CHAPTER 2 BACKGROUND
is special about Digital Images?"
2.1 A key element of
digital technology is the ease with which perfect copies can be
made (see Box 2). Attempts to copy a conventional analogue audio
tape produce an inferior copy but a digital copy of a digital
compact disc (CD) is an identical replica. This is one of the
great benefits of digital technology. However it can also create
commercial difficulties for the manufacturer trying to prevent
the production of counterfeit goods, for example. Other key features
of digital technology are the ease with which data can be changed
and the ease with which data can be matched with information from
other databases (see Chapter 4). As one of our witnesses said:
"with recent increases in computing power at affordable prices
and improvements in imaging hardware, image manipulation has become
far more accessible" (p 150). The Chartered Institute
of Arbitrators also cautioned that even colour laser photocopiers
commonly featured editing facilities, so that tampering with an
image is no longer the preserve of computer science (p 156).
This is both a great advantage and a severe problem of the technology.
2.2 If presented with
an 'original' digital image and a copy, perfect in every respect,
in the absence of any other information it is impossible to distinguish
which one was produced first. In many circumstances this might
not matter, but if the data are transferred to a computer, modified
in some way and then returned to an identical storage device to
the one they were recorded on (eg to an identical looking
CD which is passed off as the 'original'), it might matter. It
would matter greatly if the item described as an 'original' were
a photograph of a defendant apparently involved in a criminal
activity. Equally, the Crown Prosecution Service expressed concern
that the technology could give defendants "the ability to
construct an alibi that is convincing ... using home video equipment
to manipulate an image" (p 168).
2.3 Here we find that
there is some confusion over what can be described as the original
when considering digital images, in particular between the technical
and legal definitions (see Box 2). We prefer the following definition
in relation to digital images: the original is the data first
recorded in memory. Thus any printed or displayed image created
from these data is a copy. Consequently digital recording technology
provides no original that could be produced in evidence. All that
is available for use as evidence is a copy of the first, probably
temporary, recording in memory, and this will be admissible as
evidence. Its weight as evidence will depend on proper authentication
and other matters.
|Box 2: What is an original?
|An analogue image always has an original to which it relates in either negative or positive form (ie the negatives from which photographic prints are made, transparencies or the magnetic recording on a video tape). Copies can be made from the original and normally there will be little difference between them, but as further copies are made from these copies then the image quality is likely to deteriorate.
|For a digital image the 'original' consists of the data recorded in memory, from which the image can be generated. Because the recorded image is represented as a finite set of numbers, exact copies may be made, and images made from these copies. Each stage of copying is precise and there is no loss of image quality between generations. Thus it becomes impossible to say which is a first generation image: the implication is that any digital image can be thought of as being 'the original' even if it is produced from a copied set of data, unless it is tagged in some way to identify it as the first image made (see Box 4 on authentication).
|An original for the purposes of the law of evidence is usually the first manifestation of a document in final form. However, where there are multiple possibilities (eg where a fax is sent, both sender and receiver have 'original' copies) the original for some purposes is that version of a document which was intended by its maker to be legally effective.
|Because of the possibility of different interpretation of 'original' in law, we have adopted the definition of paragraph 2.3.
2.4 In relation to
a digital camera, for example, it is probable that the original
would be the digital file representing the image which is stored
on a memory chip, or series of chips, at the moment that the image
is captured. That digital file will immediately be copied to some
other form of storage and the memory chip will be overwritten
with the next image.
This does not represent a problem under the law of England and
Wales because if the original of a document no longer exists,
copies or even copies of copies are admissible in evidence
and it is irrelevant that the original was destroyed by the person
seeking to produce the copy as evidence.
Nor is it a problem in Scotland because although the general rule
that copies of documents are admissible whether or not the originals
still exist does not apply to visual images,
copies of a document which no longer exists are admissible under
the best evidence rule.
The fact that a document is a copy goes to its weight as evidence,
not its admissibility. It will therefore be necessary for the
user to be able to give evidence of the procedures used for generating,
processing and storing digital images, so as to be able to prove
that the image produced to the court is an accurate copy of the
But in general, provided it would not prejudice a fair trial,
the court is likely to admit the evidence and the judge will direct
the jury on the weight they should consider attaching to it.
