives cross-examination.

Phase 10 — Minimisation, segregation and access control

Store templates separately from case narrative and from identity records, encrypted at rest, with per-query logging and named-role access. Never merge galleries across purposes or organisations without a specific legal gateway, because purpose creep is the failure mode regulators pursue hardest. Delete raw capture media once the template is extracted and the authorised purpose is served. A good output is an access log that maps every match query to an authorised case, plus a storage layout in which a compromise of the template store does not identify individuals.

Phase 11 — Retention, destruction and revocation planning

Biometrics cannot be reissued, so retention is the dominant long-term risk. Set destruction dates at enrolment, automate them, and produce verifiable destruction records. Plan in advance for what happens to a gallery when a programme ends, an office closes or a country becomes unsafe, including secure destruction under time pressure. Where templates are shared, contract for deletion by the recipient with an audit right. The output is a documented lifecycle in which no template exists without an owner, an expiry and a destruction method.

Phase 12 — Reporting with stated uncertainty

Write the finding as a probabilistic statement with its full configuration: modality, algorithm and version, threshold, gallery size, rank, expected false match rate, adjudication outcome and corroboration. Prohibit downstream re-identification of any pseudonymised template set and state the prohibition as a condition on recipients. A good product allows a reader to disagree with your conclusion using the information you gave them. Stop short of asserting identity in any product where the corroboration table is empty, no matter how high the score.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
NIST Face Recognition Technology Evaluation	Open	Independent ongoing benchmarking of face recognition algorithms including accuracy, speed and demographic differential error analysis.	The baseline for stating expected false match rates and demographic error behaviour instead of relying on vendor claims.
NIST fingerprint and latent evaluations	Open	Evaluation programmes covering fingerprint matching, latent print comparison and image quality metrics such as NFIQ.	Provides quality thresholds and expected performance for fingerprint probes before a comparison is attempted.
ISO/IEC 39794 biometric data interchange formats	Licensed	The current international standard family defining extensible interchange formats for face, finger, iris and other modalities.	Determines whether templates from two systems are structurally exchangeable before anyone attempts a cross-system search.
ISO/IEC 19794 legacy interchange formats	Licensed	The predecessor standard family still embedded in large numbers of deployed law enforcement and border systems.	Explains why older galleries cannot be read by newer tooling without conversion, and where conversion loses fidelity.
ANSI/NIST-ITL 1-2011 transaction standard	Open	The exchange standard used by law enforcement for fingerprint, palm, face, iris and forensic biometric transactions.	Defines the record structure for lawful inter-agency biometric exchange and what metadata must accompany a probe.
ISO/IEC 30107 presentation attack detection	Licensed	Standard framework and testing methodology for detecting spoofing attacks against biometric capture systems.	Underpins the liveness and spoof testing step and gives a vocabulary for describing capture assurance.
INTERPOL biometric systems	Licensed	International fingerprint and face databases accessible only through National Central Bureau channels under specific legal conditions.	The lawful route for cross-border biometric checks in serious crime, missing persons and disaster victim identification.
European Data Protection Board	Open	Guidelines on facial recognition, special category data, biometric processing by law enforcement and DPIA requirements.	Grounds the necessity and proportionality assessment that any European biometric programme must document.
UK Information Commissioner's Office	Open	Regulatory guidance and enforcement action on live facial recognition, workplace biometrics and biometric data retention.	Reference for the UK legal position, including enforcement precedent against biometric deployments in retail and employment.
Illinois General Assembly statutes	Open	The text of the Biometric Information Privacy Act, which imposes notice, consent, retention and destruction duties with a private right of action.	The controlling authority for US civil exposure whenever biometric data of Illinois residents is processed.
C2PA content credentials specification	Open	An open standard for cryptographically signed provenance manifests describing how a piece of media was created and edited.	Supports the authenticity step by carrying verifiable capture and edit history on probe images where present.
ICAO Doc 9303	Open	Travel document specification including the facial image standard and biometric data groups stored in the electronic chip.	Explains what biometric data an ePassport actually holds and how border systems compare it.
INTERPOL Disaster Victim Identification guidance	Open	International methodology for identifying the deceased using primary identifiers including fingerprints, dental and DNA evidence.	The reference framework for humanitarian identification of the dead and missing, where biometrics are legitimately central.
ICRC Missing Persons resources	Open	Humanitarian guidance on tracing, forensic identification and management of data about missing persons and their families.	Sets the victim-centred and do-no-harm framing for biometric use in humanitarian identification work.
European Union Agency for Fundamental Rights	Open	Analysis of fundamental rights implications of facial recognition and large-scale biometric databases in the EU.	Supports the proportionality argument and identifies the rights impacts a DPIA must address.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Biometric Identifier. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• NFIQ fingerprint quality tool — Open implementation scoring fingerprint image quality as a predictor of match performance. Limitation: predicts matcher behaviour statistically, not for a specific comparison.
