Worried about Digital Evidence Tampering? 292
2marcus writes "As digital technology continues to improve and is used in more and more applications, the ease of tampering with digital files becomes more pertinent. This is especially important in the field of criminal justice, where even the appearance of possible impropriety can sway a jury. CNN has an article on the issues with digital photos being used for fingerprints and other forensics evidence."
Another CNN link... (Score:1, Interesting)
Be careful if you take (digital) pictures (Score:5, Interesting)
Unfortunately, when we went to move in, the place was trashed and grossly out of code for the city/county. In an effort to be released from the lease, I took a bunch of photographs of everything that was wrong with the house, but I took them on my digital camera. I even brought my camera to a developer and had the photos professionally developed.
Nevertheless, I brought my pictures to a lawyer (school-subsidized, provided for student lessor/lessee problems) and he said that if I wanted to use them in any practical way, I had to go take the pictures again with a real camera (and you could _barely_ tell it was digital).
Fortunately, we had enough evidence that the landlord caved (and we all learned many valuable lessons about leasing, and the law in that time period).
Who needs evidence? (Score:4, Interesting)
logs (Score:2, Interesting)
Myren
Wrong (Score:5, Interesting)
Bullshit.
This should matter a lot.
Mark Furman's bigotry was enough to create the appearance of "reasonable" doubt as to the veracity of the DNA evidence that unequivocably linked O.J. Simpson to the murder of his ex wife and her friend. Nevermind that the evidence was almost certainly NOT tainted or modified
Digital evidence is as fleeting as the wind. I can copy a file to your hard drive, make a phone call, and the assumption will be you're guilty. Or a cop could walk in with a CD, do the same thing, and convict you.
Gnupg and similiar encryption tools, combined with date and time stamping (perhaps even authenticated date and time stamping via ntp servers) could be deployed relatively simply and make data tampering virtually impossible (e-mails are certain to be real, and have been created on such-and-such a date, etc).
Similiar schemes might be applicable to preserving the integrity of digital imagry, video, etc., and it is very important that these issues be addressed.
We know that the police and the FBI do tamper with evidence. We know that they bear false witness in court
Law enforcement will tamper evidence on occasion, and making it easier for them to do so virtually insures that it will be tampered more often. In order to maintain (or even improve) the integrity of our justice system, we need to make modifying digital evidence as difficult (or impossible) as is possible, and we have numerous tools already to do so.
Dismissing this issue is foolish
Not a worry.. (Score:5, Interesting)
There's always an auditable chain of custody with all eveidence, digitally the product i use accomplishes it with encryptions and checksums. If an officer takes a pic out to alter it (they have to crop/lighten/darken mugshots so they look consistent for use in a lineup), his actions are logged, and a copy of the original is always kept. Just like checking stuff in and out of any CVS.
There are some digicams out there specially designed for the task which create special checksums and hashes to prove, mathematically that the image on a disk is the same one the camera took.
This is all tied to the officer who took the picture and entered it into the system, and ultimately would be held accountable for it.
If needed, I could be called on to swear an affidavid that the file hadn't been altered since taken/entered.
Now, for the most part, the agencies I've dealt with only use digital imagine for mugshots, and a few take digital shots of traffic accidents. But more and more are expanding the use of technology. 911 calls, and police radio chatter, being encoded to mp3 and permanently attached to the case file, stills from dashboard cameras, crime scene photos.
Frankly, you can prove mathematically with some simple tech these days that not even a single pixel in a digital photograph had been altered. It'd much easier to fake an old-fashioned analog photograph.
Of course, sleazy lawyers will wow clueless jury members with how easy it is to change things in photoshop, which they'll understand. And those jury members will be asleep when the mathemetician demonstrates that there's only a 1 in 400 kajillion chance of altering time image without changing the checksums...
Digital sound evicence (Score:2, Interesting)
Public Key Encryption (Score:3, Interesting)
How ironic... (Score:5, Interesting)
that CNN is publishing this story; back in the late 1990s, they stole a frame from one of my computer generated animations of a pulsating star, and put it in a story [cnn.com] on their website. They tweaked the colourmap a little, but apart from that the image is identical to my original animations [ucl.ac.uk].
