Everything created on a digital device, such as a smartphone or laptop, has a digital fingerprint attached to the file. That digital fingerprint is called metadata. It sticks to the document, whether a video, photo, spreadsheet or other document, until some person or program removes it. For example, if you take a photo with your phone and view the photo with a metadata viewer, the data will include what phone you used, the date and time, and the latitude and longitude.

Understanding metadata

It is possible to change metadata. For example, when you pull your photo into Photoshop, you can edit the metadata to make it appear that you were anywhere else in the world. It is essential to triangulate metadata with other elements to confirm or debunk an image. Sites such as Twitter or Facebook does not pass along metadata. However, Telegram does not remove metadata on videos and photos shared on it, making it possible to know where images were captured.

Metadata isn't foolproof

When you view a photo or video, the metadata can show if the information is accurate or questionable. If the metadata does not match the claims, it is possibly staged. In addition to examining metadata, researchers also look at smaller details to see if they add up.

Metadata in action

<figure><img width="416" height="416" src="https://www.poynter.org/wp-content/themes/elumine/assets/images/placeholder.png" alt="" srcset="https://www.poynter.org/wp-content/themes/elumine/assets/images/placeholder.png"><figcaption dir="auto">A man takes his things out of the house after damaged by artillery shelling in Novoluhanske, eastern Ukraine, Wednesday, Feb. 23, 2022. (AP Photo/Evgeniy Maloletka)</figcaption></figure><div>
					February 24, 2022				</div>In the first hours of the Russian invasion of Ukraine, internet watchdogs pored over images shared on Russian media that claimed Ukraine struck first and Russia merely responded.The Biden administration has been warning for weeks that, in the days and hours leading up to the invasion of Ukraine that arrived before dawn on Thursday, Russian sources would release “false flag” photos and videos to make it appear that the Ukrainian military attacked Russian forces unprovoked.To understand how these investigators do their work, you should first understand a few basics.<h1>Understanding metadata</h1>Everything created on a digital device — whether it is a smartphone, a laptop or tablet — includes a digital fingerprint that rides with the file. That digital fingerprint, called metadata, sticks with the document — whether it is a video, photo, spreadsheet or other document —&nbsp;until somebody or some program removes it.Let me give you an example before we explore images from the Russia/Ukraine border.I took a photo of my office at Poynter. When I pull that photo into a metadata viewer like the one shown below, you can see the data behind the file. The data shows that I used my iPhone 11 Pro Max to take the photo on Feb. 22, 2022, at 11:56 a.m.<img src="https://www.poynter.org/wp-content/themes/elumine/assets/images/placeholder.png" alt="" width="416" height="416" srcset="https://www.poynter.org/wp-content/themes/elumine/assets/images/placeholder.png">(Al Tompkins/Poynter)You will also see that my phone embedded my latitude and longitude in the metadata. It says the phone was pointed toward the west. Drop the latitude and longitude into Google Maps and you will see precisely where I was standing when I took the image. The tag is correct within about 50 yards.<img src="https://www.poynter.org/wp-content/themes/elumine/assets/images/placeholder.png" alt="" width="416" height="416" srcset="https://www.poynter.org/wp-content/themes/elumine/assets/images/placeholder.png">(Screenshot/Google Maps)<h1>Metadata isn’t foolproof</h1>It is possible to change metadata. I could pull my photo into Photoshop, for example, and edit the metadata to make it appear that I was anywhere else I could dream of. Think of metadata as a clue and not an ironclad answer. That is why it is important to triangulate metadata with other elements to debunk or confirm an image.If I shared that photo on Twitter or Facebook, those social media sites would not pass along the metadata. But there is a social media platform <a href="https://telegram.org/" dir="ltr">called Telegram</a> that is very popular outside of the United States because of its speed and its functionalities, which include encrypted video calling.Telegram has another unique quality: It does not remove metadata on videos and photos that are shared on it. So, it is possible to easily find out where images or videos from Telegram were captured.