• Accredited AFIS platform — Law enforcement fingerprint and palm matching with examiner workflow. Limitation: candidate lists require ACE-V adjudication and are not identifications on their own.
• Face template extraction SDK — Vendor library converting images to model-specific vectors. Limitation: templates are algorithm-bound and worthless against a gallery built with a different model.
• Presentation attack detection module — Detects printed, replayed or masked presentations at capture. Limitation: only protects live capture and does nothing for a supplied image file.
• Generative artefact and provenance checker — Examines images for synthesis indicators and reads C2PA manifests where present. Limitation: absence of a manifest proves nothing and detectors degrade as generators improve.
• Encrypted template store with query logging — Segregates templates from identity records with per-search audit. Limitation: purpose creep happens through legitimate access, which logging records but does not prevent.
• Case management with adjudication workflow — Forces examiner review, blinding and signed conclusions before a match leaves the unit. Limitation: only effective if operators cannot bypass it under time pressure.
• Demographic error rate reference tables — Published differential performance figures used to caveat a specific comparison. Limitation: published figures cover tested algorithms, not the deployed configuration you actually run.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• A biometric score is a statement about a gallery, not about a person. The same score that means near certainty against a thousand-record watchlist is routine noise against a fifty-million-record national database, and analysts who carry a threshold between systems generate false positives with confidence.
• Set the threshold before the search and write it in the case file. Choosing a threshold after seeing the candidate list is the most common and least visible way confirmation bias enters biometric casework, and it is invisible in the output unless the order of operations was recorded.
• Templates are algorithm-bound, so a request to compare against another agency's gallery is really a request to re-extract from source media. If the source media no longer exists, the honest answer is that the comparison cannot be made rather than that it was inconclusive.
• Unfamiliar face matching by untrained humans is unreliable in ways that are well documented and worse across ethnic groups. If your process replaces an algorithm's error with an operator's error and calls the result human review, you have added a signature, not a check.
• Absence of a match is weak evidence. Enrolment coverage, capture quality, ageing, injury and modality-specific failure to enrol all produce true non-matches for people who are in fact present, so a clean search should never be reported as exclusion without stating coverage.
• Behavioural modalities such as gait, voice and keystroke dynamics have error profiles an order of magnitude worse than iris or fingerprint and are heavily context-dependent. Treat them as clustering signals inside a case, not as identification evidence outside it.
• Plan the destruction of a gallery on the day you create it. Biometrics cannot be reissued after a breach, and the realistic threat to a humanitarian or expeditionary enrolment database is not a hacker but a change of political control over the site holding it.
• The strongest defensive habit is writing the corroboration table first. If the only evidence for an identification is the biometric system's own output, the correct product is a lead, and calling it anything else is the failure that ends up in a wrongful arrest inquiry.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Biometric Identifier is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of biometric searches with a threshold recorded before execution, audited from system logs rather than self-report. Anything below one hundred per cent indicates the bias control is not operating.
• Rate of biometric leads that survive independent corroboration, tracked over time. A falling rate signals threshold drift, gallery growth or degrading probe quality long before a wrongful identification occurs.
• Number of identifications later corrected or withdrawn, reported as a case-level outcome rather than a system accuracy figure. This is the only measure that reflects real-world harm.
• Percentage of match queries mapped to an authorised purpose in the audit log, with unexplained queries individually investigated. Purpose creep shows up here before it shows up in a regulator's findings.
• Template destruction completion against scheduled expiry, evidenced by destruction records. Surviving templates past expiry mean the retention control is documentary rather than technical.
• Probe rejection rate at the quality triage step. A very low rejection rate usually means quality triage is not being applied rather than that the material is good.
• Time from DPIA trigger event, such as a new gallery or a new purpose, to completed reassessment. Long gaps mean the deployed system no longer matches the assessed system.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• A similarity score is not an identification. Presenting a threshold hit as a positive identity is the single most common analytical failure in this class.
• Error rates that look acceptable in one-to-one verification become unusable in one-to-many search across a large gallery.
• Documented demographic performance differences mean the same threshold carries different real-world risk for different subject groups.
• Templates from different vendors or model versions are not interchangeable, and comparing across them silently produces meaningless results.
• Generative media can defeat naive face pipelines entirely, so an unverified image is not evidence that the subject was ever present.
• Behavioural modalities such as gait and voice degrade heavily with footwear, injury, illness, codec and channel conditions.

