by Michael Hollister
Exclusive published at Michael Hollister on August 07, 2026
2.081 words * about 9 minutes readingtime
Part 1 read here:
Five Good Purposes – and Three Documented Contradictions
Understand what lies behind the headlines.
My grandmother had a saying for people who make a lot of promises: Don’t listen to what they say; watch what they do. Applied to European security policy, that saying produces a finding that can be summed up in a single line. The EU publicly bans biometric mass surveillance – and at the same time funds research into it at the border, where the ban does not apply by definition.
Part 1 of this series showed how five separate measures – in-car cameras, data retention, chat control, digital identity, and financial registers – can be combined into an almost complete personal profile. Each one, taken on its own, serves a legitimate purpose. Only the sum reveals the picture. This briefing shows the sixth layer: not what is being introduced by law, but what is being developed with public funding. It does not concern suspects, but anyone who drives a new car and crosses a border. The difference from the Deep Dive is the angle: there, the focus is on the convergence of the layers; here, on a single, stark contradiction – between what the EU publicly bans and what it quietly funds. Four breaks, each independently documentable, each drawn from the EU’s own records.
Break One: The Camera That Must Not Identify You
Since July 7, 2026, every newly registered passenger car in the EU has been required to carry an infrared camera inside the vehicle. Its purpose is to detect whether the driver is distracted. The regulation is unequivocal: no biometric identification, no image storage, and the data are to remain inside the vehicle. That is the promise. In the summer of 2026, Belgian broadcaster VRT asked manufacturers how they handle the data. Volvo processes the data on external servers. Mercedes uses image and sensor data from customer vehicles for training purposes. Renault shares data with partners. The promise and the practice are already at odds, as confirmed by the manufacturers themselves.
And this is where the second part of the story begins. Through its Horizon Europe research program, the same EU is funding a project whose stated objective is precisely what the in-car camera is not supposed to do: use in-car biometrics to identify people. The project is called AutoBorder, and the EU contribution is €2,999,905. It integrates biometric recognition into the car’s control electronics and, according to the project description, is intended to provide “identity monitoring” and predictive analytics for threat detection – identity monitoring inside a moving vehicle. The largest industrial share goes to IDEMIA, the global market leader in biometrics; the consortium also includes an automaker and the operator of the Channel Tunnel. Testing is planned at two real-world borders, between the United Kingdom and France and between Moldova and Romania. The end users are the border and interior authorities of those countries – including the British Home Office and the border police of Moldova and Romania.
The same project description that announces the data collection immediately provides the reassurance. The testing, it says, will be “not connected to actual border systems,” and everything will comply with data-protection rules and the AI Act under the supervision of a dedicated ethics partner. It is the same grammar that accompanied the camera in Part 1: reassurance on one side, funding reality on the other. And AutoBorder is not a beginning but a continuation – it explicitly builds on earlier EU projects.
One misunderstanding has to be cleared up, or the entire finding falls apart. The road-safety camera and the border project are not the same device. One is about vehicle safety; the other is border research. What connects them is the logic and the circle of actors: a camera inside the car, biometric-capable data, and the same rhetoric of reassurance. AutoBorder itself calls this a dual use – the same sensor technology that protects the driver also checks who the driver is. The difference lies solely in the stated purpose. And that purpose can change without a single cable being rerouted. The regulation says “must not.” It does not say “cannot.”
Break Two: The Ban That Stops at the Border
The EU AI Act is widely regarded as the world’s strictest regulatory framework for artificial intelligence. Article 5 prohibits real-time remote biometric identification in publicly accessible spaces – facial recognition in a crowd, the automated matching of passersby against databases. The headline practically wrote itself: Europe bans biometric mass surveillance.
The ban comes with a condition, and that condition contains the fracture line. It applies only in a “publicly accessible space.” The regulation defines this as any place open to an indeterminate number of people – streets, squares, train stations, airports. And Recital 19 narrows that definition in the same breath: “Publicly accessible spaces should not include prisons or border control.” Where a space is, by definition, not publicly accessible, the ban does not apply. Real-time biometric identification at the border is therefore not prohibited. It simply falls outside the provision that prohibits it. The regulation’s strongest safeguard thus ends precisely where the densest data collection begins – at the crossing point used by millions of people every year.
