By David Spreadborough, Certified Forensic Video Analyst
I last wrote here for the Easter term of The Barrister in 2018 and honestly, where has the time gone? Considering all the troubles over the last two years though, it is not surprising that it only seems like yesterday that I was explaining some of the challenges with CCTV and Video Evidence. What has changed in that time? Are there new developments within the world of Digital Multimedia Evidence? The quick answer is yes, there have been changes and they affect every case where video and images are presented as fact.
Over the last few years, several new documents have been published offering guidance to Police Forces and private Forensic Service Providers in the handling and processing of Digital Multimedia Evidence. However, many have been contradictory, filled with ambiguity and in one case conflicted with the UK’s Forensic Regulators Guidance and also that of the training delivered in the UK by LEVA, the Law Enforcement and Emergency Services Video Association.
Some of those, I am led to believe, are undergoing review and amendments but I wanted to start with this issue to highlight a key point. If guidance by various organisations is ambiguous, conflicting or wrong, how can a courtroom trust the presented multimedia evidence? One analyst may have followed one set of guidance, but another may be using the knowledge gained through training.
Trust, not only comes in the form of the presented evidence but also in the person who has handled that evidence. Without trust, the evidence is worthless.
Let me introduce you to the three pillars of forensic image and video evidence: integrity, authenticity and science.
It doesn’t matter where in the world you are, what training you have received, how long you have been investigating video evidence, what guidance you have followed or what software you have used. If there are gaps or questions within any of these pillars then the weight of trust is reduced.
I mentioned a lot about integrity and authenticity in my previous article and I cannot emphasise how important these are now due to the digitization rollout within policing and the criminal justice system.
Integrity
As a reminder, integrity examines the origins of the evidence and the changes that have been made to it. At first reading, you may think that you do not want any changes and in an ideal world, that would be correct. However, just as a fingerprint cannot easily be seen or analysed on a piece of paper, videos and images often also need to be processed to enable the correct assessment and interpretation.
It is the initial acquisition, handling and processing that requires integrity.
Over the past few years, Police Forces have resorted to allowing members of the public to extract and submit their video evidence online. Many of these systems are then linked with new Digital Evidence Management Software (DEMS) that handles the vast amount of data being ingested during modern investigations. This has unfortunately exasperated the problem of images and video being used that have already undergone unknown and irreversible changes.
This is where the first question of trust appears – Can you trust that the image or video has not changed since the time of initial creation? If it has changed, what has been changed?
Many small businesses and homeowners now manage their CCTV and video surveillance via mobile apps on their phones. Some of these can create clips and then send those via email, or upload to a web service within policing.
During a recent test, I found that many of these videos can contain up to 4 times less visual data than the original video stored within the Digital Video Recorder.
During the early stages of investigations, requests are made for any CCTV and video evidence to be sent to the police. Screen recorded footage, the worst possible method of obtaining video evidence, is often received due to its speed and ease of creation. As I have said previously, these are invaluable for immediate media releases to trace suspects, but terrible for evidential analysis and use.
Due to the limitations within policing, however, by the time that these are reviewed and deemed of use, the original video required for evidence has often been deleted.
The consequence of these mistakes, and those mentioned in my previous article surrounding the acquisition, is that we are already starting with something that has changed and it is often difficult to understand those changes and how they affect the questions being asked of the video. Can you trust what is being presented if you cannot repeat or validate the differences?
Staying with our integrity pillar, we have the changes made to the images and video whilst stored within any legal organisation.
Even changes to the filename can cause issues, but the biggest problem is automated transcoding and undocumented naming of the video and imagery evidence.
Probably the largest mistake in any guidance document over the last few years was that of the identification of working copies. When is a file an original, when is a file a working copy and when has a file been created from another exhibit?
Again, you may believe these are easy issues to deal with and it’s concerning that guidance that should have changed to reflect the ease of digital transformations did not get updated.
The consequence of this is that many forces were changing video evidence, perhaps by cropping, trimming or making it more easily viewable, and then naming the new video as a working copy of the original.
Forensic Video Units and Forensic Service Providers were analyzing ‘‘working copies’, and in some cases oblivious to the fact that it was not a true copy of the originally acquired video evidence.
We have one last stage in the integrity and that is to answer the questions on the processing of the evidence.
For the sake of argument, and to move along, let us assume that our video evidence was acquired correctly from a CCTV system, and has been stored and labelled correctly with a Police Service. It then moves to an officer to view and assess. What does this officer use to complete that task?
Remember – This is evidence, not the latest viral video of a dog skiing.
A few years ago, we developed Amped Replay. A simple to use CCTV and Video Player designed for everyday policing but built with the forensic protection required within a modern legal system.
No need for various codecs or CCTV players. No need to screen capture footage and then take screenshots with PrintScreen. The Forces and units now using Amped Replay have the benefit of an easy to use program to view, assess and complete basic tasks like annotation or hiding the face of witnesses. They are also protected by forensic reporting of everything they have done.
What have they done, how, and who has done it? Here is the integrity again.
Finally, we then have the Forensic Video Unit or Service Provider.
A forensic image or video analyst should be able to identify errors in the integrity of a video upon initial analysis. At this point, the disclosure of those issues should be made, as it may result in no further work being completed. The lack of identification of gaps in the integrity of an item may highlight a lack of knowledge that brings into question everything else that they have done.
