If you present an object, an image, or a story to a courtroom, you must be able to trust that it is accurate.
How then, do you trust an image – a digital photograph, a snapshot in time of an object, a person or a scene? Do you trust what the photographer says? Or do you check it? Do you attempt to identify any signs of manipulation that could cast doubt on the weight of the evidence?
In my 24 years of police service, I didn’t present evidence very often. In fact, most of my time in the witness box was as a patrol officer detailing arrests or searches. Even though I spent the last 12 years acquiring, analysing and producing visual evidence for the court, mainly from CCTV systems, I was only asked once to present that evidence.
I put this down to several factors but, in the main, I hope that it was because my evidence was trusted. Well documented and repeatable procedures, resulting in science based evidence, whether for presentation purposes or to prove comparative links between the unknown and the known.
And here we have the crux of the matter – trust. It’s relatively simple to ensure trust in an image produced by the police. Regardless of its source type, the police must follow procedures in the capture, storage, handling and processing of Digital Multimedia Evidence. To protect themselves, many organisations utilize specific devices and software that automate this digital chain of custody. However, the question still needs to be asked, “Can you trust what you see before you?”
One point that cannot be automated in this scenario is interpretation. This subject could be an article by itself, but it would be remiss of me not to mention it briefly. A single image is a single snapshot of time from a single perspective. It could portray one story or version of events. With an image forming part of a video, it is very easy to interpret it incorrectly if viewed out of context. As such, the correct interpretation of the image must be assured so that we can trust the story that it tells.
It would make sense then at this point, to attempt some categorisations. First, are images and videos obtained from the police, by the police. There is a clear, repeatable workflow from acquisition to the courtroom. The original videos, if that was where the still images were obtained, are available and the correct interpretation has been proved through analysis.
Next, are images and videos that were not initially captured by the police but have subsequently been obtained, managed and maybe enhanced before presentation? The most common examples are images obtained from private video surveillance systems. It is vital that the processing and interpretation of these are correct due to the thousands of different, unstandardized formats that are used by the security industry. The level of work required to authenticate images significantly increases when dealing with this category of part-public; part-police sourced images and videos.
Finally, in the last category are images and videos captured, obtained and produced by members of the public. You may have already deduced that the level of authentication must ratchet up again here. There are many reasons for the increase but they all relate to why the image is being used, or submitted as evidence, in the first place.
Processes for authentication
In the UK, submitting an image as evidence is a simple process. A witness statement must be signed stating that the evidence is true and that the individual will be liable to prosecution if they, “have wilfully stated in it anything which they know to be false, or do not believe to be true”.
So, any person can state that they took a picture, with their camera, at that time and place, and this is what it showed. They must then follow that up with the fact that the image correctly depicts the scene they witnessed.
It is easy for me to pull out my phone, hit the button, and save a snapshot of time onto my phone’s memory card. As I am fully conversant with the rules, regulations and best practices on digital images I can extract that image in an evidential manner ensuring no loss of evidence. Remember that digital images and videos contain far more data than what is visible. Meta-data, or data about the data, is vitally important, and incorrect acquisition can unknowingly alter this information.
Once an image has been extracted correctly, it can be preserved. The evidence not only tells a picture by what it shows but the meta-data can also be accessed and relied upon. Some of this may be the location data embedded within the file.
That digital file can then be used as evidence. I have stated not only that I was at a location and that I saw an event but that the image I took is a true representation of the scene that I witnessed. Most importantly though, is that the image can be authenticated and compared against the story that I tell.
How many members of the public are aware of the Digital Imaging Procedure? What about the guidance surrounding computer based information, which includes digital images and video? Not many I would guess. What about the person that is receiving that file? Perhaps the investigating officer. Are they aware of the importance of image authentication?
For example, with users unfamiliar with image handling and how changes can occur, it is common for them to use online services to store and manage images. If the image is stored and then downloaded before being submitted as evidence it will still look the same. However, the service will have affected the data associated with it.
As such, it is no longer an image that could be classed as, ‘camera original’. Other bits of meta-data may be removed, changed or added during the upload and download process depending on the service used. For example, Google Photos, iCloud, and Dropbox all do something different. Even when simply using Microsoft Windows, the risk is there that some data can be changed. At this point though, it still tells the same story. Although it has been changed, it’s possible to validate and understand those changes.
Let’s ramp things up another notch. After downloading from Google Photos, but before I submit as evidence, I utilize a photo editing package to open my image. I find another picture I recently took of a friend at a party and I digitally edit him into my image. This is then saved as a new image and I submit this as evidence.
In my statement, I tell the same story: I was at a party, I took a picture and this is the image. However, my image now tells the story I want it to. There are two issues at play here. The first is our natural reaction to believe what we are seeing. It’s how illusions work. We are told a story, we read a story, we are then offered an image to back up that story. We often miss the truth that is directly in front of us.
The second issue comes with the ease of image manipulation. Even smartphone apps can change faces at the click of a button. People are growing up within a world where image manipulation is a natural progression after taking a photo. It may be simply adjusting the lighting or the colour, which could be classed as a justifiable manipulation. But I could equally manipulate it maliciously to tell a story that is fabricated. We see this every day in the news and social media.
Is the Criminal Justice System naive to believe that fake images do not end up being displayed in court and presented as truth? Even if it is a rarity now, we need to think of the future. To start with, we must ask ourselves, “Can we rely on the image we see before us? Has it been authenticated?”
Many years ago, image authentication was quite a challenge. We were still in our digital youth and the forensic analysis of images to identify signs of manipulation was in its infancy.
Various strands started to emerge:
- Meta data analysis to identify and compare the hidden information in an image.
- Camera matching to link a specific device to an image.
- Compression analysis to identify capture type.
- Visual analysis to identify signs of manipulation.
Whatever the type of analysis, many of the tools were either based on proprietary computer scripts or required a PhD in advanced mathematics to understand the algorithms.
However, things have evolved since then. Why? Because the ability for non-experts to quickly validate the digital images being put in front of them is needed. In my own private work for police and the courts I make use of Amped Software’s Amped Authenticate tool to detect and interpret signs of manipulation. I’m a user, not an academic or scientist showing how with the right software and training, overcoming the challenges associated with image authentication is both technically and financially viable.
So, next time you have a digital image presented as evidence, ask yourself, “Can you trust this image? Has it been authenticated? Is there any reason why the person would benefit from producing a manipulated image?”
It’s now easy to conduct all the necessary analysis to identify inconsistencies and manipulation. You just need to be asking the right questions.
By David Spreadborough, Forensic Video Expert, Amped Software
David served as a UK Police Officer for 24 years, was the first analyst in Europe to be LEVA Certified and is still one of only four outside of North America. Forensic Video qualified. He was a Senior Police Officer within the UK Visual Forensic Unit and oversaw all major crime video investigations.
He is still a practicing forensic video analyst and has frequently been called as an expert witness to assist legal teams and law enforcement with on-going criminal investigations.