TSA and Coast Guard Lock In Biometrics. Now Courts Want Your Methodology.

Two things happened in the biometric world recently that, on the surface, have nothing to do with each other. The TSA announced plans to modify its procurement for touchless identity verification units supporting the new Crewmember Access Point lanes at airports. The Coast Guard moved to award a sole-source contract for its Biometrics at Sea System — BASS 2.0 — which pulls fingerprints, iris scans, and facial images from maritime detainees to screen and deter unauthorized migration. And almost simultaneously, the FTC dropped an enforcement action against OkCupid for allegedly sharing user photo data with a third-party facial recognition firm in ways that directly contradicted its own privacy policy.

This is the split that matters. Not a percentage. Not a projected market size. The actual, operational tension between federal agencies cementing biometric systems without competitive oversight and a regulatory body now treating biometric data misrepresentation as an enforceable offense. If you work in investigations and you use photo-based identity tools, that tension is heading toward you faster than you probably think.

The Sole-Source Problem Nobody Wants to Talk About

Sole-source contracts mean one thing in practice: the government has decided there is exactly one vendor capable of doing this job, and it's going to pay that vendor without opening the work to competitive bids. Sometimes that's legitimate — continuity in a sensitive deployment, a proprietary system already embedded in operations, a timeline that doesn't allow for a full acquisition process. The Coast Guard's rationale for BASS 2.0 fits that pattern. You don't swap out the biometric infrastructure you're using to process maritime detainees mid-deployment. The operational risk is real.

But here's the thing about sole-source procurement that gets glossed over: it insulates the selected system from the kind of scrutiny that competition forces. When multiple vendors compete for a contract, they have to document their methodologies, prove accuracy rates, and explain their data handling — because the government evaluators are comparing them. Remove that competition and you remove that pressure. The system that wins a sole-source deal gets to operate with its methodologies largely unchallenged, at least from the procurement side. This article is part of a series — start with Deepfake Attacks Target Identity Verification Facial Compari.

That matters enormously right now, because the FTC just made it very clear that the other side of the biometric equation — data governance, disclosure, how you represent your data practices — is being watched closely. The OkCupid enforcement action wasn't about algorithmic accuracy. It was about whether the company told users the truth about where their data went. That's a different kind of accountability, and it's the kind that commercial operators, investigators, and anyone presenting biometric evidence in legal proceedings should be paying close attention to.

What the FTC Is Actually Saying

The FTC doesn't get enough credit for how direct it has been about biometric data. In its Commission Policy Statement on Biometric Information, the agency stated plainly that "biometric surveillance has grown more sophisticated and pervasive" and committed to pursuing "unfair or deceptive acts and practices related to biometric data collection and use." That's not regulatory throat-clearing. That's a signal about enforcement priorities.

"Biometric surveillance has grown more sophisticated and pervasive, and the Commission is committed to combatting unfair or deceptive acts and practices related to biometric data collection and use." — Federal Trade Commission, FTC Commission Policy Statement on Biometric Information

The OkCupid action is instructive. The allegation wasn't that the company's facial recognition results were wrong, or that the underlying technology was flawed. The problem was the gap between what the platform said it did with user photo data and what it actually did — specifically, that it handed images to a third-party facial recognition firm in a way that contradicted its own stated privacy practices. The deception was in the representation, not the algorithm.

Think about what that standard means when applied to investigative work. You're not just responsible for whether your facial comparison tool is accurate. You're now operating in an environment where courts — following regulatory cues — will start asking whether your process description matches your actual process. Every time you submit photo-based identification evidence, there's an implicit claim about how that evidence was gathered, processed, and protected. The FTC just established that misleading claims in that space have real consequences. Previously in this series: Radiologists Miss 59 Of Fake X Rays On First Look What That .

Why Investigators Are Sitting in the Middle of This

Federal agencies moving to standardized, federally-contracted biometric systems creates a reference point. Clients — especially corporate clients, legal teams, and anyone working adjacent to government investigations — will increasingly calibrate their expectations against what they know federal agencies use. That's just authority bias operating exactly as it always does. If the TSA trusts touchless identity verification for airport crewmember access, the implicit assumption is that this class of technology is reliable, vetted, and court-ready.

That assumption then gets applied to you. And this is where the gap opens up.

The Congressional Research Service's analysis of federal facial recognition use makes clear that admissibility and reliability standards for biometric evidence in legal proceedings are still developing — and developing fast. Investigators presenting facial comparison results will increasingly face questions about chain of custody, methodology documentation, and data handling that mirror exactly what the FTC is now pushing commercial platforms to answer. The regulatory scrutiny is moving in one direction, and it's moving toward requiring documented transparency at every step.

The FBI's FACE Services Unit — the federal standard for forensic facial comparison — operates under documented methodology requirements and chain-of-custody controls that are specifically designed to withstand legal challenge. That standard isn't going to stay in federal courtrooms. It's going to bleed out into civil litigation, insurance fraud investigations, HR disputes involving identity verification, and any other proceeding where facial comparison results are presented as evidence. The question isn't whether this happens. It's whether you're ready when it does. Up next: 58 Billion Synthetic Identity Fraud Deepfakes Industry Blind.

Tools like CaraComp's batch facial comparison and court-ready reporting exist precisely for this moment — not as a nice-to-have, but as the operational answer to a dual mandate that's now clearly forming: your clients want federal-grade accuracy, and courts will expect federal-grade documentation of how you got there.

The Accountability Gap Nobody Wants to Own

Here's the honest counterargument: federal agencies aren't subject to FTC enforcement authority the way commercial platforms are. Different constituencies, different legal frameworks. The TSA's biometric system and OkCupid's data practices exist in genuinely separate regulatory universes. The tension I'm describing isn't a direct collision — it's a convergence of separate pressures that happen to be moving investigators toward the same place at the same time.

But that counterargument misses the point. The question isn't whether the FTC can sanction the Coast Guard. It is whether the standards the FTC is articulating — about honesty in data practices, about matching your public claims to your actual workflows — will shape how judges, juries, and opposing counsel look at every kind of biometric evidence.

Federal sole-source contracts are locking in the tools. FTC enforcement is locking in the expectations. Investigators are standing exactly where those two forces meet. If you're still treating facial comparison as a black box you can simply drop into a report, you're already behind. The work now is to make your methodology as explicit, documented, and defensible as the systems your clients assume you're using — before a court forces you to do it on their timeline instead of yours.