The same recital expressly gives “a certain age” as an example of a condition of access – the same logic as the age-verification app from Part 1. The regulation already thinks about identity, age, and access as interconnected. And elsewhere it actively moves in the other direction: it expressly preserves the authority of border, immigration, and asylum authorities to conduct identity checks in the physical presence of the person concerned. This is not a fringe interpretation. The human-rights organization Collective Aid argues that the exemption allows the “unregulated use of AI in border zones”; the civil-liberties group EDRi reads the text in the same way. In fairness, the counterargument belongs in the record as well: border AI remains regulated as “high risk” and is subject to documentation and oversight requirements. But the sharpest part – the outright ban – ends at the border. And oversight requirements can be fulfilled without any ban ever taking effect.
Break Three: Not an Isolated Project, but a Funding Line
AutoBorder does not stand alone. It is the newest link in a chain. The CarMen project develops “biometric solutions for continuous border control,” uses fixed and body-worn cameras, captures faces through the windows of moving cars and, according to its description, detects “anomalous travel behavior.” PopEye identifies travelers while they are moving, without requiring them to stop. ODYSSEUS is developing a “virtual passport” and, in a trial at the Romanian-Moldovan border, used a drone to biometrically match the occupants of a moving vehicle.
One project closes the loop back to Part 1. OnMoveID, coordinated by the University of Ljubljana and receiving €5.7 million from the EU, identifies travelers as they pass through in roughly 20 seconds – and is explicitly linked to the EU Digital Identity Wallet, the same digital identity marketed as a convenience tool for dealing with public authorities and proving age. The same wallet, a different purpose: identification for biometric capture while walking past. The process is described clearly: one-time registration through the wallet, after which a smartphone is enough to enable recognition on the move – using ultrasound and a multispectral camera. The layers from Part 1 are not separate. In the funding programs, they are already being designed together.
The line reaches back almost 2 decades – from ABC4EU, which laid building blocks for today’s Entry/Exit System, through EINSTEIN and SafeTravellers to the current projects. The research organization AlgorithmWatch, which mapped this chain, puts EU funding for “biometrics on the move” at hundreds of millions of euros over nearly 2 decades. That figure applies to the cluster as a whole, not to any single project – and that is precisely what gives it weight. The same names repeatedly appear in shifting consortia; AutoBorder, for example, is coordinated by the same research center as its predecessor project EINSTEIN, while companies such as IDEMIA participate in several of these projects. And the present shows that this does not stop at research: since October 12, 2025, the EU’s Entry/Exit System has been collecting fingerprints and facial images from every third-country national at the external borders. Implementation is still stumbling, with queues and systems temporarily suspended – and at the UK-French corridor, the very test environment for AutoBorder, data collection was still being carried out manually in July 2026. That is exactly the gap the funding is designed to close. It promises the seamless technology the deployed system does not yet deliver. This is not a one-off injection of startup funding. It is a line.
Break Four: Immature, Says Frontex Itself – and You Are Not Allowed to Check
The official rationale is real, and it is not without force. According to the World Economic Forum, travel volumes will increase by half by 2030; waiting times are supposed to fall while security is maintained. The industry markets this as convenience – biometrics company Paravision describes the border as “no longer a stop,” but merely a moment of movement, with verification happening invisibly. All of the projects invoke “privacy by design.” If the goal is to speed up controls without reducing security, automation becomes almost inevitable. That is the honest core of the argument.
Against that vision stands an unexpected key witness: the EU agency responsible for the field itself. Frontex commissioned a technology-foresight report and published it in 2022. Its Technology Foresight on Biometrics for the Future of Travel classifies core techniques for biometrics on the move – gait recognition and the periocular region, both central to projects such as CarMen – as immature. The agency expected to use this technology itself considers it not yet mature. An independent technology roadmap from the same year reaches the same conclusion: operational maturity is still 6 to 15 years away, and the technology has not yet been tested under real-world conditions. An EU-funded project called PROTECT had already concluded in 2018 that multimodal biometrics were “very unlikely” to be legally integrated into passports. The vision rests on a narrow scientific foundation. Migration lawyer Caterina Bove of the Italian network ASGI calls the state of the technology an “embryonic stage”; former Statewatch director Chris Jones speaks of “techno-solutionist fantasies.” Both point to the same problem of scale: with millions of border crossings, even a low error rate adds up to thousands of false matches – and automated control risks normalizing, rather than ending, the sorting of people by appearance.
Anyone who tries to check for themselves runs into a wall. The EU project iBorderCtrl, an AI “video lie detector” tested in Hungary, Greece, and Lithuania, ultimately took lawyer Patrick Breyer to court. The General Court judgment of December 15, 2021, in Case T-158/19, Breyer v REA established that the EU research agency may keep precisely the documents concerning error rates, discrimination risks, and legality under wraps as commercial secrets. The technology is funded with public money – while its weaknesses are protected as business secrets from the public that pays for it.
