What is "official training?"

Years ago, sitting in LEVA's old class, Forensic Video Analysis and the Law, Grant Fredericks stood at the front of the class room and delivered a module on the use of Photoshop to a room full of civil servants. To the best of my knowledge, Grant is not, nor has he ever been, an Adobe Certified Expert (ACE) in Photoshop. Very few forensic video analysts are ACEs as we only utilize about 1/3 of what Photoshop can do, and the ACE test is comprehensive. Thus, the ACE isn't necessarily a good metric or barometer of a forensic video analyst's grasp of Photoshop.

Years later, sitting in another LEVA facilitated class, George Reis and Casey Caudle presented a deeper dive into Photoshop. George might be / have been an ACE, but Casey wasn't.

I have presented countless Photoshop training classes and have written a book on Photoshop for forensic analysts.

None of this was ever "official" Adobe activity. Even when I presented two days of Photoshop training in the main training room at Adobe in San Jose, it wasn't "official" Adobe training. It was Adobe being nice and gracious in their sponsorship of NaTIA, under whose banner I was teaching.

Has a lack of "official" Adobe training every been a problem for you in your testimonial experience? I've been asked about my training. I've listed it on my CV. Syllabus files are available for the courses I teach. But, case law can't be found where an analyst was excused due their having been trained in Photoshop, but not during an "official" Adobe training event.

Professional photographers and digital artists know the name, Scott Kelby. Scott has an amazing record of training photographers and artists in the intricacies of Photoshop and the various Adobe tools. He's assembled the best and brightest to his brand, offering amazing value. Prior to Beckley in California, I was a member his National Association of Photoshop Professionals. NAPP is not an "official" Adobe endeavour. It's a group of likeminded individuals, supported by Adobe. But it's Kelby's thing, not Adobe's.

Elsewhere in our tool set, countless analysts have sat through Larry Compton's FOSS tool lectures and courses. With FOSS tools, there's really no possibility of an "official" training. If you use the popular ffmpeg, did you travel to France to get training from the originators of the tool? Likely not. You may have read a bit on the net, browsed the wiki, reached out to someone like Larry for advice, then hit the command line with gusto. Are your results invalid because Larry isn't authorized to deliver training on his basket of  tools? Validity isn't a function of the "officialness" of the instruction you've received.

In the period between 2012 and early 2019, I was in the employ of Amped Software, Inc. I delivered training on Amped's product line in the US, Canada, and South Africa. I went on site to teach a single agency's staff. I hosted courses in our offices with a mix of people from over 40 countries. The curriculum that I delivered was (and still is) informed by the context in which the courses were presented.

I'm in a unique position, being a trained (CA POST) and educated (WGU MEdID) curriculum designer. The focus of my training sessions has always been "tool-assisted training to competency," as defined by the ASTM and informed by my years of experience in law enforcement. I've focused on the discipline, which is enabled by a toolset. In this way, the only real change from Photoshop to any other tool was the platform. In my Introduction to Forensic Multimedia Analysis courses, the tool is incidental to the delivery of knowledge around the standards, practices, laws, and procedures. Sure, certain platforms make the job easier. In teaching a toolset, like Photoshop or FIVE, I always frame the curriculum around standards compliance and best practices - and present the tool-specific portions after the foundation has been set.

I've written about the new freedom that I'm enjoying now that Amped have retreated to their mail box in Brooklyn. The plethora of classes now on my calendar are not "new." The curriculum development was done years ago. I've wanted to offer these for quite some time to the general market. I have presented them to select US federal service staff on several occasions - causing problems in the process. You see, I was not "allowed" to do so by Amped. Their thinking was simple, I was the only one offering these classes. It would cause a business problem for them if their customers in Russia, for example, wanted to take the courses given that I, as a US citizen, would not be able to deliver them. Amped, having been founded in the epicenter of Italian Marxism, wanted a standard offering at a standard price. Amped, being an Italian company, is free to offer it's products and services to agencies in countries prohibited to US based businesses, like Russia.

