Dutch RTL Nieuws keeps plume photo investigation a secret

Facebooktwittergoogle_plusredditpinterestlinkedinmailby feather

RTL Nieuws is a Dutch television news service produced by RTL Nederland. The 19:30 news on tv channel RTL 4 is watched by an average of 1 million viewers each day

In December 2014 RTL TV News  opened with headline news reporting RTL obtained two photos of what could be showing the smoke trail of a BUK missile. According to two experts consulted by RTL the photos are genuine.

When I asked RTL  to show me the method of investigation RTL refused to do so. RTL even did not clarify why they do not provide insight into the method of investigation.

RTL Nieuws several times appealed to the Dutch Wet Openbaarheid van Bestuur (WOB = Freedom of Information Act) to force the Dutch government to release confidential papers on MH17. So far without luck.

However, when RTL Nieuws itself is challenged for being transparent the organization seems to have double standards.

The photos

RTL obtained from a Torez, Ukraine based photographer three photos. Two show a white plume of smoke going upwards. The photos were made at July 17, 2014 minutes after the crash of MH17. The smoke could have been the trail of a BUK missile which downed MH17. RTL had the two photos examined by NIDF (Nederlands Instituut Digitale Fotografie) and Fox-IT.

The  photos in RAW format are not made available to the public. The photographer does not want to make the RAW files public. Nobody besides the experts consulted by RTL and Bellingcat were able to analyse the photos on possible manipulation.

RTL wrote about the investigation of the photos:

Fox-IT and NIDF have carefully studied the photo files and according to them there is no indication of post-processing, fraud or manipulation of the three photos”

To check the method and tools used by both NIDF and Fox-IT I contacted RTL’s deputy editor-in-chief Pieter Klein and requested him to have insight into the reports written by the consulted experts.

I was told Fox-IT did not deliver to RTL  a document describing the method of investigation. Fox-IT basically told RTL: “we studied the photos and we did not detect any manipulation”. RTL as far as I know never requested Fox-IT to document the method of investigation.

Initially RTL offered me to read the NIDF report in the RTL office. However, a few days later RTL told me on second thought reading the report was not possible. The reason given was ‘bronbescherming’ (protection of the source).

My next question was if RTL was able to explain this protection. The name of the photographer is well known so that cannot be the issue. RTL however did not explain why they want to protect the source.

I once again explained to RTL that I want to know the method and tools used by the experts. On Monday July 4 RTL wrote to me by email that they are not willing to make public the method and tooling used by the experts RTL consulted. RTL wrote that the information about the investigation can be found on the website. However, there is no information whatsoever which provides any info on the method the experts used.

The experts.

What do we know about the expertise of NIDF and Fox-IT on digital photography forensic investigation? A look at the Fox-IT website does not provide any information on expertise of digital photography. Fox-IT is about the most knowledgeable company in the field of cybercrime in the Netherlands. Their knowledge and experience on detecting manipulation of digital photos remains a mystery.

I called Fox-IT and asked if they can explain the method of investigation. Fox-IT said they cannot inform me about that.

What about NIDF? NIDF is a one-man organization run by Dutch photographer Eduard de Kam. De Kam has been hired in the past by Volkskrant, World Press Photo and Zilveren Camera (competition for best photo of the year) to verify that digital photos are not manipulated.

I had a nice and interesting telephone conversation with Mr De Kam at July 6. I introduced myself as a citizen journalist doing research on MH17. De Kam told me he got the RAW files from RTL and RTL requested him to examine the photos. De Kam stated that RAW files (the file format used by Nikon digital camera’s is NEF) cannot be adjusted. De Kam cannot guarantee for 100% the photo was not manipulated. However it must be a very difficult job for an expert to manipulate a NEF file.

I agree with his conclusion. I did some research on internet about NEF files. A NEF file is basically a container with several types of data in it:

  1. the original image data captured by the pixels of the sensor. This data might be compressed. This is called the ‘original instruction set’ or sensor data. Basically this is a digital negative. It is not in an image format like JPG.
  2. the metadata. This contains data like camera type, lens type, date and time the photo was made, all kind of info on colour, whitebalance etc.
  3. a thumbnail of the photo in a viewable image format.
  4. delta image information or alternate instruction set. This contains adjustments to the original instruction set (sensor data).

Nikon has some information on the website.

NEF file can be saved as a TIFF, JPEG or again as a NEF with the addition of any applied Capture NX2 processing saved inside the file as a second or alternate instruction set. As long as the original NEF file is preserved, the “digital negative” remains untouched; processing a NEF file does not alter the original instruction set.

However, a digital file like NEF is just bits. Using a tool you might be able to adjust the bits of the sensor data. However this is really a complex job. Some camera’s use hashing to prevent manipulation of the sensor data.

Nikon, the type of camera used to make the plume photo’s, uses a method called ‘Nikon Image Authentication System’ to guarantee the original sensor data cannot be modified without being noticed.

However. in 2011 a Russian firm was able to hack this system a described here and here.