<h1>Metadata in action</h1>Let’s apply this technique to a video that the Russian news agency<a href="https://tass.com/emergencies/1407169" dir="ltr"> Tass ran on-air and online</a>.Tass said that five Ukrainian soldiers had crossed the border into Russia riding two armored personnel carriers. It just so happened, Tass reported, that the intruders were wearing helmet cameras and rolling video when they attacked Russian soldiers and the Russians killed them. <a href="https://twitter.com/OAlexanderDK/status/1495765118969421824?s=20&amp;t=ip_X96_hJRNgFd4jYZJoPw" dir="ltr">The video had been posted on Telegram</a>, and the metadata indicated it was not actually from inside Russia but instead from the occupied area of Eastern Ukraine.That detail is critically important because, if the metadata is accurate, it indicates that the video was not an attack inside of Russia that would justify a counterattack.The metadata indicates the armored vehicles were blown apart very near another alleged attack by Ukrainian forces against what was reported in Russian media to be a Russian military outpost. <a href="https://twitter.com/lambdadmitry/status/1495780448651419649?s=20&amp;t=on2k0ds46WfJFxM--JazGg" dir="ltr">The metadata of those two images map to a location five farm fields</a> away from each other.All of this evidence would seem to indicate that both images are at least questionable. The metadata does not match the claims, and skeptics believe they were both staged — or “false flag” — attacks meant to make Ukraine appear to be the aggressor.<a href="https://www.bellingcat.com/news/2022/02/23/documenting-and-debunking-dubious-footage-from-ukraines-frontlines/" dir="ltr">Bellingcat journalists lead the way</a> in using forensic analysis like metadata to verify or debunk images and videos. Bellingcat posted a spreadsheet showing the date and content of the footage and provided an analysis of what debunkers have found.<img src="https://www.poynter.org/wp-content/themes/elumine/assets/images/placeholder.png" alt="" width="416" height="416" srcset="https://www.poynter.org/wp-content/themes/elumine/assets/images/placeholder.png">(Bellingcat)Bellingcat reported:<BLOCKQUOTE>In another illustrative case from February 20, a pro-Russian militia from Luhansk posted a video to its Telegram channel claiming to show a man in the village of Pryshyb whose leg had to be amputated after shelling by Ukrainian forces.This video includes an initial clip of a man on the ground allegedly at the scene of his injury. A man is then shown in hospital where he is said to be recovering after an amputation.Although it cannot be established that these two men are the same, the video appears easily <a href="https://twitter.com/OAlexanderDK/status/1495736730548322310?s=20&amp;t=QVIUBWYbIum2Kc_ueBJXOA" dir="ltr">disprovable</a> as the man’s prosthesis seems clearly visible in the initial clip (hence his leg had already been amputated).</BLOCKQUOTE>In addition to examining metadata, researchers look at the smallest details to see if they add up. For example, on Monday, Russian media said Russian President Vladimir Putin scheduled an emergency Security Council meeting after leaders of two contested regions in Eastern Ukraine requested Russia recognize their independence. Russian TV showed Putin signing an action doing just that.<div class="embed-placeholder" data-type="twitter" data-id="1495775724782985223"></div>But debunkers noticed that people in the video were wearing watches. The Security Council meeting reportedly took place at 5 p.m. local time, but the watches all read noon. And watches at the signing ceremony read 10:15 a.m., so either everyone had the wrong time, or the signing took place before the Security Council meeting. In other words, it was all cinema.<h1>Be careful</h1>While doing this kind of debunking work, journalists and other researchers should be careful not to overstate the certainty of what they undercover.&nbsp; For example, while I have cited inconsistencies in state media claims and the misaligned metadata behind videos and photos, we cannot say with certainty who captured the video and who posted it. But the fact that Russian government media is running it and claiming definitively that it is proof of Ukrainian aggression makes it important enough to question.<div>Support high-integrity, independent journalism that serves democracy. Make a gift to Poynter today. The Poynter Institute is a nonpartisan, nonprofit organization, and your gift helps us make good journalism better.</div>