If you want to pay a premium to receive your information from a person with an "ampedsoftware.com" email address, please do so with my blessing. If you want real-world guidance, training to competency, and an emphasis on science and standards, designed and delivered by someone who has been there and is still doing that, I'd love to see you in one of my classes. You can find our training calendar here.

Until then, have a great day my friends.

Meet Amped Software at the LEVA Conference

This just in from Amped Software:

We are happy to announce that we’ll be present at the Law Enforcement & Emergency Services Video Association (LEVA) 2012 Annual Training Conference on October 22-26, 2012 at the BAHIA Hotel in San Diego, California.

We will be demonstrating and showcasing the new 2012 version of our popular Amped Five Professional forensic video enhancement software. VideoScanner, our new product for forensic video e-discovery, will be shown in action at our booth. This is a new tool that can save countless hours for investigators looking for video evidence on a suspect’s computer.

Training conferences like LEVA are very important for us: with respect to other kind of events, here we have the possibility to be in touch with our actual end users and meet with world class forensic video analysts. Here we can present our technology to experts who can fully understand its potential and give concrete feedback for its further improvement. For this reason we are presenting here not only our popular software for forensic video analysis, Amped Five, but also our latest projects.

In particular with VideoScanner we created a very simple tool which can save hours looking and inspecting video files in digital forensic cases. VideoScanner allows the investigator to quickly extract few representative frames to all the videos found on a device for a efficient inspection. As a bonus it add several forensic facilities, such as the possibility to calculate the hash code on all the analyzed files and the automatic creation of the analysis report.

We are using this conference to show a preview of Authenticate, our new project which for digital photo authentication. Authenticate will incorporate an innovative workflow concept into a ground-breaking software for image authentication within a feature-packed, but easy to use, user experience. We see this as a critical tool for prosecutors and investigators in states such as California in light of the recent Beckley court ruling on requirements for digital evidence authentication. Evidence is being challenged in courts on the basis of authenticity and Authenticate will provide several tools for evaluating the originality of an image. We are offering several types of tools in Authenticate and have combined several different techniques, from simple metadata and quantization table analysis to actual pixel value inspection and cutting edge techniques used to specifically match an image to a camera or device.

At LEVA, Amped Software will be in booth 122 in the main exhibit hall. We have donated a VideoScanner tool for the LEVA Door Prize Drawing. You have to be present to win, so we'll see you there!

FourMatch - the marketing review

I realize that I'll probably upset some people with the comments that I'm about to make. But, I saw the marketing graphics for the new FourMatch Photoshop plug-in from Four and Six ... and I was a little shocked. Read the graphic; Assess reliability of social media images. In the same picture, Authenticate images instantly.

Now, what does that mean to you? The picture of the person with the mobile phone, the text ... with FourMatch, I should be able to authenticate pictures that I find on social media ... right?

WRONG.

From their own blog, "It currently can only analyze images from digital cameras, mobile devices, and tablets ..."

Remember Beckley? Beckley involved the police's use of images from Facebook. The police downloaded pictures from the suspect's Facebook account to use during sentencing - showing gang affiliation - for a sentence enhancement. Big problem. The defendent claimed that the image had been manipulated.

In California, authentication requires either the person in the scene to say ... yes, that's me and that's the scene as I remember it. Or, the photographer says ... yes, that's my picture and it shows the scene accurately, etc. Or, some independent person applies some scientific method to authenticate the image - like you and I.

Authenticate:
1. to establish as genuine.
2. to establish the authorship or origin of conclusively or unquestionably, chiefly by the techniques of scholarship: to authenticate a painting.
3. to make authoritative or valid.

With that in mind, I became interested in the FourMatch project/product. I need something to authenticate images from social media sites. Something that the court will recognize as accurate - and something that will work within the scientific method. Does FourMatch fit the bill for me? Unfortunately, no.

Of the five factors within the scientific method, FourMatch fails two rather significant ones.