NEF must be made public

The photographer stated he does not want to make the NEF files public. Initially he mentioned privacy reasons. Later he stated he was told by Australian and Dutch police he is not allowed to hand over the NEF.

However he handed over the NEF files to RTL and Bellingcat. And we all know the name of the photographer.

At least two independant experts with knowledge on forensics of digital photos must investigate these NEF files  to make 100% sure the image was not manipulated.

RTL response

A few days before the publication of this blog post I sent the draft version to deputy chief editor Pieter Klein of RTL. Minutes before publication of this blog and after three requests for comment via  email Pieter Klein finally responded. He stated “Bronbescherming is bronbescherming” which translates to  “protection of my source is protection of my source”  which basically means “I am not going to tell you anything about my source”

 

Conclusion

It is remarkable the news organization insisting the government for transparency has double standards when transparency is requested from RTL itself. RTL is not able to even explain why they do not want to provide insight into the methods and tooling used to verify the photos are not manipulated.

NIDF did not do a forensic investigation into manipulation of the sensor data of the NEF file. To be able to add any value to the images, such an investigation is a must.

The method of investigation by Fox-IT is not known. The fact they did not hand over a report to RTL can indicate the level of investigation.

 

 

Facebooktwittergoogle_plusredditpinterestlinkedinmailby feather

14 Comments on Dutch RTL Nieuws keeps plume photo investigation a secret

  1. Charles Wood // July 7, 2016 at 9:36 am // Reply

    It would be interesting to see if there is any Nikon website that can verify an (image) cryptographic signature. I doubt it.

    Whether there is a check site or not, as the elcomsoft site points out, the private key is always stored on the camera and can be extracted and used to sign any images. It’s even likely that all Nikon cameras have the same private key, so a breach of one is a breach of all.

    • Not possible. After all you can print out a photoshoped image, turn the camera clock back, and photograph the image. So, you’ve got a genuine nef of a fake image.

  2. I am really scared by the exports being invoked to tell whether the Aleynikov photos are photoshop or not. Because in a court room the export opinion is undisputed. I wish those experts were presented with 100 photos of smoke over a background, with half images being photoshoped and half genuine (I think I can do this photoshop job well enough). Just to verify that they really can tell the true from the fakes.

    • Charles Wood // July 7, 2016 at 10:10 am // Reply

      Actually, in a courtroom expert evidence is always disputed. Even if there is only one expert it will be disputed. Though usually there are at least two experts and a bunch of lawyers who know nothing about the topic, but are willing to argue over completely irrelevant ‘facts’ using the experts as stage props.

  3. We already know one of the images was manipulated. The blue sky smoke trail photo had the wrong weather conditions so it was claimed to have been enhanced.

    • sotilaspassi // July 11, 2016 at 6:40 am // Reply

      Unless, I’m mistaken, the blue sky was/is made by brightening the cloudy photo, to make the plume visible.

  4. Charles Wood // July 7, 2016 at 12:51 pm // Reply

    Looks like Nikon gave up on image authentication…

    discontinued product:

    http://www.nikonusa.com/en/nikon-products/product-archive/imaging-software/image-authentication-software.html

  5. I’ve just had a mad idea. What if we devise a test for those experts to tell a photoshop? Each user of this site sends two different pictures of a smoke over a background, one fake and one not, accompanied with a hash of a source file that was used to create the fake picture. Then “the experts” decide which picture in each pair is fake. After that the source of the fake in each pair is revealed (and verified by the public hash) and wee see how good the experts are.

    Pretty sure Belingcat or their experts will reject such a challenge.

    • I am sure none of the experts will cooperate. I just hope I raised the bar a bit about how carefull an image should be examined. Lets see what the expert consulted by BC has to say about the photos and more important, what tooling he used.

      Also, for us layman it is impossible to manipulate a NEF file.

  6. Liane Theuer // July 7, 2016 at 6:10 pm // Reply

    NEF files can be altered with Exif Viewer (in German) :
    http://www.nikon-fotografie.de/vbulletin/allgemeine-bildbearbeitung/166038-nef-aufnahmedatum-exif-mit-exif-viewer-aendern.html

    And with ExifTool by Phil Harvey
    Read, Write and Edit Meta Information!
    http://www.sno.phy.queensu.ca/~phil/exiftool/

    • Lianne: I explained in my post about RTL how the structure of a NEF RAW file it. Someone really needs a lot of skills to alter the sensor data.
      Changing some of the metadata is a piece of cake.

  7. Liane Theuer // July 7, 2016 at 6:43 pm // Reply

    BC and RTL can not be in posession of the original flashcard. Because Pavel stated that he gave the
    original flashcard to the SBU, but made a copy of it.
    Later the JIT requested for the camera and the original flashcard.
    BC and RTL got the pictures only after that. I think NOT from the JIT but from Pavel.
    So they have a copy from Pavels copy !

    Now the question arises how Pavel has copied the flashcard.
    The hole flashcard or only some pictures ?
    Via his PC or a harddisc or a dual card slot ?
    The answer to this question is important, because it gives an indication of how the metadata are transferred and could be altered.

Leave a comment

Your email address will not be published.


*