Executive Summary
The discussion on the use of facial recognition technology became prominent when Mohammad Saleh Hashemi Golpayegani, the former secretary of the Command of Enjoining Good and Forbidding Wrong, stated in a September 2022 interview with the news site Khabar Fori: ‘Technology now allows images to be matched with national ID photos, and those without proper hijab to be identified. If someone does not observe the hijab in public places like the metro, the metro camera captures their image, they are fined a significant amount, and the fine is mailed to them.
This statement and the subsequent protests of the Women, Life, Freedom movement triggered a debate on the use of this technology. According to Filterwatch, which analyzed a collection of hacked prosecutorial emails by the hacker group Anonymous Iran Ops, two companies named Niafam and Yaftaar Pioneers of Computing (or Yaftaar) have been working with the Iranian prosecutor’s office since around 2015 to develop technologies for image analysis and facial identification of individuals. The extent of their progress is unknown. However, given the long-term investment in this area, it can be inferred that the Iranian government has managed to develop this technology to some degree.
Furthermore, by examining the new policies addressing what Iranian authorities refer to as ‘improper hijab’, one can infer that the facial recognition technology, as described by Iranian officials, has not been developed as suggested.
For instance, on September 20, 2023, a report was released stating that according to Article 52 of the Modesty and Hijab Bill, drivers of online taxi services like Snapp and Tapsi are required to report instances of “improper hijab.”
In the note to Article 52 of this bill, it is stated: “Online taxi platforms are obliged, within two months, to incorporate in their communication systems with customers and drivers the ability for the driver to report passengers violating this law. If a driver reports a violation of this law by a passenger to the platform, they are exempted from paying a fine. Furthermore, these platforms are mandated to provide online connectivity for the officers of the Islamic Republic of Iran’s Disciplinary Command (FARAJA) to this system. In the event of non-compliance with the obligations of this article, the violating platforms will be fined an amount equivalent to three months of the platform’s profit derived from its revenues.”
The question that arises is: Why do Iranian authorities need to pass a law that forces a private company to monitor and report ‘improper hijab’ if the traffic control cameras can use facial and ‘improper hijab’ recognition technology as accurately and effectively as they say?T
Or in another instance, we know that at least since 2019, the Iranian police, in collaboration with the Command for the Promotion of Virtue and the Prevention of Vice, had designed an application named “Nazer” for the police. The app allows the police to record any violations of the dress code and send a text message with a fine to the offender.
This application, which has recently made headlines, raises the question again: Why do the Iranian authorities need to rely on this tool to punish ‘improper hijab’ if they have such advanced facial recognition technology?
At the same time, Filterwatch has found out that some Iranian companies are working with the Information Technology Organization, a branch of the Ministry of Communications and Information Technology, to create similar systems for different uses.
Some of these companies have publicly stated on their websites that they have made these technologies to improve authentication for banking and government services. But these technologies can have a dual purpose; on one hand, they can help with verifying identities, and on the other hand, they can be exploited by Iranian security and judicial authorities for security and judicial purposes.
There is evidence suggesting that some of these companies might have collaborated with these authorities. Sometimes, this evidence has surfaced in the public domain, prompting journalists to inquire about it. For instance, Nima Shamsapour, the CEO of U-ID, denied cooperation with security institutions in an interview on June 16, 2023, with the ‘Blue Room‘ program.
Sardar Ahmadreza Radan, the Chief Commander of the Iranian Police, stated in an interview with the Islamic Republic of Iran Broadcasting (IRIB) news agency on April 8, 2023, that as of the Iranian month of Farvardin (March 20, 2023 and ended on April 18, 2023), individuals not adhering to the hijab regulations “will be identified using advanced technology and equipment, reprimanded, and then referred to the judicial courts.”
The U-ID CEO’s answer implies that biometric and facial identity verification companies may be giving this technology to security and judicial authorities.
As such, in this report, we will look at some Iranian companies that work with the Information Technology Organization to make this technology. Filterban received the list of these companies from sources who talked to us anonymously.
What is facial recognition/biometric technology?