Legal and ethical considerations

Biometric data is the most restricted personal data class in modern privacy law. Under GDPR Article 9 it is special category data requiring an explicit legal exemption; comparable regimes include Illinois BIPA, which carries a private right of action, and dedicated law enforcement directives. Collection requires strict necessity and proportionality, usually a DPIA, and often prior consultation with a regulator. Retain templates only for the authorised purpose, segregate them from general case data, log every match query, and never share galleries across purposes or organisations without a specific legal gateway.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Biometric Identifier, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 6 intelligence disciplines, 2 mission domains, 6 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Is a face recognition hit evidence?

No. In mature practice it is a lead that generates a candidate list for trained human adjudication, and in several jurisdictions it is inadmissible as identification evidence outright. What can be evidence is a documented comparison by an accredited examiner using a stated methodology, or a fingerprint or DNA comparison under ACE-V or equivalent. Any product that presents a similarity score as identification is misrepresenting the technology. Report the score with its threshold, gallery size and expected false match rate, then report separately what independent corroboration exists. The corroboration is what supports a decision.

Can I run a face search against images scraped from social media?

Building or using a gallery from scraped images is unlawful in most European jurisdictions and has produced substantial enforcement action, and it creates serious civil exposure in US states with biometric statutes. Beyond legality, the provenance is unusable: you cannot state gallery composition, consent status or demographic distribution, so you cannot state an error rate. For lawful identity verification, use a regulated provider under a processing agreement. For investigative work, use galleries your organisation is legally authorised to hold, and record that authority in the case file before the first query.

Why does the same algorithm give different results in two deployments?

Because the score is only one of the variables. Gallery size changes the false match rate at any fixed threshold, capture pipeline and image quality change the template, model version changes the vector space entirely, and enrolment policy determines who is present to be found. Two deployments of the same vendor product with different galleries and thresholds are, analytically, two different systems. This is why every finding must carry algorithm, version, threshold, gallery size and probe quality. Without that configuration record, a score is an uninterpretable number.

How should templates be stored?

Encrypted at rest, segregated from identity records and case narrative, with per-query logging and access limited to named roles. The design goal is that compromise of the template store alone does not identify anyone, which means the mapping from template to person lives elsewhere under separate control. Raw capture media should be destroyed once the template is extracted and the authorised purpose is served. Every template carries an expiry set at enrolment, enforced by automation, with verifiable destruction records. Sharing outside the organisation requires a legal gateway and a contractual deletion obligation with an audit right.

What makes biometric data special category data?