Altering a digital
2.5 Because a digital
image is just a visual representation of ones and zeros in computer
memory it may be altered, deleted or copied at will in the same
way as any other computer data. An image may be altered in much
the same way as a word processor can be used to change the text
of a document: the final text when displayed need give no clue
as to how many words or paragraphs have been changed from the
first version, nor who changed them and when (or why). A variety
of software packages are available which allow one to sharpen
and enhance the image, change colours, contrast and brightness,
copy and move around segments of the image, and import image segments
from other photographs to make a seamless collage. The sequence
of a 'movie' can also be altered or reversed to show events in
non-chronological order. As discussed in Box 2, the ultimate modified
image may be indistinguishable from the first version in terms
of quality or the apparent representation of reality.
2.6 The potential for
making subtle, but significant, alterations to an image gives
most cause for concern as such changes may be highly convincing
and almost impossible to spot. For example, software is available
which can be used to add or subtract shadows and ensure that the
sun angle on an object (perhaps a person) imported into a base
image is congruent with the rest of the scene. Timing mechanisms
on electronic devices often do not keep accurate time (and they
are often set incorrectly to start with, Q 104) and visual cues
from a scene that might corroborate timings (eg a clock face)
are easy to alter or obscure.
2.7 In the course of
criminal proceedings it may be necessary to use computer techniques
to enhance an image, making the subject clearer (eg by removing
signal noise) or isolating the subject from a cluttered background
to make identification easier. If the image is to be used for
evidential purposes, the question that might be asked is, what
represents justifiable enhancement? Does this differ from manipulation
which might have, or be perceived to have, malicious intent, and
where can the distinction be drawn?
2.8 Changing the contrast
or colour balance of a computer monitor may be considered visual
'enhancement' and is no different from what might be done to an
analogue image. However, any alterations which affect the image
data, no matter how innocuous, should be treated with caution.
Sharpening the outline of an object is a standard option on image-processing
software which usually involves changing the contrast at the edge
of the image (eg black pixels against grey pixels may become black
against white). After sharpening, the object is easier to see,
but the image data have been changed.
2.9 Some modifications
are made routinely for image processing, for example de-skewing
a page as a document is scanned electronically. The process is
automatic, uses a set algorithm to make simple adjustments and
if agreed limits are placed on the scope of the operation then
this perhaps should be accepted as a justifiable modification.
Cleaning-up unwanted signals that arise from outside interference
might also be acceptable, although it would be better to ensure
that the imaging system is immune from such signals in the first
2.10 If human judgement
is involved and the process is more complicated, then the resulting
image is of questionable evidential value. For example, improving
the clarity of a face in a still from a grainy security video
will depend on the software and equipment used, the assumptions
made about that face (and this in turn will depend on the bias
of the operator), and the composition of any comparative data
set used as a reference. Value judgements will be made during
the process. There is no clear distinction between acceptable
'enhancement' and unacceptable 'manipulation'. Any changes have
to be considered on their merits.
The need for caution
2.11 With modern processing
and tele-communication techniques even an image that purports
to be analogue may have had a 'digital past'. For example, it
is possible that an image stored digitally may have been generated
with a standard analogue camera, the signal or picture may be
converted into digital format for transmission and then converted
back to analogue again to be displayed. Thus, in many circumstances,
it can be difficult to make a distinction between what is and
what is not a digital image (Abbey National Q 353). The ease with
which images, when in digital format, can be copied and modified
suggests that caution must be exercised when any image
is being used as evidence: all images, both analogue and digital
might be suspect.
But are these
2.12 We took much evidence
as to the power of image modification technology (eg Mr Sommer,
Mr Davies and Mr Smith, and witnesses from IBM), saw it for ourselves
thanks to the assistance of the Forensic Science Service and the
Greater Manchester Police, and heard about its widespread availability,
low cost and the difficulty of detecting modifications (eg Mr Sommer,
Q 115). We concluded that before the advent of digital technology
it might have been a time consuming and costly exercise to produce
a modified image in which it was difficult to detect tampering,
but with the present widespread availability of digital technology
it could now be a low cost operation to produce an image in which
the modifications would be undetectable.
The existence of a technology that can be used to modify images
in this way need in itself be of no great concern; even the widespread
availability of the technology at low cost might not cause concern.