First, I can refute the results presented in the window - in a manor of speaking. Here's my test. Let's say that I take a picture with my own phone. I upload the picture to my Facebook account. I download the picture to my computer. I load the downloaded image into Photoshop and use FourMatch - it flags it with the yellow ... probably not authenic, been processed flag. What?! It's my photo.

I'm the photographer, it's my phone, and it's my Facebook account. Who is right? Me, or the FourMatch determination that it's been manipulated and might not be authentic? I worry that, given the people involved in the project, that more weight would be given to the results of the plug-in's tests than my own testimony that it's my picture. But nevertheless, the content and context wasn't changed in any way. The only thing that happened was the upload - where Facebook recompresses the image. Facebook does that to every image. With this in mind, how can the marketing statement in the graphic (above, from their web site) be true?

In a blog post, the creators say, "It provides objective evidence that a file was not touched by any software application since the time it was first captured." If this is the case, that the plug-in works only on images that are direct from the camera and untouched by any application (as noted above, from their blog) - then you can't use the plug-in to authenticate or even assess images from social media. Social media sites recompress images on upload.

Then, there's the error rate issue. What's the instance of false negatives or false positives? FourMatch is a database driven product. It looks at the image vs. a database of camera info. For my assessment, using a popular US purchased mobile phone to take an image, the signature from the phone's imager will likely be found in the FourMatch database and it should give the image the green light. Yet, what about images from other phones, more obscure phones (not contained within the database) that are flagged yellow - further review. This is the same problem that I had with JPEG Snoop. Does the yellow, needs additional inquiry flag qualify as a false negative? Sure, for the Facebook tests FourMatch is right - it's been touched. But, it's possible to authenticate the image by other means. Again, does this qualify as a false negative? Would you be comfortable arguing this point in court?

If you hadn't read this, and you owned FourMatch ... it yellow-flagged your image, would you use the image in your case? Would you confidently proceed? Or, would you move on? In triage - it says the image has been processed, touched by software. What would you do?

So, does FourMatch provide objective evidence that a file wasn't touched by any software since capture? For the most part, yes - as long as the capture device's information is in the FourMatch database. In my tests, the database's problems were centered around mobile phones. Precisely the types of photos that we're concerned with. More people are ditching their point-and-shoot cameras in favour of the camera in their mobile. After all, who wants to carry around two pieces of gear when the cell phone pics can be directly uploaded to social media. People tend to flow to the easiest option. Remember, social media images largely come from we the people, not photojournalists with professional cameras.

Does FourMatch live up to it's own marketing slogan, assess the reliablility of social media images? No - it can't. Social media images are recompressed - touched by software.

If FourMatch really did work to authenicate social media images, it would be worth the price. I'd even pay a little more. But, most of my authenication requests come from folks who do not have the camera - or the allegations involve content/context issues (the other 2 of the 3 F's). As such, I'd have trouble justifying the expense for a database oriented triage tool.

For media outlets looking to verify the integrity of photos received from their field photographers and other sources ... I'm sure that this is a great tool and the editors will appreciate its ease of use. Generally, the cameras used by photojournalists will be present in the FourMatch database. But for law enforcement and criminal justice employees looking to authenticate social media images ... sorry. Wrong product.

The Interdependence of Science and Law

Today's topic comes from recent events in the court. The title comes from an article by Assoc. US Supreme Court Justice Stephen Breyer.

A local attorney enquired recently as to efforts underway to mitigate the Beckley decision here in California. It sparked an interesting discussion. I got to thinking ...

Should Beckley be mitigated? Certainly the technology exists to authenticate images independent from the subject of the photo or the photographer. But there aren't enough people, outside of academia, to work on the volumes of cases being tried around the state. There's got to be a better way.