They even had the gall to claim the copyright for themselves. Bastards.
veripic (Score:3, Interesting)
http://www.veripic.com/certified [veripic.com]
My guess on how they do it would be by checking how the image was encoded? any ideas?
four words (Score:5, Interesting)
(referring to the parent post, not the grandparent): b b witch hunt.
ok, so the FBI raids someone's PC on suspicion of kiddie porn. Now, the PC has been out of the hands of the suspect. What's to stop the FBI from planting kiddie porn on the hard drive? And will it, in the end, even be neccessary to find porn on the hard drive? Links might be enough (links that might have resulted from IE's insecurities, for example?)I truly despise child pornographers, but are we heading for a police state in the name of anti-terrorism and anti-kiddie porn?
Maybe DRM actually makes sense in this context. I would rather be unable to get porn at all than be prosecuted for planted porn. (the OS could be programmed to reject any files that have porno-like meta-data in their headers, or however DRM works). Granted, this solution would keep all porn (including "legal" porn) out, but it would solve the problem.
Re:logs (Score:1, Interesting)
I once knew of an institution that had their own postal meter. Each day, they'd stamp a few unsealed envelopes and set them aside. If somebody had missed a deadline by a day or two, they'd get one of the pre-dated envelopes to send their submission. Unused stamped envelopes would be used up if they got more than a week or so old. So a postmark doesn't really prove much unless it's a true stamp with a post office applied cancellation.
Re:veripic (Score:3, Interesting)
An altered photograph will often be mathematically inconsistent. Real photos are formed by light sources reflecting and refracting off objects. Mess with it, and you create regions that have inconsistent lighting. Furthermore, Photoshop (or Gimp) tools have specific mathematical properties which can be detected; for example, if you use the Clone tool, there will be little circles of pixels that are highly correlated (not exactly because of the fuzzy edge of the brush). So, with an autocorrelation approach you can find, say, that a model's zit was painted out by cloning from another part of her face, and find exactly what part.
I do not know that Veripic works this way, but I do know that forensic experts looking for altered digital pictures work this way.
Re:Only solution (Score:2, Interesting)
I seem to recall a case where this issue came up. The guy had a bunch of drawings and computer generated kiddie porn, and he was convicted and upheld on appeal. Even though his lawyer was able to prove there were no "actual" children harmed, he was convicted on something like "attempted child endangerment". I wish I could recall he details.
Just because they CAN... (Score:3, Interesting)
If you asked the average juror what the signs of digital photo tamering are, they be baffled to answer. The bottom line is that this will be used by defense lawyers to plant the seed of doubt in otherwise ignorant minds (concerning digital media.)
Just because it is (perhaps) easier to tamper with pixels than crystals on substrate, doesn't mean it's going to happen more often. Better yet, if people don't understand that digital evidence is subject, but not PRONE, to tampering this myth will continue to perpetuate.
Maybe I'm wrong with my conclusion that it is not more likely, but it certainly isn't a new issue. In fact, I worries me that it's brought up in the context of a new issue because that just perpetuates a legacy of ignorance... and if you read the article you will find out that the issue is MUCH more a case of poor evidence. If the only evidence a prosecutor has is a previously unidentifyable fingerprint, and suddenly they can identify it, you're going to get skepticism. Furthermor, if that's the only evidence they had on the guy then there's no way you can prosecute on inconclusive evidence.
The professor was able to reproduce the visual effect that occured when the scientific software processed the finger print. I hate to say it, but SO WHAT? I happen to be an experienced photoshop guy, and artist, but just because I can reproduce what I see, doesn't mean the scientific process involved is invalid. I'm concerned about this kind of defense approach, because it involves voodoo...
I'd propose that a series of laws clearly define what is digitally permissable based on established algorthms. If a new one is created, it must pass through a panel of reviewers and eventually be passed into law before it can be permissable. In this way, there would be far less "reinvention of doubt" every time a digital photograph is brought into a court room that has a couple filters run on it.
It would probably involve a series of check and balances at each stage of processing, too.
Re:Only solution (Score:5, Interesting)
Re:four words (Score:3, Interesting)
This is so obviously a troll, I'm tempted not to respond, but in case anyone takes this seriously, I'll pose the following obvious question. If someone were making kiddie porn for the purpose of selling or distributing it, why would they include metadata tags which would render the images unviewable on anyone's PC? So, we have yet another good reason for DRM: Think of the children!