Facial recognition technology is an artificial intelligence-based system that, using pre-existing data, allows for the identification and tracking of individuals. Liveness Detection is a component of the facial recognition system that prevents system errors, ensuring that an individual cannot be recognized or gain access using a two-dimensional photo or anything other than their actual face.
In ‘Liveness Detection’, the system asks the individual to face the camera and perform specific movements (such as turning their head left and right) to determine if the face is artificial or a photograph. By recognizing facial details, this system can discern the authenticity of the face and enhance the accuracy of the recognition.
Applications of Identity Recognition Systems Worldwide; Why Are We Concerned for Iran?
Face recognition and identity verification systems are used across the world in electronic systems and applications that require authenticating individuals. For example, in a banking system, a person needs to register their identification card and then verify their real identity using the face/liveness detection system. This system compares the person’s face with the photo on the ID card and checks if the person is alive and awake. This way, the system can prevent fraud or deception by photos or unconscious people.
A source who wished to remain anonymous and who was involved in developing these software applications told Filterban that identity verification and liveness detection systems are integrated. This means that a company offering identity verification can also implement the feature of checking if the person is alive and present.
On one hand, the general principles of liveness detection systems are similar to other systems such as license plate recognition. They are based on detecting specific points in an image and matching them with real samples. Therefore, facial recognition companies often offer a package that covers both liveness detection and license plate recognition features. Filterban’s research supports this statement.
Facial identity verification systems are mainly used for banking and stock exchange purposes in Iran. However, these systems also raise concerns among users and human rights activists who fear that they could be used to identify and track down government protesters.
Over the past months, the government had claimed, through official figures and media outlets, that it used facial recognition systems to identify hijab protesters in the past months.
Sardar Ahmadreza Radan, the Chief Commander of the Iranian Police, stated in an interview on April 8, 2023, that starting from April 15, individuals without hijab would be “identified using advanced technology and equipment, they would be warned, and then referred to judicial courts.”
On June 15, 2023, Radan, while addressing reporters in the province of Qom, announced the implementation of a “plan to confront those without hijab using surveillance cameras.” He also revealed that the President has agreed to expand the coverage of cameras so that they can be utilized “to ensure security using smart platforms in all security dimensions.”
Iran’s Infrastructure for Face Recognition: What Systems are Required?
Face recognition and liveness detection services require various software and hardware capabilities. On the software side, they need face recognition programs that use artificial intelligence to differentiate between similar faces. These programs require digital software, programmers, and a large number of real-life samples and a comprehensive database of citizens’ photos. On the hardware side, they need high-quality and accurate images for this purpose.
On September 4, 2023, a few weeks before the tragic death of Mahsa (Jina) Amini, Mohammad Saleh Hashemi Golpayegani, the then-Secretary of the Command for the Promotion of Virtue and the Prevention of Vice, told the “Khabar Fori” website that his organization used facial recognition technology to identify and punish citizens who violated the hijab law or engaged in “non-standard and inappropriate behaviors”. He said that they compared the images of the offenders with the national citizens’ database for their ID cards. He urged other institutions to employ the same systems to enforce what is termed by law as “modesty and hijab”, in order to deal with violators.
As previously mentioned, Sardar Radan had earlier announced the use of surveillance cameras to capture images of those protesting against the government. Filterban’s field investigations, based on interviews with citizens inside Iran and Fars News Agency reports, reveal that military and plainclothes officers in some parts of the city – especially in public transportation and main roads – are filming people without hijabs using mobile phones or cameras. It is not clear if all these videos are used to improve the facial recognition system, but some of them have led to the arrest and identification of protesters.
In terms of historical usage, facial recognition technology is also used for all electronic government services.. For example, the ‘Smart Government Services Window’ or http://my.gov.ir employs two-factor authentication.”
The Ministry of Communications also has to implement three authentication levels by the end of 1401. These levels are: verifying the applicant’s identity information with the Iranian Identity Information Database, checking it with the User Authentication Network Database (SHAHKAR), matching the applicant’s biometric data with the registered biometric information in the Iranian Identity Database, and using digital signatures to confirm the service request process from start to finish. Private companies offer these services and sell their solutions to the government.