Under GDPR Article 9, biometric data processed for the purpose of uniquely identifying a natural person is special category data, prohibited by default and permitted only under a specific exemption such as substantial public interest with a basis in law, or explicit consent where consent is genuinely free. Note the purpose test: a photograph becomes biometric data when processed through recognition. Comparable regimes elsewhere include Illinois BIPA, which adds notice, written release, published retention schedule and a private right of action. The practical effect is that necessity and proportionality must be documented before, not after, deployment.

How do I handle a request to share a gallery with a partner agency or host government?

Treat it as a legal question with a protection dimension, not an operational courtesy. Establish the specific legal gateway permitting transfer, the recipient's retention and onward disclosure rules, and what happens if the political situation changes. For humanitarian and human rights organisations the answer is frequently no, because a biometric registry of a vulnerable population is a targeting resource that cannot be revoked. Where sharing proceeds, transfer the minimum subset for a defined query rather than the gallery, contract for deletion, and record the decision and its reasoning at a level above the requesting analyst.

Can biometric templates be reversed back to an image?

Not naively, but the assumption that they cannot be inverted is outdated. Research has repeatedly demonstrated reconstruction of recognisable images from templates for several modalities, and even where reconstruction is imperfect the template remains a stable unique identifier that can be linked across databases. Regulators treat templates as biometric personal data regardless of reversibility. Design accordingly: encrypt, segregate, log, expire and destroy. Where a system offers renewable or cancellable biometric schemes that allow a template to be revoked and reissued, that property is worth real deployment effort, because ordinary biometrics cannot be reissued at all.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• GDPR Article 9 classifies biometric data processed for unique identification as special category data, prohibited unless a specific exemption applies, with Article 35 requiring a DPIA for high-risk processing.
• Illinois Biometric Information Privacy Act imposes notice, written release, a published retention schedule and destruction duties, and uniquely provides a private right of action driving US litigation risk.
• ISO/IEC 39794 defines the current extensible biometric data interchange formats, superseding ISO/IEC 19794 which remains embedded in deployed systems.
• ANSI/NIST-ITL 1-2011 governs law enforcement biometric transaction structure and the metadata that must accompany a probe in inter-agency exchange.
• ISO/IEC 30107 provides the framework and test methodology for presentation attack detection, giving a vocabulary for capture assurance claims.
• Law Enforcement Directive (EU) 2016/680 sets the distinct regime for biometric processing in criminal investigation, including necessity, logging and retention obligations.
• NIST evaluation programmes for face, fingerprint and other modalities provide the independent accuracy and demographic differential baseline that vendor claims must be tested against.
• ICAO Doc 9303 specifies the facial image and biometric data groups stored in electronic travel documents and how border systems perform the comparison.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. Biometrics evaluation programmes — National Institute of Standards and Technology. Independent accuracy and demographic differential benchmarking for face, fingerprint and other modalities.
2. Guidelines on facial recognition and biometric data — European Data Protection Board. Authoritative EU interpretation of necessity, proportionality and lawful basis for biometric processing.
3. Biometric Information Privacy Act — Illinois General Assembly. US state statute governing collection, retention and destruction of biometric identifiers with a private right of action.
4. Biometric data interchange standards — International Organization for Standardization. The ISO/IEC 39794 and 19794 families defining template and image interchange formats.
5. Fingerprints and other biometrics — INTERPOL. International biometric databases and the National Central Bureau channels through which they may lawfully be queried.
6. Facial recognition technology guidance and enforcement — UK Information Commissioner's Office. Regulatory position and casework on live facial recognition and workplace biometric deployments.
7. Content Credentials specification — Coalition for Content Provenance and Authenticity. Open standard for signed media provenance manifests used in probe authenticity assessment.
8. The Missing and their families — International Committee of the Red Cross. Humanitarian guidance on forensic identification and handling of data about missing persons.
9. Facial recognition technology and fundamental rights — EU Agency for Fundamental Rights. Rights-impact analysis used to structure proportionality assessments for biometric deployments.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: records biometric match decisions, thresholds and lawful basis as auditable case metadata rather than storing raw templates. Explore the platform, or browse the rest of the library by following any tag above.