RTL Nieuws is a Dutch television news service produced by RTL Nederland. The 19:30 news on tv channel RTL 4 is watched by an average of 1 million viewers each day
In December 2014 RTL TV News opened with headline news reporting RTL obtained two photos of what could be showing the smoke trail of a BUK missile. According to two experts consulted by RTL the photos are genuine.
When I asked RTL to show me the method of investigation RTL refused to do so. RTL even did not clarify why they do not provide insight into the method of investigation.
RTL Nieuws several times appealed to the Dutch Wet Openbaarheid van Bestuur (WOB = Freedom of Information Act) to force the Dutch government to release confidential papers on MH17. So far without luck.
However, when RTL Nieuws itself is challenged for being transparent the organization seems to have double standards.
RTL obtained from a Torez, Ukraine based photographer three photos. Two show a white plume of smoke going upwards. The photos were made at July 17, 2014 minutes after the crash of MH17. The smoke could have been the trail of a BUK missile which downed MH17. RTL had the two photos examined by NIDF (Nederlands Instituut Digitale Fotografie) and Fox-IT.
The photos in RAW format are not made available to the public. The photographer does not want to make the RAW files public. Nobody besides the experts consulted by RTL and Bellingcat were able to analyse the photos on possible manipulation.
RTL wrote about the investigation of the photos:
To check the method and tools used by both NIDF and Fox-IT I contacted RTL’s deputy editor-in-chief Pieter Klein and requested him to have insight into the reports written by the consulted experts.
I was told Fox-IT did not deliver to RTL a document describing the method of investigation. Fox-IT basically told RTL: “we studied the photos and we did not detect any manipulation”. RTL as far as I know never requested Fox-IT to document the method of investigation.
Initially RTL offered me to read the NIDF report in the RTL office. However, a few days later RTL told me on second thought reading the report was not possible. The reason given was ‘bronbescherming’ (protection of the source).
My next question was if RTL was able to explain this protection. The name of the photographer is well known so that cannot be the issue. RTL however did not explain why they want to protect the source.
I once again explained to RTL that I want to know the method and tools used by the experts. On Monday July 4 RTL wrote to me by email that they are not willing to make public the method and tooling used by the experts RTL consulted. RTL wrote that the information about the investigation can be found on the website. However, there is no information whatsoever which provides any info on the method the experts used.
What do we know about the expertise of NIDF and Fox-IT on digital photography forensic investigation? A look at the Fox-IT website does not provide any information on expertise of digital photography. Fox-IT is about the most knowledgeable company in the field of cybercrime in the Netherlands. Their knowledge and experience on detecting manipulation of digital photos remains a mystery.
I called Fox-IT and asked if they can explain the method of investigation. Fox-IT said they cannot inform me about that.
What about NIDF? NIDF is a one-man organization run by Dutch photographer Eduard de Kam. De Kam has been hired in the past by Volkskrant, World Press Photo and Zilveren Camera (competition for best photo of the year) to verify that digital photos are not manipulated.
I had a nice and interesting telephone conversation with Mr De Kam at July 6. I introduced myself as a citizen journalist doing research on MH17. De Kam told me he got the RAW files from RTL and RTL requested him to examine the photos. De Kam stated that RAW files (the file format used by Nikon digital camera’s is NEF) cannot be adjusted. De Kam cannot guarantee for 100% the photo was not manipulated. However it must be a very difficult job for an expert to manipulate a NEF file.
I agree with his conclusion. I did some research on internet about NEF files. A NEF file is basically a container with several types of data in it:
- the original image data captured by the pixels of the sensor. This data might be compressed. This is called the ‘original instruction set’ or sensor data. Basically this is a digital negative. It is not in an image format like JPG.
- the metadata. This contains data like camera type, lens type, date and time the photo was made, all kind of info on colour, whitebalance etc.
- a thumbnail of the photo in a viewable image format.
- delta image information or alternate instruction set. This contains adjustments to the original instruction set (sensor data).
Nikon has some information on the website.
NEF file can be saved as a TIFF, JPEG or again as a NEF with the addition of any applied Capture NX2 processing saved inside the file as a second or alternate instruction set. As long as the original NEF file is preserved, the “digital negative” remains untouched; processing a NEF file does not alter the original instruction set.
However, a digital file like NEF is just bits. Using a tool you might be able to adjust the bits of the sensor data. However this is really a complex job. Some camera’s use hashing to prevent manipulation of the sensor data.
Nikon, the type of camera used to make the plume photo’s, uses a method called ‘Nikon Image Authentication System’ to guarantee the original sensor data cannot be modified without being noticed.
NEF must be made public
The photographer stated he does not want to make the NEF files public. Initially he mentioned privacy reasons. Later he stated he was told by Australian and Dutch police he is not allowed to hand over the NEF.
However he handed over the NEF files to RTL and Bellingcat. And we all know the name of the photographer.
At least two independant experts with knowledge on forensics of digital photos must investigate these NEF files to make 100% sure the image was not manipulated.
A few days before the publication of this blog post I sent the draft version to deputy chief editor Pieter Klein of RTL. Minutes before publication of this blog and after three requests for comment via email Pieter Klein finally responded. He stated “Bronbescherming is bronbescherming” which translates to “protection of my source is protection of my source” which basically means “I am not going to tell you anything about my source”
It is remarkable the news organization insisting the government for transparency has double standards when transparency is requested from RTL itself. RTL is not able to even explain why they do not want to provide insight into the methods and tooling used to verify the photos are not manipulated.
NIDF did not do a forensic investigation into manipulation of the sensor data of the NEF file. To be able to add any value to the images, such an investigation is a must.
The method of investigation by Fox-IT is not known. The fact they did not hand over a report to RTL can indicate the level of investigation.