TL;DR:
- A joint investigation traced Iran's acquisition of NtechLab's FindFace technology to a 2019 agreement.[1]
- Contracts connected the system to companies serving Iranian security agencies, along with deployments in transit systems and universities.[1]
- A researcher assessed that the system was likely operational during the January 2026 crackdown. The investigation did not present direct operational records proving individual arrests came from FindFace matches.[1]
How the Technology Reached Iran
In August 2019, Russian developer NtechLab granted Rasad Intelligent Technologies, also called Rasadco, rights to use FindFace as a systems-integration partner. Kama took over after a 2021 merger.[1]
The investigation connected Kama's leadership to the Islamic Revolutionary Guard Corps. Other companies in the contract chain had provided technology to Iran's Ministry of Defense, Ministry of Intelligence, and the IRGC.[1]
The Insider reported that contracts dated from 2020 through 2022 and that some transactions ran through companies investigators described as shells. The customers included entities linked to the IRGC and Intelligence Ministry, Sharif University, and Mashhad authorities.[2]
What FindFace Could Do
Forbidden Stories reported that FindFace could search a database of 500 million faces in less than a second with a claimed 98% probability of identification. One Iranian license covered searches against 100 million faces, while another contract referred to 200 cameras and a database of 300 million events.[1]
The system could analyze age, gender, masks, glasses, and other attributes. It could also build relationship maps linking a person to friends and relatives.[1]
Reported deployments included Mashhad's subway and an entrance at Amirkabir University of Technology. The broader network could combine public cameras with government identity photos and online images.[1][3]
The January 2026 Crackdown
Protests that began in late December 2025 spread in January 2026. Forbidden Stories reported that more than 30,000 people were killed over January 8 and 9. Nima Fatemi, an Iranian cybersecurity researcher, assessed that FindFace was operational during that period, while noting that on-the-ground verification was not possible.[1]
That distinction matters. The investigation documents the surveillance network and a researcher's assessment of its use. It does not show a list of people identified, detained, or killed because of a specific FindFace match.
Sanctions Came After Deployment
The European Union sanctioned NtechLab in 2023 for its role in surveillance tied to human-rights abuses in Russia. The United States blacklisted the company in December 2024. Those measures came years after the 2019 Iran agreement.[1]
By then, Iranian customers had access to a system designed for fast identification across large camera networks. The public record shows the infrastructure. It also shows why claims about individual victims must be stated with care.
Sources
Published: March 5, 2026