We’re Tracking the Future of Security

Category: Access Control & Identity

Credentialing, biometrics, smart locks and identity verification technologies that control who can enter a facility.

  • Ofcom Investigates Pornhub Device-Level Age Checks Under UK Online Safety Rules

    Ofcom Investigates Pornhub Device-Level Age Checks Under UK Online Safety Rules

    UK communications regulator Ofcom has opened a formal investigation into whether the age-assurance process used by Pornhub operator Aylo satisfies duties under the Online Safety Act. The inquiry focuses on a device-level approach that uses operating-system age signals rather than requiring a fresh identity or age check inside the service.

    Investigation focuses on effectiveness and due diligence

    Ofcom said it will examine whether the service uses highly effective age assurance and whether Aylo completed an adequate children’s access assessment. The regulator also raised the question of whether sufficient due diligence and testing took place before the process was introduced. Opening an investigation is not a finding of non-compliance, and Ofcom said it is not making a determination about Apple’s age-verification system itself.

    The technical distinction matters because a device-level signal may describe an account holder without proving who is using the device at a particular moment. Shared devices, known passcodes and household account practices can therefore affect the assurance provided by the overall workflow.

    Age assurance is a system-level control

    Organizations assessing age controls should document the signal source, binding between the signal and the current user, fallback methods, privacy boundaries and testing evidence. They should also record how exceptions and account recovery are handled, because those paths can weaken an otherwise strong primary check.

    The case is relevant to broader Access Control & Identity design: assurance depends on the full chain between enrollment, device, account and transaction. A vendor feature alone does not establish that the deployed service meets a regulatory or operational threshold.

    Sources

  • UK Home Office Awards Ingenium Two-Year Biometric Testing and Assurance Contract

    UK Home Office Awards Ingenium Two-Year Biometric Testing and Assurance Contract

    Ingenium Biometric Laboratories has begun work under a two-year UK government contract to provide independent biometric testing and assurance for Home Office programs. The work covers quality assurance, performance evaluation and security testing for technologies used in identity assurance, age assessment and related services.

    Testing across defined use cases

    The published service description includes biometric algorithm assessment, adversarial detection assessment and specialist assurance activities. Testing is expected to evaluate performance for an agreed use case rather than produce a single universal score. Relevant measures may include matching performance, sample quality, age-assessment outputs and other algorithm results specified by the program.

    The contract also calls for repeatable methods, analysis of trends and errors, and practical recommendations. Ongoing assessments are intended to show how performance changes over the contract lifecycle. That is important because accuracy can vary with capture conditions, demographic composition, software revisions and the decision thresholds used by an operational service.

    Assurance is broader than headline accuracy

    Independent biometric evaluation should document datasets, environmental conditions, failure modes and the limits of any conclusion. Security testing is also necessary because a system can meet an accuracy target while remaining vulnerable to presentation attacks, poor enrollment controls or unsafe integration.

    For related design and governance considerations, see SectechMedia’s Access Control & Identity coverage. Procurement teams should map each test result to the exact workflow and risk decision it is meant to support.

    Sources

  • Kantara Becomes First Body Accredited for UK Digital ID Framework 1.0 Certification

    Kantara Becomes First Body Accredited for UK Digital ID Framework 1.0 Certification

    Kantara Initiative has become the first conformity assessment body accredited to certify digital identity providers against version 1.0 of the United Kingdom’s Digital Verification Services Trust Framework. The accreditation also covers the supplementary codes used for regulated right-to-work and right-to-rent checks.

    What the accreditation covers

    The DVS framework defines requirements for organizations that verify identity and attributes for digital services. Kantara’s role is to assess providers against those requirements and issue certification when the evidence supports compliance. The organization already performs conformity assessments against other identity and authentication specifications, including assurance criteria associated with NIST and OpenID.

    Framework version 1.0 took effect on September 1, 2026. Updated supplementary codes for right-to-work and right-to-rent checks were introduced at the same time, with certified-service requirements applying from October 1. Certification does not eliminate implementation risk, but it provides an independent assessment against a published rule set.

