Daily Surveillance Briefing: July 25, 2026

A joint investigation by Forbidden Stories and The Insider traced NtechLab's FindFace technology into Iranian security agencies, transit systems, and universities, with contracts dating from 2019 through 2022 and a researcher assessing the system was operational during the January 2026 crackdown that killed more than 30,000 people over two days. TSA announced plans to expand PreCheck Touchless ID from 15 to 65 airports by spring, on the same day the ACLU reiterated warnings that airport facial recognition infrastructure can outlast any opt-in promise. Florida's HB 945 counterintelligence bill, written to cover people whose views or opinions were deemed hostile to state interests, died in committee on March 13. Delhi Police distributed AI-enabled glasses linked to a 65,000-person database for Republic Day security, with India still operating without a dedicated facial-recognition statute. The Identity Theft Resource Center's 2025 report counted 3,322 U.S. data compromises and found 70 percent of notices omitted the attack method.

State of Surveillance Editorial Team

Today in Surveillance:

  • A joint investigation traced Iran's NtechLab FindFace contracts into security agencies, transit systems, and universities. Forbidden Stories and The Insider reported that a 2019 deal let an Iranian systems integrator resell FindFace, with later contracts covering entities linked to the IRGC and Intelligence Ministry. A researcher assessed the system was operational during the January 8-9, 2026 crackdown that killed more than 30,000 people, though the investigation presents no individual arrest records tied to specific matches [1][2][3].
  • TSA announced plans to expand PreCheck Touchless ID from 15 to 65 airports by spring 2026. Aviation Week reported the expansion on January 14. The participating airlines are Alaska, American, Delta, Southwest, and United; verification is designed to take 10 seconds or less. TSA says images are not used for law enforcement and are deleted within 24 hours of scheduled departure [4][5][6].
  • Florida's HB 945 counterintelligence bill died in committee. The Florida Legislature tracker records the bill as dead on March 13, 2026, after clearing three House committees but never leaving the State Affairs Committee. The proposal defined adversary intelligence entities by their "actions, views, or opinions," and Cellebrite was the sole corporate interest listed on the lobbyist disclosure [7][8].
  • Delhi Police distributed AI-enabled glasses linked to a 65,000-person database for Republic Day. News9 reported the deployment on January 22, 2026. The devices used facial recognition with age-progressed likeness comparison and thermal scanning. India has no dedicated statute governing facial recognition, and broad state exemptions in the Digital Personal Data Protection Act limit oversight [9][10][11].
  • The ITRC counted 3,322 U.S. data compromises in 2025. The Identity Theft Resource Center's January 29, 2026 report found 70 percent of breach notices omitted the attack method, up from 65 percent in 2024 and 45 percent in 2023. Financial services led the count with 739 incidents, healthcare with 534, and professional services with 478 [12][13][14].

Also today: California's SB 446 took effect January 1, 2026, requiring notice to affected residents within 30 calendar days and attorney-general notice within 15 days when at least 500 Californians are notified [15]. Oklahoma's SB 626 also took effect January 1, expanding covered information to include biometric data and additional identifiers [15]. GovTech reported that 34 states require organizations to notify a state agency after qualifying breaches, with thresholds ranging from 250 affected people in Oregon to 1,000 in Alabama [14].

A Joint Investigation Traces FindFace From Moscow Into Iranian Security Agencies

A joint investigation by Forbidden Stories and The Insider traced Iran's acquisition of NtechLab's FindFace facial recognition to an August 2019 agreement in which NtechLab granted Rasad Intelligent Technologies (also called Rasadco) rights to use the software as a systems-integration partner. Kama took over after a 2021 merger. The Insider reported that contracts dated from 2020 through 2022 and that some transactions ran through companies investigators described as shells [1][2].

The investigation connected Kama's leadership to the Islamic Revolutionary Guard Corps. Other companies in the contract chain had provided technology to Iran's Ministry of Defense, Ministry of Intelligence, and the IRGC. Forbidden Stories reported that customers included entities linked to the IRGC and Intelligence Ministry, Sharif University, and Mashhad authorities [1][2]. Biometric Update reported on the same investigation that Iranian authorities were using NtechLab live facial recognition to crush dissent [3].

Forbidden Stories reported that FindFace could search a database of 500 million faces in less than a second with a claimed 98 percent probability of identification. One Iranian license covered searches against 100 million faces, while another contract referred to 200 cameras and a database of 300 million events. Reported deployments included Mashhad's subway and an entrance at Amirkabir University of Technology [1].