A look at the techniques that journalists and other investigators use to verify whether images and videos are real and in accurate context.

technologyandthefuture

Technology & The Future

artsandculture

Society, Arts & Culture

In the first hours of the Russian invasion of Ukraine, internet watchdogs pored over images shared on Russian media that claimed Ukraine struck first and Russia merely responded.

The Biden administration has been warning for weeks that, in the days and hours leading up to the invasion of Ukraine that arrived before dawn on Thursday, Russian sources would release “false flag” photos and videos to make it appear that the Ukrainian military attacked Russian forces unprovoked.

To understand how these investigators do their work, you should first understand a few basics.

Everything created on a digital device — whether it is a smartphone, a laptop or tablet — includes a digital fingerprint that rides with the file. That digital fingerprint, called metadata, sticks with the document — whether it is a video, photo, spreadsheet or other document — until somebody or some program removes it.

Let me give you an example before we explore images from the Russia/Ukraine border.

I took a photo of my office at Poynter. When I pull that photo into a metadata viewer like the one shown below, you can see the data behind the file. The data shows that I used my iPhone 11 Pro Max to take the photo on Feb. 22, 2022, at 11:56 a.m.

(Al Tompkins/Poynter)

You will also see that my phone embedded my latitude and longitude in the metadata. It says the phone was pointed toward the west. Drop the latitude and longitude into Google Maps and you will see precisely where I was standing when I took the image. The tag is correct within about 50 yards.

(Screenshot/Google Maps)

It is possible to change metadata. I could pull my photo into Photoshop, for example, and edit the metadata to make it appear that I was anywhere else I could dream of. Think of metadata as a clue and not an ironclad answer. That is why it is important to triangulate metadata with other elements to debunk or confirm an image.

If I shared that photo on Twitter or Facebook, those social media sites would not pass along the metadata. But there is a social media platform <a href="https://telegram.org/">called Telegram </a>that is very popular outside of the United States because of its speed and its functionalities, which include encrypted video calling.

Telegram has another unique quality: It does not remove metadata on videos and photos that are shared on it. So, it is possible to easily find out where images or videos from Telegram were captured.

Let’s apply this technique to a video that the Russian news agency<a href="https://tass.com/emergencies/1407169">Tass ran on-air and online </a>.

Tass said that five Ukrainian soldiers had crossed the border into Russia riding two armored personnel carriers. It just so happened, Tass reported, that the intruders were wearing helmet cameras and rolling video when they attacked Russian soldiers and the Russians killed them. <a href="https://twitter.com/OAlexanderDK/status/1495765118969421824?s=20&t=ip_X96_hJRNgFd4jYZJoPw">The video had been posted on Telegram </a>, and the metadata indicated it was not actually from inside Russia but instead from the occupied area of Eastern Ukraine.

That detail is critically important because, if the metadata is accurate, it indicates that the video was not an attack inside of Russia that would justify a counterattack.

The metadata indicates the armored vehicles were blown apart very near another alleged attack by Ukrainian forces against what was reported in Russian media to be a Russian military outpost. <a href="https://twitter.com/lambdadmitry/status/1495780448651419649?s=20&t=on2k0ds46WfJFxM--JazGg">The metadata of those two images map to a location five farm fields </a>away from each other.

All of this evidence would seem to indicate that both images are at least questionable. The metadata does not match the claims, and skeptics believe they were both staged — or “false flag” — attacks meant to make Ukraine appear to be the aggressor.

<a href="https://www.bellingcat.com/news/2022/02/23/documenting-and-debunking-dubious-footage-from-ukraines-frontlines/">Bellingcat journalists lead the way </a>in using forensic analysis like metadata to verify or debunk images and videos. Bellingcat posted a spreadsheet showing the date and content of the footage and provided an analysis of what debunkers have found.

In another illustrative case from February 20, a pro-Russian militia from Luhansk posted a video to its Telegram channel claiming to show a man in the village of Pryshyb whose leg had to be amputated after shelling by Ukrainian forces.

This video includes an initial clip of a man on the ground allegedly at the scene of his injury. A man is then shown in hospital where he is said to be recovering after an amputation.

Although it cannot be established that these two men are the same, the video appears easily <a href="https://twitter.com/OAlexanderDK/status/1495736730548322310?s=20&t=QVIUBWYbIum2Kc_ueBJXOA">disprovable </a>as the man’s prosthesis seems clearly visible in the initial clip (hence his leg had already been amputated).

In addition to examining metadata, researchers look at the smallest details to see if they add up. For example, on Monday, Russian media said Russian President Vladimir Putin scheduled an emergency Security Council meeting after leaders of two contested regions in Eastern Ukraine requested Russia recognize their independence. Russian TV showed Putin signing an action doing just that.

But debunkers noticed that people in the video were wearing watches. The Security Council meeting reportedly took place at 5 p.m. local time, but the watches all read noon. And watches at the signing ceremony read 10:15 a.m., so either everyone had the wrong time, or the signing took place before the Security Council meeting. In other words, it was all cinema.

While doing this kind of debunking work, journalists and other researchers should be careful not to overstate the certainty of what they undercover.  For example, while I have cited inconsistencies in state media claims and the misaligned metadata behind videos and photos, we cannot say with certainty who captured the video and who posted it. But the fact that Russian government media is running it and claiming definitively that it is proof of Ukrainian aggression makes it important enough to question.

How to spot video and photo fakes

Understanding metadata

Metadata isn't foolproof

Metadata in action

Karl Murphy's ideas are part of this journey:

Related collections

Similar ideas