Biometric Access Control: 250 Florida Agencies, One Vendor

Here's a number that should stop you mid-scroll: federal agencies can pull from more than 641 million driver's license photos sitting in state DMV databases, often without a warrant, according to research compiled by State of Surveillance. More than 27 states let the FBI search their driver's license photos directly. Sit with that for a second. You smiled for a camera at the DMV to get a license to drive a car. You did not sign up to be part of the country's biggest face database. And yet here you are.

Biometric access — meaning who can actually pull up, compare, or copy your fingerprint or face scan inside a government system — depends far less on the technology itself and far more on the contract that governs it, which is exactly what just played out in Florida's deal with a private contractor.

What biometric access really means when a state hands its data to a contractor

Most of us picture our driver's license photo like a filing cabinet folder: it sits there, quiet, until someone needs it. That's not how it works. Once your photo or fingerprint gets digitized, it lives inside a system with layers — software that decides who's allowed to touch it, rules about what "touching" even means (viewing? comparing? downloading?), and a running log of every single time someone does. That whole layered system is what people in the industry call a biometric back office, and Florida just handed the keys to a private company, according to Florida Politics.

Think about what that back office actually touches. It's not just DMV photos. Florida's system — called the Multi-Biometric Identification System, or MBIS — runs fingerprint intake at sheriff's offices, palm print collection, TSA-adjacent identity checks, and facial comparison for law enforcement, all funneling through the same contractor's infrastructure, according to technical details reported by Biometric Update. That's fingerprints, palm prints, latent prints (the smudgy partial ones lifted from a crime scene), and faces — all cross-referenced against each other. One contractor. One system. One set of rules governing biometric access control for the whole state.

Biometric access control isn't a lock, it's a permission chart

Here's where people get tripped up. We hear "access control" and picture a literal lock — like the biometric door locks some offices install where your fingerprint opens the door instead of a key card. That's a real thing, and it's a decent mental starting point for physical access generally. But a state-level biometric back office isn't one door. It's thousands of doors, each requiring a different level of clearance. A detective might get permission to run a face search against a suspect photo. A DMV clerk might only get permission to view — not compare — a license photo. A TSA officer accessing airport identity checks might get a totally different slice of the system. Software assigns each user a tier, and that tier decides exactly what they're allowed to do, according to Aware, a company that builds examiner tools for these systems. Without those tiers, you don't have security. You have chaos with a login screen.

---

Recognition systems, retention, and audit logs: the three things a biometric access control contract must nail

Let's break down the three moving parts that actually determine whether your data is handled well or handled recklessly. First: recognition — meaning the actual matching software that compares your fingerprint or face against others in the database, sometimes called a biometric reader or scanning module depending on the hardware involved. Second: retention — how long your biometric template (a mathematical map of your face or print, not the literal photo) sits in the system after it's collected. Third: audit logs — the running record of who looked at what, and when. Miss any one of these three, and the whole system becomes a black box.

Start with recognition systems. A modern setup like Florida's doesn't just do face matching — it does fingerprint, palm print, latent print, and facial comparison, each with image enhancement and filtering tools built in, according to Biometric Update. Here's the part that surprises people: a 95% match on a clean fingerprint means something completely different than a 95% match on a smudged partial lifted off a doorknob. Each type of biometric — fingerprint, face, palm — needs its own separate calibration and its own separate rules for what counts as a "match" worth acting on, because fingerprint biometrics and facial biometrics behave differently under bad lighting, smudging, or aging. Lump them together and you get false confidence dressed up as precision. This article is part of a series — start with Ai Deepfake Laws Lag As Cloned Voices Drain Family Cash Podc.

Now retention. This is the quiet one nobody thinks to ask about. When data moves to a cloud-based system — meaning it lives on a contractor's servers instead of a government building's basement — the question of how long they keep it, and who owns the deletion schedule, becomes a contract term instead of a law. A state can absolutely hand over the operational keys to its biometric back office. What it can't do is hand away the responsibility. That responsibility just gets written down — or, worse, left vague — inside the fine print of a vendor deal.

And then there's the audit log, which is honestly the piece that makes accountability possible and the one that gets talked about the least. Every time someone opens a record, the system is supposed to log who they are, when they logged in, and (ideally) why. That log is what turns "we have a system" into "we can prove what happened." Without it, if your face gets pulled up by the wrong person for the wrong reason, there's no way to catch it — and no way to prove it happened at all. This is the difference between biometric entry that's merely convenient and biometric security that actually holds up under scrutiny.

Florida has maintained one of the longest-running facial recognition programs in the country, with roughly 250 agencies granted access to the system.

— reporting synthesized from Florida Politics

Sit with that scale for a second. Two hundred fifty agencies isn't a rounding error — it's 250 separate doors into the same house, each staffed by different people, different training levels, different oversight, and different biometric access control settings baked into their login credentials. If the audit logging fails for even one of those doors, you don't have one small leak. You have a gap that could touch anyone whose biometric identity sits in that system — which, if you've ever gotten a Florida driver's license, might include you.

