NZ Cyber Experts Question Authenticity of VP's Video Evidence

MANILA, Philippines — New Zealand cyber experts have weighed in on local investigators’ use of digital forensic methods to show Vice President Sara Duterte’s Nov. 23, 2024 press briefing had not been altered before being presented as evidence. The experts walked through the testimony of National Bureau of Investigation Senior Agent John Mark Calilung, the prosecution’s first witness, who had outlined the steps probers took to preserve, authenticate and store the footage. Calilung testified that the livestream was first located on Harry Roque’s Facebook account, after which he submitted a preservation request to Meta to ensure it would remain available. He said he made a copy of the livestream by recording it using Open Broadcaster Software (OBS) and manually compared the recorded copy with the original livestream to ensure they were identical. Calilung said he generated a hash value calculation on the recording to ensure that it would not be tampered with before it was presented in court. New Zealand cybersecurity expert Adam Burns of BlackVeil Security said a hash value can demonstrate file integrity but cannot establish whether the original livestream itself was authentic. “It can show that a specific file has not changed since the hash was generated,” Burns said. Burns said the NBI’s manual comparison and later hashing supported the integrity of the preserved OBS screen recording but noted that screen captures do not preserve Facebook’s native file, server-side records, upload history or metadata. “But that is different from independently authenticating the original Facebook livestream,” he said. “It does not, by itself, prove that the original Facebook livestream was genuine, complete, unedited before preservation, or correctly attributed. “For fuller authentication, investigators would usually look to chain of custody, URL/account records, timestamps, capture settings, platform records or metadata, network logs, and corroborating evidence.” New Zealand computer scientist and software engineer James Noble said a hash function avoids the need to compare large amounts of data by computing and comparing much smaller values known as “hashes.” “The rule is that two absolutely identical data items will always have the same hash value; but it’s much quicker to compare those hashes than to compare all the data,” he said. He said it is possible but statistically very unlikely for two different items to also have the same hash. “That’s because hashes necessarily lose information: they are much smaller than the underlying data.” Under the Supreme Court’s Rules on Electronic Evidence, the party presenting an electronic document has the burden of proving its authenticity by demonstrating its integrity and reliability to the satisfaction of the court. Meanwhile, Sen. Panfilo Lacson yesterday stressed the importance of properly authenticating digital evidence, saying courts must exercise greater caution as artificial intelligence makes it increasingly difficult to distinguish manipulated content from genuine recordings. Lacson raised the issue during his questioning of Calilung on the third day of Duterte’s impeachment trial. Lacson clarified that he was not disputing the authenticity of the video but that he wanted to ensure that the evidence would be able to withstand judicial scrutiny.- Mark Ernest Villeza