Here's an idea from Justice Breyer: "Judge Jack B. Weinstein of New York suggests that courts should sometimes “go beyond the experts proffered by the parties” and “appoint independent experts” as the Federal Rules of Evidence allow. Judge Gerald Rosen of Michigan appointed a University of Michigan Medical School professor to testify as an expert witness for the court, helping to determine the relevant facts in a case that challenged a Michigan law prohibiting partial-birth abortions. Judge Richard Stearns of Massachusetts, acting with the consent of the parties in a recent, highly technical genetic engineering patent case, appointed a Harvard Medical School professor to serve “as a sounding board for the court to think through the scientific significance of the evidence” and to “assist the court in determining the validity of any scientific evidence, hypothesis or theory on which the experts base their testimony.”

In other words, why not create a panel of experts who have the tools, training, and experience in independently authenticating images? Sure, the panel would be small ... but why not? California is not that big, is it? Those of us that follow Hany Farid's work (and have applied it to cases) could collectively pick up the slack whilst others got their training and tools together?

It's just a thought ...

People v. Beckley

The s***t storm has already begun. The cat's out of the bag. Motions have already been filed relating to the Beckley decision on the authentication of images taken from on-line sources.

If your agency is in (or does business in) California, you'll need to understand how this ruling will impact your casework. It's best to get ahead of these things.

There aren't many labs out there that can provide this level of service. If you need help, send me a note and I'll get you an appropriate referral.

Enjoy.

Authentication of web pages

Continued from yesterday ...
From People v Beckley, et all (B212529 - Ca. 2nd Appellate District): "As evidence that the defendants belonged to the Southside Compton Crips, the prosecution offered a purported roster of the gang‘s members, including Beckley and Finn, which appeared on a web page that Detective Schoonmaker printed from the internet. The trial court admitted the evidence over the defendants‘ objections. Only Finn has pursued the admissibility of the roster on appeal. He argues that the roster was ―unauthenticated‖ because there was no evidence as to who created it, what it was intended to represent, whether it did in fact represent what it was intended to represent, and whether its creator had any basis in personal knowledge for including the names on the list."

"The printout is presumed to be an accurate representation of the web page Detective Schoonmaker found on the internet. (Evid. Code, § 1552, subd. (a) ["A printed representation of computer information or a computer program is presumed to be an accurate representation of the computer information or computer program that it purports to represent"].) The issue, however, was not whether the computer‘s printer could be trusted to reliably print out what was on the computer‘s screen or stored on some site but whether the content of what was on the site was reliable. We conclude that the evidence was insufficient to show that the writing was what it purported to be "a roster of the Southside Compton Crips. Therefore, the writing should have been excluded as unauthenticated and, therefore, irrelevant. We further conclude, however, that the error was harmless."

"Here, Schoonmaker claimed the writing was a roster of the members of the Southside Compton Crips. Schoonmaker admitted that he did not know who authored the roster but testified that he believed "that is a roster of Southside Compton Crip gang members that they themselves put together." This evidence was insufficient to authenticate the document as a roster of the Southside Compton Crips. Schoonmaker admitted that he did not know who created the list nor did he explain the basis for his assertion that the gang members "themselves put [it] together." Moreover, he offered no evidence that the person who created the list had any personal knowledge of the members of the gang or that the persons named in the list were current gang members. Accordingly, the court should have excluded the purported roster of gang members. The court‘s error, however, does not require reversal of Finn‘s conviction because the information contained on the list was cumulative. There was other evidence of Finn‘s membership in the gang, including his own admission, only one month before the shooting, made to police when interviewed in Seattle, and the testimony of Detective Valencia that Finn "has been seen and congregated with other members of this particular street gang." Evidence also showed that he had a body tattoo indicating affiliation with the gang."

... to be continued ...

Enjoy.

Authentication of on-line images

From People v Beckley, et all (B212529 - Ca. 2nd Appellate District): "In this opinion we hold that the prosecution‘s failure to authenticate a photograph and "gang roster" downloaded from internet web sites should have barred their admission but that the errors were harmless as to both defendants. We also conclude there was insufficient evidence to support the street gang enhancement of each defendant‘s sentence. We modify the judgments as to each defendant by striking the street gang enhancements. We further modify Finn‘s judgment by striking the gun use enhancements under Penal Code section 12022.53, subdivisions (b) through (d) and remand for resentencing."