    Why independent assessment matters

    Digital identity services combine document checks, biometric comparison, fraud controls and data-governance decisions. A recognized assessment process gives relying organizations a clearer basis for evaluating whether a provider follows the applicable framework rather than relying solely on vendor claims.

    SectechMedia tracks the operational implications of identity assurance in its Access Control & Identity coverage. Buyers should still examine scope, exclusions, renewal conditions and incident-reporting responsibilities before treating a certification as sufficient for a specific deployment.

    Sources

  • Rutherford Police Unifies Video and Access Control Across Public-Safety Network

    Rutherford Police Unifies Video and Access Control Across Public-Safety Network

    The Rutherford Police Department in New Jersey has consolidated video surveillance, access control and intercom functions within a single Axis Communications environment. The deployment began at the department’s new headquarters and has expanded to public spaces and the Route 3 corridor near New York City and MetLife Stadium.

    From headquarters security to borough coverage

    Axis says partner GTBM designed the headquarters system around AXIS Camera Station Pro, approximately 70 network cameras, door controllers, key-fob readers and network video intercoms. Dispatch personnel can visually verify visitors and release doors remotely, while investigators can review video and access events in the same management environment.

    The department later extended the camera network into parks and other public areas. A pan-tilt-zoom camera on Route 3 uses an ARTPEC-9 processor and AV1 compression. Axis attributes an approximately 20 percent reduction in bandwidth and storage consumption to that deployment; the figure is a manufacturer-reported result for this project, not a universal performance value.

    Operational value depends on workflow

    A unified platform can reduce time spent moving between disconnected systems, but integration alone does not guarantee effective response. Agencies still need role-based permissions, retention rules, audit logging, operator training and procedures for evidentiary export. Public-space deployments also require clear governance and oversight. SectechMedia tracks similar architectures in its video surveillance and imaging coverage.

    Sources

  • Login.gov Adds Mobile Driver’s Licenses for Remote Identity Verification

    Login.gov Adds Mobile Driver’s Licenses for Remote Identity Verification

    Login.gov has begun accepting eligible mobile driver’s licenses and state IDs stored in supported digital wallets for remote identity verification. The federal identity platform currently lists Google Wallet and Samsung Wallet among the supported options, with availability depending on the issuing state, device and wallet.

    A cryptographically verifiable credential path

    The mobile credential option gives users an alternative to photographing a physical identity document. Login.gov’s official help guidance lists mobile driver’s licenses alongside physical state IDs and U.S. passport books and cards. The service says additional wallet support is planned, while users whose state or device is not eligible can continue with another accepted document type.

    Reporting published on September 23 says the digital credential can be authenticated cryptographically, helping the service verify that the credential has not been altered. That is relevant as identity-proofing systems face counterfeit documents, synthetic media and AI-assisted impersonation attempts. The option is voluntary and is used for identity proofing rather than as a general-purpose replacement for every physical ID use case.

    Deployment questions remain important

    Support for a mobile credential depends on the full trust chain: the issuer, wallet, device, verification service and relying government agency. Programs adopting similar technology should define fallback processes, data minimization, user consent and recovery when a device is lost or replaced. SectechMedia covers related design and procurement questions in its access control and identity channel.

    Sources

  • ACCS Publishes Assessment Requirements for ISO Age-Assurance Framework

    ACCS Publishes Assessment Requirements for ISO Age-Assurance Framework

    The Age Check Certification Scheme has published ACCS 1:2026, a set of conformity-assessment requirements linked to ISO/IEC 27566-1, the framework for age-assurance systems. The organization says the document is intended to help conformity-assessment bodies prepare for accreditation and certification work covering age verification, estimation and inference services.

    From a framework to assessable controls

    Age-assurance standards describe objectives and system characteristics, but certification also requires a repeatable method for evaluating whether an implementation meets those expectations. ACCS says the new requirements work with its general scheme rules and have been reviewed by the United Kingdom Accreditation Service for suitability in an accreditation process.