In the software realm, numerous companies have so far introduced facial recognition software, which we will delve into later in this report. Furthermore, in the subsequent section, we will detail the facial recognition and liveness detection software provided by these groups
Facial Recognition Service Providers
Kavoshgaran Hamrah Kish (Novin Development Hamrah Kish)
The Development Novin Hamrah Kish Company is a subsidiary of the Geraish Tazeh Kish Group of Companies (GSS), led by CEO Kiavash Arj. The GSS was founded in 1989 and has several companies that provide software services in fields such as banking and electronic payment, identity verification, card-based payment, and fuel system solutions.
The Kavoshgaran Hamrah Kish Company’s website mentions its collaboration with government organizations such as the Ministry of Interior, Ministry of Communications, Information Technology Organization, Civil Registration Organization, and the ‘Root’ Electronic Certificate Issuance Center. It provides ‘access to identity data for precise verification’ for all these organizations. The website also introduces a range of its software products.
The ‘zoomID‘ infrastructure for non-present biometric authentication and electronic signature authenticates the user by receiving their identity information and comparing it with the records in the civil registration. This is a summary of the functionalities of ‘zoomID’ available on the company’s website. The website does not provide more details about this service, such as what ‘non-present authentication’ means, or what specific data is used for verification.
Non-present authentication Providing services for managing the digital identity lifecycle
Using the Public Key Infrastructure (under the ‘root’ center approved by legal authorities) to issue electronic signature certificates for different entities, such as natural persons, legal entities, and equipment.
National “Pas” Application
The National “Pas” Application website says that this app uses government services and artificial intelligence technology to make identity verification, registration, and digital signature certificate issuance easier. The site provides identity verification and electronic signature services to companies.
This app offers facial recognition-based identity verification and matches information with civil registration data for access to various websites, which can be governmental, semi-governmental, banks, mobile phone operators, taxis, or online stores.
Summary of Services:
- Online Biometric Authentication (based on facial recognition)
- Electronic Signature Certification
- Remote Identity Verification (via face)
- Digital Signature Certificate
Ghadir Design and Processing Company
Founded in 2004 and led by CEO Mohammadkamal Niknam, Ghadir Design and Processing Company offers a variety of services. One of its offerings includes hardware and software products related to identity verification, biometrics, and artificial intelligence, which have been available for roughly a decade. The company’s website highlights products such as “biometric scanners, portable identity verification, and identity verification software.”
The company has three distinct groups dedicated to service delivery, with the “Identity Verification and Biometrics” group specifically focusing on the aforementioned products. On Ghadir Group’s website, it is claimed that they have business relations with brands from South Korea, China, and Turkey and have registered representations in these countries.
This company provides services to governmental, private, and military organizations, including NAJA (Law Enforcement Force of Iran), the Organization for Registration of Deeds and Properties, the Social Security Organization, Mahan Airline, Caspian Airline, Parsian E-Commerce Company (affiliated with Parsian Bank), the Iranian Red Crescent Society, Ansar Bank, and Middle East Bank.
The identity verification system has the capability to detect gender, emotions, age, and race. The company’s products in the field of identity verification consist of both hardware and software components. In the hardware section, these products include document scanners and fingerprint devices from both South Korea and Iran.
In the facial recognition software segment, the company utilizes the Ghadir Intelligent Face Analyzer. This product is introduced on a website named “DibaRayan“, not the “Ghadir” website. Historical domain information review indicates that the manufacturer’s name was removed from their public domain details at the beginning of 2023.
The “Ghadir” Intelligent Face Analyzer claims that it does not offer its product for the purpose of identifying “an individual’s identity associated with their face.” Instead, it is used to provide services to “security and surveillance systems, electronic customer relationship management, human-computer interaction, aesthetics, and smart advertising boards.”
Based on the information in the promotional brochure (archive link), this product can determine the gender of Iranian individuals, accurately detect age within a range of 5 years, discern people’s emotions, and identify race based on the three main categories of Asian, Black, and White (considering eye shape and skin color).