But an apparent lack of understanding of the implications of both
these facts should cause concern and warrants further study. The
public and all those in the legal profession (Mr Smith Q 84)
should be made more aware of the technology, what it can do, and
what its limitations are. It was suggested that criminal convictions
that were dependent on evidence captured by digital cameras could
be at risk if defence lawyers began to realise how vulnerable
such images are to manipulation. This means that when presented
with an image the observer should have no more, and no less, faith
in it than if the information had been text on a sheet of paper
of questionable provenance.
2.13 However, we also
heard that digital images presented opportunities: Mr Marcus,
Senior Legal Counsel for IBM, held the view that digital images
presented "positive evidentiary opportunities ... for the
identification of content owners (owners of copyright) and of
unauthorised modifications in ways which are not available to
traditional analogue technologies" (Q 261). For example,
images could be time-stamped or given other authenticating marks.
The current law
on the use of images as evidence
2.14 Although there
is no legislation which expressly covers digital images used as
evidence, nor any reported cases in which the fact that an image
was collected in digital form was at issue (Crown Prosecution
Service p 167) there is a substantial body of the law of
evidence which deals with the problems arising from technological
recordings. This body of law will equally apply to digital images.
Indeed, witnesses including the Senior Counsel from IBM (Q 263)
and solicitors from Bird & Bird (Q 78) regarded the differences
between digital images and other evidence as being one of "degree
rather than of fundamental kind" (Q 78).
2.15 The rules of evidence
of common law jurisdictions normally exclude from evidence certain
types of document. The most unreliable kind of evidence, under
these rules, is 'hearsay', which is not admissible as evidence
unless it falls within one of the numerous exceptions to the rule.
By contrast, information captured by a recording device, with
no human intervention, is not normally hearsay and can be admitted
in evidence. Video and image recordings are not therefore excluded
2.16 In civil litigation,
there are no prior requirements which must be met before a document
(which would include a digital image) can be admitted in evidence.
Section 1 of the Civil Evidence Act 1995 abolishes the hearsay
rule for civil proceedings, and Section 8 provides that where
a statement in a document is admissible, it may be proved by producing
a copy of the document (even if the original is still in existence)
and that the number of removes between a copy and the original
is irrelevant (ie it may be an nth generation copy).
Furthermore, under Section 9, documents which form part of the
records of a business (defined very widely) are automatically
admissible and the absence of an entry in those records can be
proved by an appropriately signed certificate.
2.17 In criminal cases
the position is a little different, as the House of Lords has
that the provisions of Section 69 of the Police and Criminal Evidence
Act 1984 (see Box 3) apply to all computer records, whether they
are hearsay or not. This means that in criminal cases, any use
of a digital image as evidence must be accompanied by the certificate
required under Section 69. This certificate, given by a person
responsible for the computer system in question, must state that
either the computer system was at all times operating properly,
or that any defect in its operation was not such as to affect
the accuracy of the record.
|Box 3: Police and Criminal Evidence Act 1984 (PACE)
|Section 69 of PACE refers to the admissibility of evidence from a computer, and requires assurances about whether the equipment was being used properly and was functioning normally at the time. The implication of Section 69 is that any party relying on computer evidence has to provide oral or written certification of the reliability of the computer, or for each computer if a number have been involved.
|Section 69 Evidence from computer records
|(1)In any proceedings, a statement in a document produced by a computer shall not be admissible as evidence of any fact stated therein unless it is shown:
(a) that there are no reasonable grounds for believing that the statement is inaccurate because of improper use of the computer;
(b) that at all material times the computer was operating properly, or if not, that any respect in which it was not operating properly or was out of operation was not such as to affect the production of the document or the accuracy of its contents; and
(c) that any relevant conditions specified in rules of court under subsection (2) below are satisfied.
|(2)Provision may be made by rules of court requiring that in any proceedings where it is desired to give a statement in evidence by virtue of this section such information concerning the statement as may be required by the rules shall be provided in such form and at such time as may be required.
