Biometric Access: 250 Florida Agencies, One Contractor

Federal agencies can search more than six hundred forty million driver's license photos held by state motor vehicle departments — and in many cases, they don't need a warrant to do it. If you have a driver's license, your face is almost certainly in one of those piles. You never consented to that search. You'd never know it happened.

That last part is what I want to sit with today

That last part is what I want to sit with today. Not whether the photo gets taken — you already handed that over at the D.M.V. counter. The real question is what happens to it afterward. Who can pull it up, what they're allowed to do with it, and whether anybody can prove they did. In Florida, a single private contractor now runs the machinery behind all of that, for more than two hundred fifty agencies. And most of the protection you're counting on doesn't live in the software at all. So where does it actually live?

Every state biometric system has a back office. It's the engine room — the part nobody photographs for the press release. Picture the post office. You see a clerk at the counter. Behind that wall, there's a sorting floor where your mail gets routed, handled, and tracked by people you'll never meet. The counter is the enrollment center. The sorting floor is where governance actually happens.

In Florida, that back office runs the fingerprint scanners in sheriff's offices, the enrollment kiosks, the airport screening terminals. According to reporting from Florida Politics, one contractor operates it under a contract most residents have never read.

The first thing that engine does is decide who's

The first thing that engine does is decide who's allowed to ask questions. Biometric systems use something called authority tables. In plain English, that's a permission ladder. A detective might be cleared to run a face search. A clerk at the license office might only be allowed to verify a fingerprint against one record. Somebody wrote those rules down. And somebody can rewrite them.

For you, that means the question isn't "is my photo encrypted." It's "who's standing on which rung of that ladder today."

Second piece — the log. Every time someone touches biometric data, the system is supposed to stamp it. Who searched. What they searched. When. That stamp is the only thing standing between a legitimate investigation and someone looking up an ex-partner on a slow Tuesday. Now multiply it. Two hundred fifty agencies with access to Florida's system — that's hundreds of people, every day, and the log is the only witness.

Florida's system also searches across multiple

Florida's system also searches across multiple kinds of biometrics. Fingerprints, palm prints, faces, and the partial smudges left at crime scenes. Each one needs its own calibration. A ninety-five percent face match and a ninety-five percent match on a smeared partial print are not the same claim. Same number. Wildly different confidence.

And now for the part most people get backwards. We've all been trained to think encryption equals safety. That's not paranoia — it's what every company tells us when they announce a breach. Your data was encrypted. But encryption stops strangers. It does absolutely nothing to stop someone who's supposed to have the key. A person with legitimate access decrypts data invisibly, by design. That's what access means.

When these systems move to the cloud, the data leaves the government building and sits on contractor hardware. Retention schedules, deletion rules, breach notification timelines, who owns the audit logs — none of that is a technical setting. It's a paragraph in a contract.