"In rebuttal to Beckley‘s and Fulmore‘s testimony denying Beckley‘s gang involvement, Detective Schoonmaker testified regarding gang-related evidence he recovered from the MySpace.com internet accounts of Finn and Beckley"

"To rebut Fulmore‘s testimony that she did not associate with the Southside Compton Crips and that she insisted Beckley stop his association with the gang, the prosecution offered a photograph purportedly showing Fulmore flashing the Southside Compton Crips gang sign. Detective Schoonmaker testified that he downloaded the photograph from Beckley‘s home page on the internet website MySpace. The trial court admitted the photograph over both defendants‘ objections that it had not been authenticated. We agree with defendants that the court erred in admitting the photograph but we conclude that the error was harmless."

"A photograph is a "writing" and "[a]uthentication of a writing is required before it may be received in evidence." (Evid. Code, §§ 250, 1401, subd. (a).)"

"In People v. Bowley (1963) 59 Cal.2d 855, our Supreme Court established the two methods of authenticating a photograph. "It is well settled," the court stated, "that the testimony of a person who was present at the time a film was made that it accurately depicts what it purports to show is a legally sufficient foundation for its admission into evidence." (Id. at p. 859.) In addition, the court noted, authentication of a photograph "may be provided by the aid of expert testimony, as in the Doggett case, although there is no one qualified to authenticate it from personal observation." (Id. at p. 862.) In People v. Doggett (1948) 83 Cal.App.2d 405, the Court of Appeal upheld the admission of a photograph showing the defendants committing a crime. Because only the victim and the defendants, none of whom testified, were present when the crime took place and one of the defendants took the photograph, there was no one to testify that it accurately depicted what it purported to show. The People, however, produced evidence of when and where the picture was taken and that the defendants were the persons shown committing the crime. Furthermore, a photographic expert testified that the picture was not a composite and had not been faked. The court held this foundation sufficiently supported the photograph‘s admission as substantive evidence of the activity depicted. (Id. at p. 410.) Citing Doggett with approval, the Supreme Court held in Bowley that "a photograph may, in a proper case, be admitted into evidence not merely as illustrated testimony of a human witness but as probative evidence in itself of what it shows." (People v. Bowley, supra, 59 Cal.2d at p. 861.)

"Although defendants conceded that the face in the MySpace photograph was Fulmore‘s, neither method of authentication recognized in Bowley qualified the photo for admission as accurately depicting that Fulmore had assumed the pose shown in the photograph. Schoonmaker could not testify from his personal knowledge that the photograph truthfully portrayed Fulmore flashing the gang sign and, unlike Doggett, supra, 83 Cal.App.2d at p. 410, no expert testified that the picture was not a 'composite‘ or 'faked‘ photograph. Such expert testimony is even more critical today to prevent the admission of manipulated images than it was when Doggett and Bowley were decided. Recent experience shows that digital photographs can be changed to produce false images. (See e.g. U. S. v. Newsome (3d Cir. 2006) 439 F.3d 181, 183 [digital photographs used to make fake identification cards].) Indeed, with the advent of computer software programs such as Adobe Photoshop "it does not always take skill, experience, or even cognizance to alter a digital photo." (Parry, Digital Manipulation and Photographic Evidence: Defrauding The Courts One Thousand Words At A Time (2009) 2009 J. L. Tech. & Pol‘y 175, 183.) Even the Attorney General recognizes the untrustworthiness of images downloaded from the internet, quoting the court‘s warning in St. Clair v. Johnny’s Oyster & Shrimp, Inc. (S.D. Tex 1999) 76 F. Supp.2d 773, 775 that "[a]nyone can put anything on the Internet. No web-site is monitored for accuracy and nothing contained therein is under oath or even subject to independent verification absent underlying documentation. Moreover, the Court holds no illusions that hackers can adulterate the content of any web-site from any location at any time.‘"

... to be continued ...

Enjoy.