---

The old way vs. the new way of thinking about biometric access control

Old mental model	How biometric access actually works	Status
Your photo is "stored" in a database	Your photo lives inside a permission system with tiered biometric access control across hundreds of agencies	Active statewide, MBIS contract
Security means encryption	Security means encryption plus governance — who can decrypt it, and whether that action is logged	Contract-defined, 2024 terms
One agency, one purpose	Facial recognition and fingerprint matching shared across law enforcement, DMV, and federal partners under one contract	Shared across 250+ agencies
The state controls everything	A private contractor operates the recognition engine, retention rules, and audit trail day to day	Contractor-operated back office

Does facial recognition access get logged the same way as fingerprint access?

Not always, and that's the catch. Facial recognition searches, fingerprint comparisons, and palm print lookups can each run through different modules of the same back-office system, and each one can have its own logging standard. A well-built biometric system logs all three consistently. A poorly governed one might log fingerprint searches carefully (because that's the older, more legally scrutinized technology) while treating facial recognition as an afterthought — even though face searches are, in many ways, the more invasive of the two.

---

Why people think encryption alone protects their biometric access

Here's the misconception, and it's an honest one — most of us aren't wrong to think this way, we just haven't had reason to think past it. We hear "encrypted database" and assume that's the whole security story. Locked box, safe inside, done. It makes sense: that's how we think about our email password, our bank login, our house key.

But encryption only stops outsiders. It does nothing to stop someone who's already got a legitimate login. A contractor employee with proper credentials can open an encrypted record without setting off a single alarm — because they're not breaking in, they're walking through a door they were handed a key to. The real vulnerability in a large biometric system isn't usually some hacker cracking a code at 2am. It's the quieter question of who has standing permission to look, and whether looking gets written down anywhere. Encryption protects data in a vault. Governance decides who gets a key to the vault, and whether the vault keeps a guest log. Previously in this series: Roblox Age Verification Bypass A Fake Birthdate Still Works .

This is genuinely the piece that CaraComp spends the most time thinking about when it evaluates any facial recognition or biometric authentication system — not "is the math good," but "who's allowed to press the button, and can we prove it later." The comparison algorithm is almost never the weak point. The permission structure around access control usually is.

What everyday biometric authentication has in common with a state contract

You've actually already used a small, personal version of all this. Ever unlock your phone with your face, or use a fingerprint to approve a payment? That's biometric authentication — a security system that uses unique physical characteristics to confirm it's really you, no password required, sometimes paired with voice matching for an extra layer. Some workplaces now use biometric door locks or even full-building access control systems tied to fingerprint or face scans instead of key cards, sold as a passwordless, more unobtrusive way to manage building security and physical access more broadly. Companies market these as personalized security — and honestly, for a front door, that's a reasonable trade. Your phone's fingerprint template (the mathematical map, not an actual image of your print) usually never leaves the device. That's a closed loop with one user and one door, more like a biometric reader for personal use than a government-scale biometric access control deployment.

Now stretch that same idea across an entire state, 250 agencies, and millions of residents, and the stakes change completely. It's the difference between a house key and a master key to every building in a city. Both are, technically, "locks" — one just has consequences that ripple outward in ways a single front door never will.

Facial recognition solutions and the credentials problem nobody talks about

Vendors selling government facial recognition solutions often emphasize speed and accuracy — how fast the system can match a face, how many false positives it avoids. Those numbers matter. But they're only half the pitch. The other half, the part that rarely makes the sales deck, is: who gets credentials to use this thing, how are those credentials tied to individual users rather than shared department logins, and what happens on the back end every time someone hits "search." A fast, accurate matching engine sitting behind a sloppy credential system is still a sloppy access control system.

---

The real lesson behind Florida's biometric access control contract

Here's the analogy that finally made this click for me. Picture a postal sorting facility. You, the customer, only ever see the counter — the friendly worker who takes your envelope and hands you a receipt. But behind that counter is a massive back room where every piece of mail gets sorted, routed, scanned, and tracked. If that back room is run by a private contractor instead of the post office itself, someone still has to answer: how long do they keep a scan of your envelope? Who can pull up your mailing history? Is there a record every time someone does? The public only ever interacts with the counter. The real decisions — the ones that determine whether your mail (or your fingerprint, or your face) is handled with care — happen entirely out of view, governed by whatever the contract says about access control.

That's the exact shift happening in Florida. Residents see the counter: a DMV clerk taking their photo, a deputy scanning a print during booking. What they don't see is the back room where a contractor's software decides which of Florida's 250-plus agencies get to search that data, under what login credentials, logged in what way, retained for how long. The florida biometric contract isn't really a story about facial recognition technology getting better or worse. It's a story about who holds the pen on the access control rules — and whether "we have a system" is ever going to be a good enough answer again.

So here's the question worth sitting with the next time you're asked to look into a camera or press your thumb on a scanner: not "where does this go," but "who's allowed to open the door once it's in there — and is anyone writing down every time they do?" Florida just answered that question by handing the pen to a contractor. Whether the ink holds up is the part nobody outside a courtroom will ever get to check.

Biometric access: Frequently Asked Questions