Digital Evidence Preservation Challenges Highlighted in Sara Duterte Impeachment Trial

MANILA, Philippines – The methods and technicalities of preserving digital evidence have become a focal point in the ongoing impeachment trial of Vice President Sara Duterte at the House of Representatives. On Tuesday, July 7, the House panel of prosecutors presented its first witness, Senior NBI Agent John Mark Calilung. Calilung testified regarding a screen recording of an online briefing held by the Vice President on November 23, 2024. During this briefing, Duterte allegedly stated that if something were to happen to her, an assassin was already prepared to attack specified targets: President Ferdinand Marcos Jr., First Lady Liza Marcos, and former House speaker Martin Romualdez. The video was livestreamed on Facebook via the page of former spokesperson Harry Roque. Calilung stated he screen-recorded the video from Facebook to preserve it as evidence. Calilung mentioned he has training in digital forensics, though the duration of this training was questioned by some senator-judges. During his testimony, he was asked to explain technical terms unfamiliar to the general public, such as "OSINT" and "hash values." OSINT, or Open Source Intelligence, refers to information gathered from publicly available sources. This includes scouring Facebook pages and posts to understand personal connections and activities, as well as reviewing old blog posts, websites, and even Discord or Telegram channels. It is a method of utilizing all accessible public information on the internet, employed by journalists and cybersecurity researchers alike. Calilung explained that screen-recording the Facebook livestream constituted an OSINT process because the evidence was collected from publicly accessible online sources. Furthermore, the NBI conducted additional OSINT, which led them to discover an online press conference from October 18, 2024, where Sara allegedly made remarks about imagining cutting off President Marcos Jr.'s head and exhuming his father's remains to throw into the West Philippine Sea. Calilung provided Senate President Win Gatchalian with an explanation of what OSINT is. Must Read SPECIAL COVERAGE: Impeachment trial of Sara Duterte Once the publicly available video was identified, the next step was preserving it in a way that could later withstand scrutiny in court. First, he verified that the video he recorded was the same as the video on Facebook by comparing the two. “After screen recording, there’s an output video. I compared the output video with the November 23, 2024 video and ensured that the contents are identical,” he said. This speaks to the nature of digital files. When a person screen records, there could be a glitch of some sort that garbles the speech or image in the video. Rechecking the video ensures that there are no serious glitches that occurred in the process of preservation. Next, Calilung testified that he generated a hash value for the video. A hash value is a string of characters generated by a mathematical algorithm that serves as a digital fingerprint for a file. The smallest change, even just one pixel, will result in a different hash value. A hashing tool, running a hashing algorithm, is used to generate a hash value. By generating a hash value immediately after preserving the file, investigators can later demonstrate that the file has not been altered. “After ensuring that the contents are identical, I generated a hash value calculation on the video to ensure that the video won’t be tampered until presented in court,” he said. While the hash value protected the video’s integrity, Calilung explained that they also made a preservation request to Meta, Facebook’s parent company, which preserves the page in which the video appears. This provides provenance—its origin and history—of the data, allowing investigators to show that indeed the video publicly appeared on Facebook. The locally preserved copy and the platform preservation request serve different purposes. The first protects the evidence investigators collected, while the second preserves records held by Meta that can later corroborate where and when the content appeared. Further, Calilung also testified that several former reporters including Bonz Magsambol of Rappler and the late Dempsey Reyes of Inquirer were previously interviewed by the NBI about the online briefing in question to provide further authentication. Both confirmed they were present during the briefing, and heard the Vice President’s alleged grave threats. Play Video When most people record their screen, they record and that’s it. But in cases where one wants to be able to point to a file’s authenticity, there are indeed steps to take to protect a digital file’s integrity. Digital files are prone to manipulation, especially when it comes to videos in the era of deepfakes. All of these steps help establish what is called a “chain of custody” in digital forensics, whose goal is to demonstrate that the evidence presented in court is the same evidence originally collected. Calilung will appear again on Wednesday, July 8, for the defense’s cross-examination. – Rappler.com Source: Rappler Philippines