US passport photo plan points to new layer of remote biometric verification

U.S. Secretary of State Marco Rubio said this month that the State Department is preparing to make passport applications “almost all” online, including a process in which an applicant uses a phone or computer camera and the government’s security system to “verify the facial ID.” He said applicants would be able to apply “online entirely, for the most part,” but did not say whether first time applicants, minors, or everyone seeking a passport would qualify, and he did not define who would. The announcement suggests a significant expansion of the department’s existing online passport renewal service. Americans already can submit an eligible renewal application online and upload a “selfie” digital image. The current system is designed principally to determine whether an applicant’s uploaded photograph meets passport rules. It is then physically reviewed by an employee. But what Rubio described is a face biometrics comparison confirming that the person submitting a picture is the person associated with the passport record. Speaking at the launch of the commemorative Patriot Passport that features President Donald Trump standing behind the Resolute Desk, Rubio said applicants would be able to go online and do “almost all of it entirely online.” He said the camera that is in a phone, laptop, or desktop computer should allow a person to take a passport picture at home and have the department “verify the facial ID” in real time. He said the department expects to “roll that out in a few months when it’s ready.” Rubio did not say the system would use liveness detection, explain whether the applicant would take a still photo or a short video, or describe how the department would distinguish a live applicant from a replayed image, manipulated photograph, or synthetic video. This part of the process is critical, and the challenge it presents is one of the reasons why most jurisdictions around the world still do not offer selfie photos to be submitted for passports. If the passport issuer does not have control over the capture process, then it is vulnerable to biometric morphing spoof attacks , which have been recognized as a major security issue on both sides of the Atlantic. Rubio also didn’t identify a contractor. His reference to “facial ID” may describe a one-to-one comparison between a newly captured image and a photograph already associated with an applicant’s passport record, which is a different function from one-to-many facial identification or surveillance searching. The distinction matters because the State Department’s passport online renewal system already relies on automated screening. State’s instructions say an applicant selects a digital photo from the device, the tool checks basic image requirements, and a department employee reviews the picture after the application is submitted. The department also says it checks photos for AI editing and other digital changes. Rubio’s proposal appears to move beyond determining whether a photograph has the right background, lighting, position, and file characteristics toward live biometric confirmation of an applicant’s identity. The public contracting record identifies companies currently operating important pieces of that environment, but none of the records prove that State has selected a liveness-detection provider for the forthcoming feature described by Rubio. In April 2024, State Department Consular Affairs awarded eSimplicity a $4.46 million firm-fixed-price contract for the Online Passport Renewal 3.0 modernization program. That work ran through July 2025 and covered modernization of the application service that became the public online renewal platform. State then awarded eSimplicity a larger task order, valued at up to $13.84 million, for Online Passport Enhancement, Renewal, and Application Services, or OPERAS. The contract began in May 2025 and currently runs through July 2028. It is classified as computer systems design and business application development support, meaning eSimplicity is positioned to build and maintain the online workflow through which applicants enter information, submit payment, upload images, and receive system notices. The record does not identify eSimplicity as the developer of a facial recognition algorithm or liveness detection engine. A State Department contract for $68.3 million was awarded to Idemia National Security Solutions in September 2018 for a facial recognition system with updated matching capability, integration with State’s passport and visa issuance processes, and transition from the legacy facial recognition platform. The award record listed a potential completion date of March 31, 2026. A 2025 contracting entry also shows a $6.91 million action associated with that award which reflects a much longer relationship between State and Idemia. When State moved in 2018 to retain the company on a sole-source basis, the department said Idemia screened passport and visa applicants and maintained roughly 360 million facial templates in its proprietary format. State argued that replacing the company would require recreating those templates in another vendor’s format, creating cost and operational risks for passport and visa processing. Idemia markets both active and passive liveness functions and describes a phone or computer camera “selfie check” designed to confirm that the person behind the camera is present rather than a still image. It also holds a place on the General Services Administration’s (GSA) 10-year, $194.5 million Login.gov identity-proofing blanket purchase agreement . In August 2025, GSA began allowing Login.gov users to prove identity with a U.S. passport by capturing the passport’s biographical data page. Login.gov then checks the credential against State Department passport records through a privacy preserving department-operated application programming interface. It is not the same as applying for or renewing a passport, and the department has not said that the new feature announced by Rubio will run through Login.gov. It does, however, demonstrate that the department already operates an interface enabling another federal identity-proofing service to query authoritative passport records. The department has not released a statement of work, security architecture, privacy impact assessment update, test results, or award notice tying any company to the forthcoming feature.

U.S. Secretary of State Marco Rubio said this month that the State Department is preparing to make passport applications “almost all” online, including a process in which an applicant uses a phone or computer camera and the government’s security system to “verify the facial ID.”He said applicants would be able to apply “online entirely, for the most part,” but did not say whether first time applicants, minors, or everyone seeking a passport would qualify, and he did not define who would. The announcement suggests a significant expansion of the department’s existing online passport renewal service.

Americans already can submit an eligible renewal application online and upload a “selfie” digital image. The current system is designed principally to determine whether an applicant’s uploaded photograph meets passport rules. It is then physically reviewed by an employee.

But what Rubio described is a face biometrics comparison confirming that the person submitting a picture is the person associated with the passport record. Speaking at the launch of the commemorative Patriot Passport that features President Donald Trump standing behind the Resolute Desk, Rubio said applicants would be able to go online and do “almost all of it entirely online.”He said the camera that is in a phone, laptop, or desktop computer should allow a person to take a passport picture at home and have the department “verify the facial ID” in real time.

He said the department expects to “roll that out in a few months when it’s ready. ”Rubio did not say the system would use liveness detection, explain whether the applicant would take a still photo or a short video, or describe how the department would distinguish a live applicant from a replayed image, manipulated photograph, or synthetic video. This part of the process is critical, and the challenge it presents is one of the reasons why most jurisdictions around the world still do not offer selfie photos to be submitted for passports.

If the passport issuer does not have control over the capture process, then it is vulnerable to biometric morphing spoof attacks, which have been recognized as a major security issue on both sides of the Atlantic. Rubio also didn’t identify a contractor. His