The January 2026 crackdown sits at the center of the surveillance timeline. Protests that began in late December 2025 spread in January 2026. Forbidden Stories reported that more than 30,000 people were killed over January 8 and 9. Nima Fatemi, an Iranian cybersecurity researcher, assessed that FindFace was operational during that period, while noting that on-the-ground verification was not possible [1]. That distinction matters. The investigation documents the surveillance network and a researcher's assessment of its use. It does not show a list of people identified, detained, or killed because of a specific FindFace match.

The sanctions gap is part of the story. The European Union sanctioned NtechLab in 2023 for its role in surveillance tied to human-rights abuses in Russia. The United States blacklisted the company in December 2024. Both measures came years after the 2019 Iran agreement, by which time Iranian customers had access to a system designed for fast identification across large camera networks [1]. The site's Iran vessel carries the contract chain and the researcher's assessment in full [1].

TSA Plans to Expand PreCheck Touchless ID to 65 Airports

On January 14, 2026, TSA announced plans to add PreCheck Touchless ID at 50 airports by spring. Fifteen airports already offered the program, bringing the planned total to 65. Aviation Week reported the announcement, and The Points Guy published the airport list and rollout timeline [4][5].

The first announced group included Houston Bush Intercontinental, Washington Dulles, Boston, Miami, Palm Beach, Orange County, Dallas Love Field, Kansas City, Houston Hobby, Fort Lauderdale, San Jose, Sacramento, Anchorage, Baltimore, Orlando, and Long Beach [5]. The Points Guy reported the remaining planned airports and that the rollout would reach 65 by the end of spring [5].

Eligible travelers had to hold TSA PreCheck, maintain a profile with a participating airline, upload a valid passport, and opt in. The participating airlines were Alaska, American, Delta, Southwest, and United. A camera compares the traveler's face with an image already held by the government, and Aviation Week reported that verification was designed to take 10 seconds or less. TSA told Aviation Week that images were not used for law enforcement or surveillance and that photos and personal data were deleted within 24 hours of the scheduled flight departure [4].

The ACLU has warned that airport facial-recognition infrastructure can outlast an initial opt-in promise. Its analysis argued that opting out could later be withdrawn or made inconvenient, and that the same infrastructure could spread beyond airport identity checks [6]. Those concerns are about policy direction, not a claim that Touchless ID was already mandatory. At the time of the announcement, the program required enrollment and consent through a participating airline [4][5].

Florida's Counterintelligence Bill Dies in Committee

Florida HB 945 would have required the Florida Department of Law Enforcement to establish a statewide counterintelligence and counterterrorism unit. The bill's effective date was July 1, 2026. The proposal cleared three House committees but never left the State Affairs Committee. The official Florida Legislature tracker records it as dead on March 13, 2026, and its identical Senate companion, SB 1712, died the same day in the Senate appropriations process [7].

The bill defined an "adversary intelligence entity" broadly enough to include a person, group, or entity whose demonstrated actions, views, or opinions were considered threatening or hostile to the interests of Florida and the United States. WGCU's investigation reported that the proposed unit could gather intelligence, analyze "patterns of life," execute arrests, and use counterintelligence and counterterrorism tradecraft. The structure began with a 10-person leadership team and contemplated seven regional teams [8].

The language did not stop at criminal conduct. It expressly included views and opinions. First Amendment advocates warned that the wording could turn protected speech into a basis for state surveillance. WGCU also reported that Cellebrite was the sole corporate interest listed on the HB 945 lobbyist disclosure. Cellebrite sells phone-extraction and digital-forensics tools to law-enforcement agencies [8]. The same investigation compared the proposal with past political-intelligence programs, including the FBI's COINTELPRO and police "red squads" [8].

That final status matters. The proposal exposed a real push for state-level political intelligence powers, but it did not become Florida law. The site's vessel tracks the bill language and the lobbyist disclosure [8].

Delhi Police Distributed AI Glasses Linked to a 65,000-Person Database

Delhi Police distributed more than a dozen AI-enabled glasses to officers working around Kartavya Path for the January 26, 2026 Republic Day parade. The devices used facial recognition linked to a police database of about 65,000 people. Additional Commissioner of Police Devesh Mahla said the system could compare a current face with an old photograph and generate an age-progressed likeness. The glasses also included thermal scanning that police said could help screen people carrying prohibited items [9].

