British Transport Police have begun deploying live facial recognition in the London Underground, starting at Victoria station and planning to rotate the technology across other Underground and Network Rail stations through November 2026. The system scans faces in real time and compares them against a police watchlist using NEC’s NeoFace M40 algorithm, with officers required to review any match before action is taken. The move extends a trial launched earlier at London Bridge and aligns with broader facial recognition expansion across London policing.
The rollout has drawn scrutiny from civil liberties advocates over accuracy, oversight, and data handling. Critics have pointed to previous wrongful detentions and concerns that false positives may disproportionately affect ethnic minorities, while questions remain over public transparency and how long images are retained. The deployment marks a significant increase in biometric surveillance across one of the UK’s busiest public transport networks.

Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The British Transport Police's live facial recognition trial started at London Bridge station. This earlier trial preceded the wider rollout into the London Underground network.
British Transport Police expanded its live facial recognition program into the London Underground, beginning at Victoria Underground station. The system performs real-time scans against a police watchlist and requires human review before action is taken on a match.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.