Re:logs (Score:3, Interesting)
Each camera would contain a tamperproof digital signature chip and a tamperproof clock.
This seems a long ways away from being credible, because it does not take more than a few seconds to think of how to get around it. It is so easy to take a picture of another high-res picture that has been digitally created or modified. Of course, this could be done with a film-based camera, as well. Look all the UFOs people have on film with no digital photography required. Many years ago I knew a photo lab technician for a law firm that loved to dial in the magenta to make injuries look positively gruesome for juries.
If the signing camera were permanently locked in a fixed place (like a police evidence room) with surveilance cameras that observed the photo shoot, and the camera took sequentially-numbered signed pictures, it would be a bit harder to falsify -- but it still seems like it might be like current digital voting -- more prone to undetectable error and fraud than existing technology. Adding secure GPS might help you slightly out of doors (I know of no other good way of securing the timestamp, either).
When you get the negative of a film picture, it is usually between other pictures on a roll that to some extent establish a real time sequence greater than a single picture. Even this seems like better than time stamping.
Re:This shouldn't change anything (Score:1, Interesting)
"Sure, it's a little easier, but it's not something we suddenly can do that we weren't able to do previously. "
It's not only easier, but with a little work, you can get much more convincing results than with old analog techniques. Each year, the tools only get better. Sure, in the hands of an idiot, even the best tools will create crap, but someone with a bit of skill can create something with very little artifacts. In some cases, photographers have been accused of cooking their pictures because their images are too perfect.
Ignorance is bliss (Score:2, Interesting)
I'm sure we all see/hear about this stuff while people close to us are complaining about their jobs. If we could only reduce screw ups by 5%, I imagine the world economy would take off.
Re:Only solution (Score:3, Interesting)
Sadly, 'experts' proved that the moon landing was faked, too. Shadows cannot be easily disproven because of things that are happening off-camera.
The best you can do is detect use of a filter algorithm. Gaussian blur, for example, should be easy to detect. Clone tool? You betcha. It could take a bit, but images are inherently noisy. If the noise in the image has repeatable patterns, then use of the clone tool can be detected. Most digital images are sharpened by the camera. Changes that aren't sharpened can be detected.
I could probably think of more ways to detect digital fraud, but I think I've satisfactorally made my point. The fact of the matter is that we are not close enough to making changes undetectable. Just because the tools to make the changes get fancier does not mean that the tools to detect that fanciness just sit there and don't evolve.
Of course... (Score:3, Interesting)
Unless you want the camera to digitally sign them as well. Might work, if you have the secret key in a WOM not directly readable (i.e. you may sign the MD5 and verify the signature, but not read the actual key).
Kjella
Re:Only solution (Score:4, Interesting)
There are quite a lot of issues with kiddie porn prosecution.
So I read about this article saying they got person X on kiddie porn charges, and yet I wonder how much of that is real kiddie porn, as opposed to
*photoshopped kiddie porn
*18 and over porn, but with really young looking girls
the latter is of interest to me, there's a lot of really young looking girls used in porn, and I assume that the photographer and webmasters have done their duty to make sure the person is 18. However, those credentials don't pass over the net to the photo sitting on the hard drive, how does law enforcement know or not know if the girl really is over 18, though she could pass for 14?
As for the former, the idea of photoshopped kiddie porn is that it's kiddie porn without, hyptohetically speaking, having hurt a chlid in the process. Should that be illegal in that a person who consumed photoshopped kiddie porn is very likely to commit such an act? That's an ugly precedent.
Of course, this doesn't even touch the surface of what the difference is between kiddie porn and children who happen not to have any clothes on. Apparently the standard is some sorta fuzzy concept of one type of pic was taken specifically for the purpose of getting off, and the other was not.
Really odd case from Australia: a guy there makes videos of himself getting kicked in the jewels--that's the sexual fetish. He made one of a 14 year old kicking him, and was brought in on kiddie porn charges (though the girl was completely clothed.) The idea here is that a girl was being used for sexual satisfaction, though, under normal circumstances, it hardly is a sexual situation. (Dunno what happened to the case.)
Honestly, this is a mine field of questions that no one wants to talk about or answer.