The glasses were one piece of a much larger security operation. More than 10,000 police personnel, along with paramilitary forces, commandos, and snipers, were assigned to the parade [9]. Delhi Police had already announced a citywide surveillance system combining facial recognition, automatic number-plate recognition, predictive analytics, and feeds from more than 10,000 cameras. The plan aimed to monitor up to 1,000 feeds at once and return matches in under five seconds [16].

India has no dedicated statute governing facial-recognition technology. A Software Freedom Law Center analysis says the Digital Personal Data Protection Act 2023 contains broad exemptions for state processing tied to criminal investigations, public order, and national security. The same analysis found no mandatory testing, training, or ethical-impact requirements before agencies deploy these systems, and warned that procurement documents often state accuracy targets without disclosing false-positive rates or demographic bias [10]. India's Supreme Court recognized privacy as a fundamental right in 2017. Even so, the Atlantic Council warned that broad government access and weak institutional checks leave police use of facial recognition with limited oversight [11].

ITRC: 70 Percent of 2025 Breach Notices Omitted the Attack Method

The Identity Theft Resource Center's 20th annual report counted 3,322 U.S. data compromises in 2025, up from 3,152 in 2024 and a 79 percent increase over five years. The report's sharper warning concerned what companies did not disclose. Seventy percent of notices, covering 2,324 incidents, gave no information about the attack. The share was 65 percent in 2024 and 45 percent in 2023. In 2020, nearly every breached organization disclosed attack details [12][13].

Insurance Journal summarized the problem with the report's blunt phrase: "Transparency is on life support." It also reported that consumers and small businesses are left "operating blind" when notices omit useful details [13]. Financial services recorded 739 compromises, healthcare had 534, professional services 478, manufacturing 299, and education 188 [12]. The victim-notice count fell from 1.37 billion in 2024 to about 279 million in 2025, and the ITRC attributed that drop to the absence of the huge incidents that drove the previous year's total, not to a broad improvement in security [12]. One of the largest 2025 compromises reused data stolen from AT&T in 2021, a reminder that old records remain useful to criminals [13].

State rules still vary. GovTech reported that 34 states require organizations to notify a state agency after qualifying breaches, with thresholds ranging from 250 affected people in Oregon and 500 in Pennsylvania to 1,000 in Alabama [14]. California's SB 446 took effect on January 1, 2026, requiring notice to affected residents within 30 calendar days and attorney-general notice within 15 calendar days when at least 500 Californians are notified. Oklahoma's SB 626 also took effect on January 1, 2026, expanding covered information to include biometric data and additional government and financial identifiers [15].

The ITRC surveyed 1,040 U.S. consumers. Eighty percent had received at least one breach notice in the previous 12 months, and nearly 40 percent had received three to five. Among notice recipients, 88 percent reported at least one negative consequence, with increased spam and robocalls as the most common, followed by phishing and account-takeover attempts. The survey also found immediate anxiety among 60 percent of recipients and frustration among 59 percent, with half fearing financial fraud [12]. The site's vessel tracks the ITRC counts and the consumer-survey findings in full [12].

What to Watch This Week

Friday July 25 to Sunday July 26. The TSA Touchless ID expansion is the active federal deployment to watch. The 65-airport target was set for the end of spring 2026, and the ACLU's standing warning about opt-in creep is the structural argument for travelers who want to keep the standard document lane in place [4][5][6].

The Iran contracting chain. Watch whether the European Union or U.S. Treasury moves to sanction additional entities in the FindFace supply chain identified by Forbidden Stories and The Insider. The EU sanctioned NtechLab in 2023 and the U.S. in December 2024; the Iranian systems integrator and its successors are the next layer [1][2].

The post-HB 945 fight. Florida HB 945 died, but the bill language around "views or opinions" is a template other state legislatures can copy. Watch the Florida Legislature's 2027 session for reintroduced language, and watch for similar proposals in other states that already run intelligence-style fusion centers [7][8].

Sunday August 2. The EU AI Act high-risk compliance deadline phases in, including biometric-inference rules that touch age-verification and identity systems. Expect the first member-state enforcement signals in the weeks after, and watch whether the European Commission moves to narrow the recent Court of Justice platform-liability ruling in the same window [17][18].