Bottom Line
Four contradictions, four times the same grammar. The camera is not supposed to identify – the funded technology is supposed to do exactly that. The ban applies everywhere – except at the border. It is supposedly all research – yet the system is already running. The technology is said to be safe – the EU’s own agency calls it immature, while the court allows scrutiny to stop at the boundary of commercial secrecy.
The numbers are not secret. AutoBorder receives €2,999,905, OnMoveID €5.7 million, and the cluster as a whole has received hundreds of millions over 2 decades. Not a cent of that is hidden. What remains hidden is what these capabilities will ultimately make possible – and whether the assurances attached to each individual project will still apply once they do.
None of these contradictions is merely an assertion. Each can be found in an EU document itself – in the regulation, in the project database, in the foresight report, in the judgment. What is being funded is a capability. Whether those capabilities are one day brought together will not be decided by the technology, but by those who write the laws – and laws change faster than hardware. The intent remains open. The finding does not.
The contradiction between what is promised and what is funded is not an accidental one. It can be read in the texts themselves, paragraph by paragraph, grant number by grant number. My grandmother would not have said a word about intentions. She would simply have said: Don’t listen to what they say; watch what they do.
The full analysis – including the complete project chain and the companies behind it, the iBorderCtrl case and Breyer’s lawsuit in full, and the question of who profits from the funded border – read on here:
If you value independent analysis on geopolitics, international relations, and global affairs, consider supporting this publication. Your contribution helps keep this Webpage open and accessible to everyone.
About the Author
Michael Hollister is a geopolitical analyst and investigative journalist. He served six years in the German military, including peacekeeping deployments in the Balkans (SFOR, KFOR), followed by 14 years in IT security management. His analysis draws on primary sources to examine European militarization, Western intervention policy, and shifting power dynamics across Asia. A particular focus of his work lies in Southeast Asia, where he investigates strategic dependencies, spheres of influence, and security architectures. Hollister combines operational insider perspective with uncompromising systemic critique – beyond opinion journalism. His work appears on his bilingual website (German/English) www.michael-hollister.com and in investigative outlets across the German-speaking world and the Anglosphere.
More context, fewer headlines – free by newsletter.
Sources
- EU AI Act, Regulation (EU) 2024/1689, Recital 19 (German version) – “Publicly accessible spaces should not include prisons or border control.” https://artificialintelligenceact.eu/de/recital/19/
- EU AI Act, Regulation (EU) 2024/1689 – Full text, Official Journal of the European Union: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=OJ:L_202401689
- Collective Aid – “The AI Act: Securing Borders, Not Rights”: https://www.collectiveaidngo.org/blog/2025/2/27/the-ai-act-securing-borders-not-rights
- Michael Hollister – “Five Layers, One Profile” (Part 1 of this series): https://www.michael-hollister.com/de/2026/07/12/fuenf-schichten-ein-profil-wie-die-eu-den-glaesernen-buerger-baut/
- AutoBorder – CORDIS, Grant Agreement ID 101225829: https://cordis.europa.eu/project/id/101225829
- CarMen – CORDIS, Grant Agreement ID 101168325: https://cordis.europa.eu/project/id/101168325
- OnMoveID – CORDIS, Grant Agreement ID 101225635: https://cordis.europa.eu/project/id/101225635
- AlgorithmWatch (Fabio Chiusi) – “The Seamless Surveillance Machine”: https://algorithmwatch.org/en/seamless-surveillance-machine-europes-biometric-border-vision/
- European Commission – Entry/Exit System (EES): https://home-affairs.ec.europa.eu/policies/schengen/smart-borders/entry-exit-system_en
- Frontex – “Technology Foresight on Biometrics for the Future of Travel” (2022): https://www.frontex.europa.eu/innovation/eu-research/news-and-events/frontex-publishes-technology-foresight-on-biometrics-for-the-future-of-travel-us6C6v
- General Court of the European Union – Judgment of December 15, 2021, T-158/19, Breyer v REA (iBorderCtrl): https://eur-lex.europa.eu/legal-content/DE/TXT/
Full source list and additional supporting material are available in the extended analysis article.
© Michael Hollister – All rights reserved. Redistribution, publication or reuse of this text requires express written permission from the author. For licensing inquiries, please contact the author via www.michael-hollister.com
