Clearview AI FedRAMP bid could ease federal procurement of facial recognition

Clearview AI has begun a federal cloud security review that, if completed, could make its facial recognition platform easier for U.S. government agencies to procure and deploy across law enforcement, national security, and other government operations.

The company says its “Clearview GovCloud [[would be] delivered as a SaaS offering using a multi-tenant Government-Only Cloud computing environment … available to federal, state, local, and tribal governments to investigate crimes, enhance public safety, secure our communities, and provide justice to victims.”

It is a move that is likely to draw the attention of privacy and civil rights advocacy groups.

Clearview’s use by federal agencies has been controversial because it allows immigration and law enforcement personnel to search photographs against a vast faceprint database Clearview AI has built by scraping images from websites and social media, generally without the knowledge or consent of the people depicted.

Immigration and Customs Enforcement has used the system in criminal investigations, while Customs and Border Protection has obtained access for “tactical targeting” and counter-network analysis.

Critics argue that the technology can expand immigration and police surveillance, expose people to erroneous matches, and operate with limited public transparency or clear safeguards.

Clearview maintains that its results are investigative leads that should be corroborated with other evidence.

A FedRAMP sign-off “will add a further layer of independent validation for federal procurement officers, chief information officers, and chief information security officers evaluating the platform for sensitive government use cases,” the company said.

The practical significance of the move is not that Clearview has won blanket federal approval, it has not. But a completed FedRAMP certification would give government agencies a standardized, reusable package documenting the security of Clearview, allowing them to build from an established federal assessment rather than independently reconstruct from scratch a cloud security review.

FedRAMP provides a standardized approach to security assessment, certification, and continuous monitoring for cloud computing products and services.

GovCloud is a specialized cloud computing environment designed to meet the strict security, compliance, and regulatory mandates of government agencies and their contractors.

Clearview announced Wednesday that GovCloud had received an “In Process” designation at the former High impact level. The FedRAMP Marketplace lists the product as “Agency Auth in Process,” under the Rev. 5 path and Class D, the new label for the former High baseline. The listing shows no completed authorizations or reuses.

“In Process” means Clearview is pursuing authorization with a sponsoring federal agency through the FedRAMP Rev. 5 Agency Authorization Path, the traditional, document-heavy process where a Cloud Service Provider partners directly with a federal agency sponsor to achieve a FedRAMP certification.

Neither the company’s announcement nor the public Marketplace listing identifies the sponsoring federal agency.

Grounded in the updated NIST SP 800-53 Rev. 5 security controls, this path is centered around narrative-heavy paperwork and strict point-in-time assessments.

Clearview says the designation positions it “to serve federal law enforcement, national security, and defense agencies that require the highest levels of cloud security assurance.”

“Federal agencies operate in environments where the stakes are as high as they get, and the security standards they require reflect that,” said Clearview AI CEO Amos Kyler. “Achieving FedRAMP High ‘In Process’ status is a direct reflection of the investments we have made in the controls, governance, and infrastructure that mission-critical government work demands.”

Clearview’s projected first quarter 2027 FedRAMP certification completion date is the company’s estimate, not a government commitment.

Under the agency path, an initial federal agency must authorize the service before it can become a completed FedRAMP offering. The process is the modified legacy pathway that FedRAMP still permits for Rev. 5 services, even as the program shifts toward newer certification models.

For Clearview, a successful certification could remove a major procurement and deployment obstacle.

A prospective agency would still need to decide whether Clearview fits its mission, complete its own authorization-to-operate process, negotiate a contract, and comply with applicable privacy, civil liberties, records management and law enforcement rules.

But, it could rely on an existing federal security package rather than begin with no common assessment foundation.

The High label also needs qualification. FedRAMP now calls it Class D, and the classification describes the depth and complexity of the security assessment package.

It does not mean FedRAMP has found Clearview’s face search system accurate, lawful, unbiased, appropriate for a particular investigation, or compliant with every privacy requirement.

FedRAMP itself says certification is not a guarantee that a service is appropriate for an agency’s specific use.

The prospective certification would therefore matter most as a route toward broader federal adoption. It would make Clearview’s cloud security documentation more portable within government, potentially reducing one of the administrative barriers that can slow a facial recognition purchase.

It would not, however, settle the larger questions surrounding the company’s database, its use of publicly collected images, or the circumstances in which federal agencies should be permitted to search faces at all. Those questions remain outside FedRAMP’s security review mandate.

Article Topics

biometrics  |  cloud services  |  facial recognition  |  procurement  |  U.S. Government