Amn Afar Gostar Sharif
Rasoul Jalili, a member of the filtering committee, is also a board member of AmnAfarGostar Sharif. This company has faced criticism and sanctions from online activists for providing filtering software to the Iranian government.
This company has been operating since 2002 in the fields of “research and production of indigenous security products in the IT sector” to “protect Iran’s information assets” and operates under the management of Hashem Habibi. According to the information provided on the company’s website, AmnAfar Sharif aims to achieve Iran’s lofty goals in the IT sector through “providing integrated solutions for a secure cyberspace” using security products that are “indigenous and from like-minded countries.”
In the list of products and services of the AmnAfarGostar Sharif company, there is no separate mention of an identity verification or facial recognition system. However, in the description of some of the company’s services and products, various identity verification methods are mentioned several times as ancillary services provided in a software program. We will reference these below:
ParsPAM Remote Access Management System
This is a system for managing and creating user access. In the description of this service, it refers to “multi-faceted authentication solutions”, “multiple authentication tools”, and “multi-factor identity verification tools”.
Datin Company (a subsidiary of Fanap Holding)
Datin, officially named “Datis Arian Qeshm,” is a subsidiary of the “Pasargad Arian Information and Communication Technology (Fanap)” holding. The company was established in December 2005 with the investment of the Pasargad Financial Group.
Datin Company is a financial and banking software company led by Mohammad Nezhad Sadaqat. The company’s website says that it used to be the banking solutions unit of the ‘Pasargad Arian Information and Communication Technology (Fanap)’ until 2011. It was responsible for developing and launching a comprehensive centralized banking solution for the Pasargad Bank’s branch network. It also aimed to develop and implement other banking and insurance systems. It continued this path after becoming the Datin Company from Fanap’s banking solutions unit.
Wepod Software
The Wepod software, developed by Datin Company—a subsidiary of Fanap, is designed for executing administrative banking tasks (such as account opening, card issuance, loan applications, and general banking activities). For user identity verification, it utilizes facial recognition and liveness detection systems.
Upon initial access and the first step of authentication, the SIM card of the phone must match the national identification number of the account holder (the individual requesting to work with Wepod). Next, the individual’s identity is verified by retrieving national card information, and in the final stage, liveness detection is conducted. For the liveness detection segment, the user is asked to record a video while moving their face to the left and right.
Based on the information provided on the Wepod website, these inquiries are made through the Civil Registration Organization and the Central Bank.
Iranian Kiosk Information Technologists Company
The Iranian Kiosk Information Technologists Company is one of the five companies of the national kiosk services holding, also known as the Kiosk Services Holding, established in 2009 with the aim of creating a supply chain for government kiosk services. It operates under the leadership of CEO Mehrdad Mohammadi.
The company’s website claims that it serves more than 100 executive devices from ministries, organizations, and public institutions. It says that it manages, maintains, and develops the national gateway for government service kiosks in a secure network with supervisory entities.
Government service kiosks carry out state services such as issuing government certificates, paying fines, and issuing documents while verifying the identities of citizens. Additionally, one of the services of the government service centers is the authentication of individuals and confirmation of their identity – for undertaking certain administrative and judicial processes such as registering complaints. For instance, for online registration of legal complaints between an employee and employer, one of the methods of verifying the parties’ identities is through authentication at the government service kiosk.
For remote identity verification, which has gained momentum following the outbreak of COVID-19, the company utilizes the software and website named “Signal“. (This software is different from the Signal messaging app.) This program compares a registered photo of the individual from the national registry with a video received for liveness detection and defines the person’s identity in the SEJAM system. The SEJAM system is an application that facilitates an individual’s participation in stock exchange transactions.
“Signal”, which is utilized for identity verification in the SEJAM system, has been developed by the company “Part Financial Processing”. In the continuation of this topic, we will delve into this company and its subsidiaries in the field of identity verification.
“Part Financial Processing Company”
The Part Financial Processing Company, under the management of Ali Rasouli-Zadeh, has launched the Signal application and website, which enables remote identity verification for stock market transactions. To do this, people need to get a tracking code in the SEJAM system (the Comprehensive Registration System for Customer Information) and verify their identity online through this system.