Sources

  1. Forbidden Stories: Eyes of Iran, How the Regime Secretly Monitors Its Citizens (March 3, 2026). https://forbiddenstories.org/iran-regime-monitors-citizens/
  2. The Insider: Investigation Finds Iran Acquired FindFace (March 4, 2026). https://theins.press/en/news/289968
  3. Biometric Update: Iran Uses NtechLab Live Facial Recognition (March 4, 2026). https://www.biometricupdate.com/202603/irans-authorities-using-ntechlabs-live-facial-recognition-to-crush-dissent
  4. Aviation Week: TSA Expanding Touchless Facial Recognition to 65 Airports (January 15, 2026). https://aviationweek.com/air-transport/airports-networks/tsa-expanding-touchless-facial-recognition-65-airports
  5. The Points Guy: TSA PreCheck Touchless ID Expansion (January 13, 2026). https://thepointsguy.com/news/tsa-precheck-touchless-id-expansion/
  6. ACLU: How TSA's Facial Recognition Plan Will Go Far Beyond the Airport. https://www.aclu.org/news/privacy-technology/how-tsas-facial-recognition-plan-will-go-far
  7. Florida Legislature: HB 945, Statewide Counterintelligence and Counterterrorism Unit (2026). https://www.flsenate.gov/Session/Bill/2026/945
  8. WGCU and Florida Trident: Legislation to Criminalize Dissent in Florida? (February 19, 2026). https://www.wgcu.org/investigation/2026-02-19/legislation-to-criminalize-dissent-in-the-free-state-of-florida
  9. News9: Delhi Police to Deploy AI-Enabled Glasses for Republic Day Security (January 22, 2026). https://www.news9live.com/city/delhi/delhi-police-to-deploy-ai-enabled-glasses-for-republic-day-security-key-features-2921821
  10. Software Freedom Law Center India: Facial Recognition Surveillance Landscape in India. https://sflc.in/analysis-of-the-facial-recognition-technology-enabled-surveillance-landscape-in-india/
  11. Atlantic Council: India's Adoption of Facial Recognition Technology (April 10, 2020). https://www.atlanticcouncil.org/blogs/new-atlanticist/indias-adoption-of-facial-recognition-technology-could-have-serious-ramifications/
  12. Identity Theft Resource Center via PR Newswire: 2025 Annual Data Breach Report (January 29, 2026). https://www.prnewswire.com/news-releases/identity-theft-resource-center-2025-annual-data-breach-report-record-number-of-data-compromises-in-2025-79-percent-jump-over-five-years-302668595.html
  13. Insurance Journal: ITRC Says Data-Breach Transparency Is on Life Support (February 18, 2026). https://www.insurancejournal.com/news/national/2026/02/18/858534.htm
  14. GovTech: 2025 Data Breach Report Finds More Compromises, Less Transparency (January 29, 2026). https://www.govtech.com/security/2025-data-breach-report-more-compromises-less-transparency
  15. Alston & Bird: California and Oklahoma Breach Notification Updates for 2026. https://www.alstonprivacy.com/key-breach-notification-updates-in-california-and-oklahoma-for-2026/
  16. BW Security World: Delhi Police Facial Recognition System Citywide Rollout (April 18, 2025). https://bwsecurityworld.com/technology/delhi-police-to-roll-out-ai-powered-facial-recognition-surveillance-system-citywide/
  17. State of Surveillance: EU AI Act August 2026 Biometric Surveillance Explainer. /news/eu-ai-act-august-2026-biometric-surveillance-explainer
  18. State of Surveillance: Iran's Russian Facial Recognition Network, the Iran vessel carrying the Forbidden Stories and The Insider investigation. /news/iran-russia-findface-facial-recognition-crackdown-2026
  19. State of Surveillance: TSA Planned Touchless ID Expansion to 65 Airports, the TSA Touchless ID vessel. /news/tsa-touchless-id-65-airports-facial-recognition-2026
  20. State of Surveillance: Florida Counterintelligence Bill Died in Committee, the Florida HB 945 vessel. /news/florida-hb-945-counterintelligence-views-opinions-surveillance-2026
  21. State of Surveillance: Delhi Police Used AI Glasses at Republic Day, the Delhi glasses vessel. /news/delhi-police-ai-glasses-republic-day-2026
  22. State of Surveillance: Data Breach Transparency Is on Life Support, the ITRC vessel. /news/data-breach-transparency-crisis-itrc-2025-report-2026