2.18 The Law Commission
has recently recommended the repeal of Section 69 of PACE because
it "serves no useful purpose". The Law Commission said
that it was impractical to certify all the intricacies of computer
operation and experience showed that most computer error was either
easy to detect immediately or had resulted from human error in
data entry rather than from malfunction. With the repeal of Section
69, a presumption of proper functioning would be applied to computers
(Evidence in Criminal Proceedings: Hearsay and Related Topics,
LAW COM No. 245, June 1997).
2.19 As new technology
(and in particular information technology) finds a place outside
the research laboratory, its reliability and accuracy is established
through use and public acceptance grows through familiarity (or
indifference). Debate over the use of the technology moves on
from whether the hardware and software are reliable to how the
technology might be used to greatest effect, hence the move by
the Law Commission. If the proposal of the Law Commission is accepted,
legal challenge to new technology may now be reoriented to establishing
authenticity and suitable weight for the evidence which it generates.
2.20 The underlying
problem that remains is the potential for image tampering: how
to be sure that an image has not been unfairly modified and what,
if any, image processing in the name of 'enhancement' is justified.
The Home Office already gives 'type approval' for systems where
the only evidence of a crime is an image taken by an enforcement
camera (eg speeding and bus lane violations), but the general
concept of a 'self authenticating image' and how it might be used
in a court of law is still something which needs to be evaluated.
2.21 The courts always
have discretion to exclude evidence which has doubtful probative
value. A prosecutor or party to litigation will always need to
be prepared to offer further evidence about the source of a digital
image and the processing and storage it has undergone since it
was first recorded. It has been held that the person adducing
a recording as evidence must describe its provenance and history,
so as to satisfy the judge that there is a prima facie
case that the evidence is authentic.
4 US law provides that printouts of data stored in
a computer are `originals' under Fed. R. Evid. 1001(3), and even
if not original are normally admissible as duplicates unless there
is some doubt as to their authenticity (rule 1003). The records
are always admissible if the originals have been destroyed (rule
There is a misconception, presumably derived from the old best
evidence rule which is now largely superseded, which stated that
where the original of a document existed it must be produced before
the courts in preference to a copy. R v. Wayte (1983)
76 Cr. App Rep 110. "It is now well-established that any
application of the best evidence rule is confined to cases in
which it can be shown that the party has the original and could
produce it but does not" (per Beldam J. at p 176).
See also Civil Evidence Act 1995 s. 8(2). Back
Unless, of course, there is evidence that the original was destroyed
to suppress evidential weaknesses. Back
Paragraph 1 of Schedule 8 to the Criminal Procedure (Scotland)
Act 1995. Back
Paragraph 8 of Schedule 8 to the Criminal Procedure (Scotland)
Act 1995. Back
Advocate's Reference No. 1 of 1992
1992 SLT 1010 at p 1018 J-K. Back
evidence will not be necessary in civil proceedings if the authenticity
of the image is admitted during discovery under RSC Ord. 27 r.
4(1), which provides that where lists of documents are exchanged
a document which is asserted on the list to be a copy is presumed
to be a true copy unless its authenticity is specifically disputed
by the other party. If the document is disputed, however oral
evidence as to authenticity will be required. In criminal proceedings,
it will always be necessary to be able to produce some founding
testimony as to the source and authenticity of the image, otherwise
the courts may refuse to admit the evidence. Back
the technology exists then it is inevitable that it will be used:
for example, the Newport Beach Police Department in Anaheim, California,
have recently been testing Adobe Photoshop image processing software
to isolate and give greater clarity to suspects in CCTV images. Back
that not all business documents are `records'. H v. Schering
Chemicals (1983) 1 All ER 849, the leading case on the meaning
of `record', indicates that a document, irrespective of its form,
will only be a record if (a) it effects a transaction or is a
contemporaneous compilation of information derived from primary
sources which is intended to serve as a record of events; and
(b) it is a comprehensive compilation, rather than a selection
of source information. If a document is not a comprehensive record
of what has occurred, or, even if comprehensive, was not intended
to serve as a primary source of information on that matter, it
will not be a record. Thus the majority of computer records
will fall under s.8 rather than the more favourable provisions
of s. 9. A certificate signed by an officer of the business is
required under s. 9(2) so as to demonstrate that the document
forms part of its records. Back
R v. Shepherd (1993) 1 All ER 225. Back
R v. Robson & Harris (1972)
1 WLR 651, a case concerning an audio recording. Back