Signal verifies identity using a camera (mobile or computer webcam) with a liveness detection system. The Signal website says that it compares the data from the liveness detection process with the Civil Registration Organization’s information. It uses the ‘Farashenasa’ platform, which is a remote identity verification system by the Part Financial Processing Company.
It’s worth noting that Signal is just one of the identity verification tools for the Sejam system. The Sejam platform also uses facial recognition authentication through the ‘UID’ and ‘Up’ systems, which we will further address in this article.
Farashenasa Platform (Business Identity Verification)
Farashenasa is a biometric identity verification software by the ‘Part Financial Processing’ company. It has been providing biometric identity verification for various businesses since 2013. As previously mentioned, Farashenasa is one of the platforms that facilitates identity verification services for the Sejam system (a system related to the stock exchange)
Farashenasa offers two services, digital signature and electronic identity verification, as eKYC (online customer identification) solutions to ’emerging businesses’. In the Iranian digital ecosystem, emerging businesses are referred to as startups.
Farashenasa uses two systems, Shahab (Artificial Intelligence Cloud Network) and Sahab (Intelligent Cloud Service), as its operational arms. Both Shahab and Sahab are products of the Part Artificial Intelligence Research Center (a related entity to Farashenasa and the Part Financial Processing Company).
Kiahoushan Aria (Vida)
Kiahoushan Aria is a knowledge-based company in Sharif Science and Technology Park, led by CEO Nafiseh Hatami Khah. It verifies identity online for the Thana system, which is owned by the Judiciary of Iran. The company also provides a voice-based authentication system.
The Thana system uses both face and voice authentication under the “Vida” platform. To verify identity in the Thana system, a person has to provide their identity information such as birth certificate details, national ID card, occupation, and postal address. They also have to take a photo and a video for identity confirmation. For the liveness check, the user has to record a video and read a short text.
This company provides face recognition authentication services for banking systems, cryptocurrencies, and other companies. However, it does not disclose its clients or partners.
Trust Key Pathway (SHAKEYLID) The Trust Key Pathway company (SHAKEYLID) developed a facial recognition authentication system called ‘Ashnami’. It started as a part of the Adan-Nik Afzar Engineering Company (Adanik), which works in the financial and banking sector, in 2018. It became an independent legal entity two years later and is now run by Meysam Faqihieh Rezaie.
Adanik Company, the parent firm of SHAKEYLID, produces infrastructural and software solutions for financial systems. Its clientele includes insurance institutions and the following banks: Bank Ayandeh, National Bank, Parsian Bank, Export Development Bank, Shahr Bank, Karafarin Bank, Noor Financial and Credit Institution, Razi Insurance, and Saman Insurance.
According to SHAKEYLID’s website claim, the Thana system (the electronic notification of the Judiciary), the Sejam system (identity verification for receiving stock exchange services), and municipalities are among the significant government clients of SHAKEYLID. Additionally, 12 banks utilize SHAKEYLID’s identity verification service known as ‘Ashnaami’.
Ashnaami System
The Ashnaami System, an authentication system based on facial recognition and liveness detection owned by ShakiLID, operates as follows:
1.It collects identity and residency information and verifies it through the Civil Registration Office.
- It captures the individual’s photo and a video (for liveness detection) and matches it with the database image
- It issues the identity verification certificate and completes the authentication process.
.
Intelligent Insight Pioneer Generation (U ID)
Intelligent Insight Pioneer Generation is a knowledge-based company that offers authentication systems using facial recognition and liveness detection, called ‘U ID’. It says it can also verify faces with masks. The company is run by CEO Nima Shamsapour.
The Up application is a platform that uses the U ID authentication system, which is based on facial recognition and liveness detection. The Up application hosts the Thana system and the Sejam system, which are used for receiving judicial notifications and accessing the stock market, respectively. U ID can verify the identity of users even when they wear masks. Some of the major clients of U ID are Bank Tejarat and Bank Saman (System 720).
In an interview with the Jomhouri Eslami newspaper on July 28, 2021, Nima Shamsapour, the CEO of Intelligent Insight Pioneer Generation, said that his company’s U ID authentication system is a commercial partner of Up and Bank Saman’s System 720. He did not elaborate on the nature of this partnership.
