Internal Competitive Landscape — RFI-15434

🔒 INTERNAL ONLY — NOT FOR LODGEMENT. This page is strategic intelligence to inform Anuna’s positioning of the RFI-15434 response. It must not be transcribed into Part 3, Part 3a, Part 4, Part 4a, the FOCI form, or the cover letter. Federal procurement responses do not include competitor analysis; reading as if we are attacking other vendors would damage credibility. This page exists only to inform internal sharpening of the affirmative case.

Likely respondent pool

The RFI explicitly invites responses across three streams — liveness detection, biometric matching, NFC ePassport verification. A vendor needs strength in one stream to respond. The realistic respondent pool:

Tier 1 — Closest functional matches / probable incumbent

Tier 1 — Heavy-iron globals

Tier 2 — Identity-verification platforms (adjacent)

Tier 2 — Australian players

Australian Government will weight Australian-domiciled providers favourably.

Tier 3 — Hyperscalers

Tier 4 — ZK / privacy-preserving identity

This is where SABLE’s competitive set is genuinely thin:

• WorldCoin / Tools for Humanity — iris + ZK, dependent on proprietary Orb hardware, politically toxic; would not respond
• Privado ID / Polygon ID — ZK identity, credential-focused, not biometric
• Anon Aadhaar, zkPass, Galxe — ZK credential proofs, no biometric
• Academic projects at MIT / ETH Zurich — not commercially deliverable

SABLE is genuinely close to a category-of-one in the intersection of (true ZK biometric proofs) × (open source) × (no special hardware) × (production-ready library) × (Australian-developed). Most reviewers will not have seen this combination before.

Competitive position by axis

Where SABLE can credibly win

Three evaluator hot buttons where SABLE has a defensible distinctive position:

1. Privacy-conservative reviewers (Privacy Commissioner, OAIC, ATO privacy team, parliamentary scrutiny). Argument: “every other respondent transmits biometric data to a vendor system; SABLE doesn’t. The Optus / Medibank / Latitude / Suprema breach class is structurally impossible for us.”
2. Sovereignty-conservative reviewers (concerned about foreign-vendor dependence, especially post-AFP-FRT-NEC controversy, post-Optus). Argument: “Australian-developed, open-source, no foreign-vendor lock-in, source-escrow obviated.”
3. Future-fit / strategic reviewers (thinking about 5-10 years of Digital ID Act evolution, BBS+ Verifiable Credentials, post-quantum migration). Argument: “forward-fit to where the Act is heading; not a retrofit.”

Where SABLE will almost certainly lose

1. Pure technical compliance evaluation focused on existing certifications. If evaluation is checklist-driven, we score 42/55 Compliant + 13 Partially while incumbents score 50+/55 fully Compliant.
2. Scale / track record evaluation. Incumbents have multi-million-user SABLE-equivalent deployments today. Anuna has BARMM (eGov delivery, no SABLE yet) going live in 2 months as a delivery-capability proof, and early international dialogue with Germany’s BSI on the SABLE approach.
3. MAUI-specific evaluation. Microsoft Entra will be very hard to beat on this axis.

Sharpening recommendations (for the affirmative case — without naming competitors)

These should sharpen what is already in the response. None of these add competitor names.

#1 — Promote architectural-retirement argument to cover letter

The breach-evidence paragraph in ato-myid-context.md is currently strategic-internal. The most decisive single sentence — “any system that aggregates biometric data into a central store creates a structural risk class; SABLE retires the target class by design” — should appear in the cover letter as the closing of pillar 1 (Privacy by construction). This directly contrasts SABLE’s architecture with every other respondent’s architecture without naming any of them.

#2 — Concrete scoped PoC offer in cover letter

The PoC offer is currently distributed across compliance-summary.md and the IN-5 / VISM-6 / OP-10 row text. Worth a discrete paragraph in the cover letter: “We propose a paid 8-week Proof-of-Concept against the ATO’s existing myID IP3 test cohort, evaluating PAD performance against a curated attack corpus, FMR/FNMR against a representative diverse Australian sample, end-to-end UX of the spatial-flash flow, PrivateLink integration latency to existing FVS/DVS infrastructure, and operational soak at 10× current peak load. This is the most decisive evidence either party can generate inside the RFI’s stated question.” This positions SABLE to break a deadlock with incumbents who lead on certifications: against actual ATO data, the architectural advantages start to count.

#3 — Sovereignty narrative made explicit

Currently implicit. One direct sentence in the cover letter or Part 3 Section 3: “SABLE is Australian-developed open-source IP. No foreign-vendor licensing dependency, no foreign-IP escrow risk, no foreign-commercial-entity in the SABLE delivery chain between the ATO and the cryptographic primitives.”

#4 — Architectural advantages not retrievable by incumbents

The most strategic counter-positioning argument. Incumbents can build remediation programmes to close certification gaps; they cannot rebuild their architecture mid-contract. Worth one sentence in cover letter or compliance summary: “The certification gaps SABLE acknowledges (ISO/IEC 30107-3, IRAP PROTECTED, ISO/IEC TS 19795-9) are time-bounded remediation work. The architectural advantages SABLE offers (biometric data on-device, ZK proof traversal, open-source auditability, selective disclosure) are not retrievable by competitors inside any procurement timeline. The relevant question for the ATO is therefore which set of properties is more strategically valuable to acquire.” — this argument is the cleanest way to invite an evaluator to weigh “certified incumbent vs architecturally distinctive newcomer” in our favour.

What NOT to do

• ❌ Don’t name competitors in the response. Federal procurement responses don’t include competitor analysis.
• ❌ Don’t claim “we are better than X”. Claim instead “we have property X that solves problem Y”. Let the evaluator do the comparison.
• ❌ Don’t speculate publicly about who has the 2021 contract. Unprofessional and we don’t actually know.
• ❌ Don’t underprice to undercut incumbents. Anuna can’t run a heroic loss-leading bid. Win on architectural distinctiveness; price on value.
• ❌ Don’t push “category of one” claims harder than “first open-source library to combine X”. That line is defensible; stronger claims become risky.

Questions for Hugo before lodgement

1. Who do we think holds the 2021 myID liveness contract? Hugo may know via industry contacts; informs how aggressively we counter-position.
2. Which respondents has Hugo specifically talked to about partnering? Could affect whether we mention partnership availability anywhere (currently we say none in place).
3. Is there a strategic incumbent vendor we should be open to subcontracting to? Sometimes the right play is to be the “ZK biometric component” inside a prime’s response, not a standalone respondent. Could mean different framing for a different prime relationship.
4. What’s the realistic post-RFI scenario? If Hugo thinks the ATO is genuinely scoping a new procurement (not just market intelligence to inform an incumbent renewal), the PoC offer should be more aggressive.
5. DFAT / DTA touchpoints. If Anuna has any actual conversations with DFAT or the DTA about regional Pacific digital identity, the regional-spillover argument lands harder.

Linked notes

• opportunity-overview — the RFI itself
• sable-fit — per-requirement capability mapping
• ato-myid-context — strategic framing (privacy, breach-class, social licence, regional spillover)
• gaps-and-risks — honest gap disclosure
• evaluation-criteria — source requirements