    The development comes as regulators and service providers face growing demand for age checks in online environments. Relevant systems can use identity documents, biometrics, account information or other signals, and each method introduces different privacy, security, accessibility and error-handling considerations. A conformity-assessment scheme does not eliminate those trade-offs, but it can give buyers a structured basis for reviewing claims and audit evidence.

    What buyers should verify

    Organizations evaluating age-assurance services should confirm the exact scope of any certification, the version of the referenced standard and whether the assessment covers the deployed configuration rather than only a generic product. They should also examine data minimization, retention, appeal procedures and performance across the intended user population. Marketing language should not be treated as a substitute for a certificate and its scope statement. SectechMedia monitors related requirements through its Standards Watch coverage.

    Sources

  • MojeID Adds Post-Quantum Protection to Digital Identity Logins

    MojeID Adds Post-Quantum Protection to Digital Identity Logins

    Czech digital identity service MojeID has introduced post-quantum cryptography protections for encrypted server communications and login confirmation in its mobile application. The change is intended to prepare authentication services for a future in which sufficiently capable quantum computers could undermine widely used public-key algorithms.

    Protection at the transport and login layers

    According to reporting published September 21, MojeID has enabled a post-quantum key-exchange option for connections to its servers. The MojeID Klíč mobile application has also added post-quantum algorithms for identity-confirmation operations in version 16.0.0. The application was developed with security technology company Wultra.

    New users receive the updated protection automatically. Existing users can update cryptographic keys through the application’s settings, with authorization by PIN or supported biometric confirmation. MojeID says further stages of its quantum-safe identity roadmap will be discussed in October. The implementation does not mean every component of the identity ecosystem has completed a post-quantum migration; it is one step in a broader transition that also involves protocols, certificates, devices and relying services.

    Operational considerations for identity teams

    Post-quantum migration should be treated as an inventory and lifecycle-management program rather than a single algorithm replacement. Organizations need to identify where cryptographic dependencies exist, determine which components can support hybrid or post-quantum mechanisms and plan key rotation without locking out users. Authentication recovery and device replacement procedures remain important because stronger cryptography does not remove account-recovery risk. SectechMedia follows related developments in cyber-physical security and identity infrastructure.

    Sources

  • NIST FRTE Update Shows Face-Matching Leaders Vary by Capture Scenario

    NIST FRTE Update Shows Face-Matching Leaders Vary by Capture Scenario

    The latest NIST Face Recognition Technology Evaluation results reinforce a practical lesson for biometric buyers: performance rankings depend heavily on the image scenario being tested. An analysis published on September 21 examines NIST’s September 1 FRTE 1:1 report, which includes new and updated submissions across visa, border, mugshot and kiosk comparisons.

    No single leaderboard tells the whole story

    Different capture environments introduce different combinations of lighting, pose, camera position, image quality and user interaction. The reported leaders therefore change from one dataset to another. Controlled visa-photo comparisons produce a very different error profile from kiosk images captured during a live border process. Several updated algorithms moved into leading groups in particular scenarios, while other established performers retained their positions elsewhere.

    The results also include demographic-performance measures. These are not interchangeable with overall matching accuracy: an algorithm may improve its headline error rate without showing the same relative strength across demographic groups. Buyers should read both sets of results and avoid presenting one benchmark score as proof of universal performance.

    Implications for procurement and acceptance testing

    A meaningful evaluation starts with the intended deployment. Teams should define enrollment image quality, live-capture conditions, user population, gallery size and whether the application is one-to-one verification or one-to-many identification. Laboratory results can narrow a vendor list, but a site-specific pilot remains necessary before operational approval. Acceptance testing should also measure failure handling and manual review, not only successful matches. More coverage of these design questions appears in SectechMedia’s identity and access-control channel.

    Sources

  • DHS Expands RIVR Tests to Deepfakes and AI-Generated Identity Documents

    DHS Expands RIVR Tests to Deepfakes and AI-Generated Identity Documents

    The U.S. Department of Homeland Security is expanding its Remote Identity Validation Rally to test how commercial identity-verification systems respond to AI-generated documents and biometric deepfakes. DHS Science and Technology announced the 2026 program on September 21, adding a dedicated deepfake-detection track alongside broader document-validation and presentation-attack testing.