For instance, the opinion of a facial expert may be inadmissible if they never identified that the video was a screen recorded, transcoded copy of the original and their processing altered the dimensions of the face being analysed and compared.
Changes to an exhibit will, in most cases, need to be made to a video or image when questions are being asked of it. Some of those changes may be simple, such as extracting a single frame from a video, but some changes may be technical and complex. This is the last stage in the integrity chain. Any changes will result in a new derivative exhibit, and as such, the integrity chain starts again.
All the processing required in the creation of a new exhibit must be reversible, repeatable, reproducible and recorded.
Integrity, therefore, asks the question: has an exhibit changed since the time of acquisition?
The answer should be NO. If yes, those changes must be detailed and explained.
Authenticity
Authenticity enables us to rely on the video or image. Is it a true and accurate representation of that which it purports to be?
Again, I have mentioned this before but, the increased importance today cannot be overstated.
If a video or image has full integrity, then it still may not be authentic. How can this be?
The way video is recorded can be hugely complicated. It is not possible to capture uncompressed video at high frame rates across multiple cameras, the data size would be huge. As a consequence, video compression is used in many different ways to get the best effort. How this works is extremely clever but it takes someone with a full understanding of the image generation to verify the authenticity of objects, movement, colour and light.
Is the video authentic in that it displays motion correctly? In the case of a low frame rate video, the answer to that question may be No.
Is the video authentic in that it presents colour correctly? In the case of highly compressed video, the answer may be No.
Is the video authentic in that it displays a vehicle’s speed correctly? In the case of transcoded video, the answer may be No.
Authenticity and the reliability of the image and video data can only come after analysis, and that is where the research, interpretation, restoration and enhancement of the exhibit happens, and this leads us on to our third and final pillar.
Science
Forensic Video Analysis is a scientific process. Even when the question relates to a task, such as, “can you prepare that video for court?” The process involved in that preparation must be accurate, repeatable and reproducible.
“Can you enhance that licence plate?” The process again must follow a scientific model to ensure the validity of the result.
A video, when exported from a CCTV system may not be authentic without processing. Its aspect ratio may be wrong, there may be lens distortion, there could be blur, lighting issues, the timing could be incorrect, the frame rate may be wrong. I could go on, but you should be able to get the picture (no pun intended).
For forensic image and video processing, restoration and enhancement, the image generation model should be used. This gives us a workflow that allows us to restore a video view or object and therefore regain authenticity.
Whenever a video has been produced from another, specifically for presentation, it is vital that the continuity chain can be followed back to the original exhibit and that all changes made follow the scientific model. These basic checks make it easy to assess all changes and allow all parties to test the item’s authenticity.
The correct interpretation of events in a video directly relates to the initial understanding, analysis, restoration and enhancement of it. It is truly frightening to still see images and video being presented where there are errors in the basic skills and knowledge of the presenting witness, or when there is no understanding of the processes they have used.
Technology has also not stood still over the last few years and the presenting witness must be careful in their approach to it. Images and videos can pass through several different applications and systems but every exhibits movement must be verified to ensure that what is passed from one piece of software, is received correctly by another. If a video is not being decoded in the same way, for instance, it may show a different number of frames or playback at a slightly different speed.
The competency and reliability of the presenting witness are of vital importance in the identification of unknown and untested image processing. With advancements in technology and the increase in Artificial Intelligence (AI) algorithms to assist in image and video processing, the analyst has a duty to the court to ensure that no unvalidated technology is used in the processing of images or video.
An analyst’s responsibility is to ensure the evidence can be trusted. If they are unable to explain a processing stage because this has been conducted using an unexplainable computer algorithm, then how can the result be trusted in a courtroom?
Witnesses being proficient on the creative side of photography and video editing is not enough. They should have the approach of the scientist, not that of the artist, and they should follow valid scientific workflows.
In some cases, more than one witness may be required. A technician may have completed several image processing tasks, but may not have the technical knowledge to explain the methods used. Therefore, an analyst may be called to explain the more technical aspects to allow the image or video to be admitted.
This aspect can easily be managed during a peer review.
This is one of the final stages of the workflow and it is vital to ensure that the processing has been done correctly and all the facts are verified. A forensic image or video analyst is there to ensure that the presented evidence is factual. If an object or mark is highlighted as being of relevance then that object or mark can be trusted. If they are conducting a comparative analysis for instance, then they are comparing the representation of an object in a video or image, and that representation can be trusted.
The peer review should also consider the effects of unconscious bias.
What was known to the technician or analyst? Have they conducted their analysis or task in an unbiased way to assist the court, and not to assist the particular side to which they are employed?
This is important in all comparative casework, but also in the tracking and recognition of persons through events or time. This is best completed through a staged disclosure approach to the analyst. It ensures they don’t work ‘in reverse’ to follow a particular narrative and therefore any timeline of events can be trusted
Video and image evidence is the most common form of physical exhibit. If we ensure that the presented material has integrity, authenticity and that all processing has followed a scientific model, then that evidence can be trusted. Corners must not be cut to assist in speed or ease. A lack of time or not having the correct software cannot be a justification for the submission of untrustworthy evidence.
Next time an image or video arrives in a case, ask yourself, “Can this be trusted?” Does it have integrity, authenticity and has it been processed in an explainable and peer accepted scientific manner?
For further information, please contact info@ampedsoftware or visit ampedsoftware.com
David Spreadborough
Certified Forensic Video Analyst
www.forensicvideo.training
www.spreadys.com