On June 22, 2023, Nima Shamsapour, the CEO of Intelligent Insight Pioneer Generation, spoke to the ‘Blue Room’ program, a product of the ‘Rah-e Pardakht’ website, which covers news in the technology and financial sectors, and said: , said: ‘There were reports suggesting that UID identifies people’s faces through cameras and provides the data to other institutions. However, in its four years of operation, UID’s business model has been focused on aspects like live image recognition. UID is a provider of digital identity verification services and is entirely distant from the aforementioned notion.”
Nima Shamsapour continued in the same conversation: “UID provides services to businesses and centers that wish to offer non-physical services, and the users’ data does not belong to this company at all. The information is for the bank, the stock exchange organization, and the primary service provider. All accessible data by UID is registered in more detail with the National Civil Registration Organization. We, in the same vein and based on the data of the smart national ID card, match the data, and we don’t have the capability to access camera technology at all.”
UID also provides authentication services for cryptocurrency exchanges and the Comprehensive Labor Relations System, which is a platform for identity verification in the Ministry of Labor and offering retirement services, electronic registration of labor contracts, and registering complaints of workers and employers. However, according to the U ID website, this project has faced some problems from the Ministry of Labor, but the reason is not specified. UID verifies the user’s identity by matching their information with the Civil Registration database.
Sharif Sepid System Company
Sharif Sepid System Company is a knowledge-based company that specializes in digital identity verification products.
Sepid ID, Sepid Star, and Sepid Box are the primary software applications of this company in the identity verification field, which work with cards, fingerprints, and vehicle plate tags. However, among the company’s products, the eKVC system for NAJA (Law Enforcement Force) is mentioned, which is not listed in the company’s standard products, and detailed information about it is not available. eKVC, or the remote identity verification system, is an application that uses facial recognition and liveness detection for identifying individuals.
This company has a wide range of clients from various sectors, such as the Judiciary, the Railway, the Oil Company, Karafarin Bank, Telecommunications Company of Iran, City Bank, Bank of Industry and Mine, and Noor Institution. The company also provides identity verification services for several banks, such as Eghtesad Novin Bank, National Bank, Saman Bank, Mehr Eghtesad Bank, Agricultural Bank, Pasargad Bank, Mellat Bank, Ayandeh Bank, and Bank Melli.
Sepid System Sharif Company mentions three companies of Korean, German, and Austrian nationalities as its business partners on its website. These companies provide attendance systems, access control systems, fingerprint scanners, RFID-based systems, and time and attendance solutions.
Radin Company is a subsidiary of Hassin Group.
Hassin Group is a holding company with a collection of businesses that offer products in various digital fields, such as Myket (a digital store alternative to the App Store), Taaghche (a digital library similar to Kindle), and GooshiShop (a virtual mobile phone store).
Radin Company, a subsidiary of Hassin Group, offers banking software solutions that include identity verification. However, it is unclear whether this system utilizes facial recognition technologies for authentication or not
Behpardaz Jahan Company
Behpardaz Jahan is a company that was founded in 1995 by CEO Amirreza Jalili. It specializes in the production of systems for tracking and monitoring, database systems, and credit verification. On the company’s website, there is no mention of identity verification services in the descriptions of any of Behpardaz Jahan’s software or systems.
This company has subsidiaries that develop software and systems for major state-owned companies such as the Infrastructure Communication Company, the Information Technology Organization of Iran, and the IRIB (Islamic Republic of Iran Broadcasting). Among these systems is the “Border Resident System,” which aims to collect information about individuals residing in the border areas of Iran. The Electronic Single Window Trade Company (TAR) has developed it.
Among the subsidiaries of “Behpardakht”, the “Computer and Mechanized Methods” (CMS CO) operates in the field of producing tracking, inspection, and surveillance systems.
The company’s website is inaccessible, and the latest blog post dates back to February 2018. The last general assembly of this company was held in 2011, and no official activities have been registered under this company’s name. Based on the available data, it is not possible to determine what software this company has developed in the area of identity verification and facial recognition.