    What the expanded evaluation covers

    The program is designed to examine technologies used in remote onboarding, where a person submits an identity document and a selfie or video rather than appearing at a service counter. DHS says the new evaluation will include synthetic or altered documents, face-swap video and other impersonation techniques that can be used during video calls or teleconferencing. Applications for document-validation and selfie-to-document systems are scheduled to open in October, followed by presentation-attack and deepfake-detection submissions in December.

    DHS also plans to request real-world deepfake samples and information about attack methods from organizations able to contribute threat data. That material is intended to strengthen the test dataset and make evaluations more representative of current fraud techniques. The agency has not yet published the full technical protocol, so details such as how digital injection attacks will be separated from camera-presented attacks remain open.

    Why it matters for identity programs

    Government-run comparative testing can help buyers understand where products perform consistently and where results vary by device, document or attack type. Earlier RIVR testing found substantial differences among document-validation and liveness systems. The expanded work also reflects the direction of NIST identity-proofing guidance, which calls for controls against forged media and digital injection. Organizations reviewing remote access and onboarding technology should therefore assess fraud resistance together with usability, privacy and operational fallback processes. SectechMedia tracks related developments in access control and identity technology.

    Sources

  • Anti-Passback and Occupancy Accounting in Access Control Systems

    Anti-Passback and Occupancy Accounting in Access Control Systems

    Anti-passback is an access-control rule that compares a credential’s expected location with the direction of the next transaction. If the system records that a badge entered a controlled area, a second entry may be rejected until a corresponding exit is recorded. The same state data can support occupancy estimates, but only when the physical and operational design is consistent.

    Hard, soft and timed enforcement

    Hard anti-passback denies a transaction that violates the expected sequence. Soft anti-passback allows access but generates an event for review. Timed anti-passback blocks repeated use for a defined period without requiring a complete entry-and-exit model. Each approach addresses a different risk and produces a different operational burden.

    Hard enforcement can reduce credential sharing, yet it can also lock out legitimate users when the recorded state is wrong. Soft enforcement is less disruptive but depends on monitoring and investigation. Timed rules are useful against rapid badge handoff but do not establish where a person is located.

    Why occupancy counts drift

    An access system counts credential events, not people. Tailgating, propped doors, emergency exits, mechanical-key use and readers that cover only one direction all create gaps. A person may also enter through a turnstile and leave during an evacuation when normal exit reading is bypassed. Contractors and visitors may follow different workflows from employees.

    For these reasons, occupancy should be labeled as an operational estimate unless every route is controlled and exceptions are reconciled. It should not automatically be presented as an emergency roll-call list. Life-safety procedures need independent accountability methods and a clear understanding of who may be missing from the access data.

    Design the state model before enabling the rule

    Define areas, transitions and reset conditions before configuration. The system needs to know which reader represents entry, which represents exit and what happens when a controller or network link is unavailable. Multi-building campuses may require nested areas, while elevators and shared lobbies can complicate direction.

    Reader-to-controller communication should be supervised and protected. Standards such as OSDP can improve channel supervision and interoperability, but the complete design also includes locks, door position, request-to-exit devices and operator procedures.

    Testing and exception handling

    Acceptance testing should cover normal passage, denied re-entry, missed exit, emergency release, controller restart, duplicate credentials and operator reset. Every override should be logged with a reason and an accountable user. Reports should distinguish a true policy violation from a state-reconciliation action.

    Operators also need a defined daily reconciliation process. Repeated corrections at the same door may indicate a reader-direction error, unreliable door hardware or a business process that the configured area model does not represent.

    Successful anti-passback is a coordinated process rather than a checkbox. It works best when the organization combines physical lane control, credential governance and realistic procedures within its broader access-control and identity program. Occupancy data can then support operations without being mistaken for certainty.

    Reference sources