Can a screenshot of a single image from a cell phone video recorded by an unknown person located on an unidentified Facebook account where the video was deleted shortly after uploading be authenticated for use at trial? That was the question a trial court in Maryland (USA) and the appeal court needed to address. At first glance, it would be reasonable to assume that the answer would be a definitive “no” given that the courts were dealing with a perfect storm of evidential challenges. The cell phone video was recorded by an unknown person and the original video was never located. The owner of the Facebook site was not determined, and the cell phone video disappeared soon after discovery, leaving no trace of its existence. This article discusses the importance of contextual circumstantial evidence in assessing the authentication of images tendered as evidence.

In Harmon v. State of Maryland, 2024 WL 1975255 (Appellate Court of Maryland), the appellate court was asked to review whether the trial court erred in admitting a still shot obtained from Facebook. An altercation occurred in a bar and CCTV video captured the event from various camera angles. The CCTV video evidence was tendered by the prosecution and admitted at trial without objection. The video images showed the appellant with a knife in his hand after throwing the victim to the ground. The appellant did not dispute this interpretation of the video evidence.

The day after the altercation, the police officer investigating the incident found a cell phone video posted on a random unidentified Facebook page. He testified at trial that the Facebook video depicted the same event shown on the bar CCTV video recordings. He noted that it showed what he perceived to be the same people wearing the same clothing. The officer was unable to download the video, and it was removed from Facebook within minutes of the officer discovering it. He did however capture a single screen shot with his cell phone. The prosecution alleged that in this single image, the appellant was observed to be holding a knife in his hand prior to the time he threw the victim to the ground. On the facts of the case, this single image was important for the prosecution’s case and countered a version of the events favoured by the defence.

At trial, the defence challenged the authenticity of the Facebook image on the basis that the photographer was unknown and that no version of the video was available for examination. All that remained of the cell phone video was the single screenshot recorded by the officer. The defence also asserted that the image may have been manipulated and that without being able to evaluate the full video, that could not be determined. The trial court admitted the image on the basis that while it could not be authenticated on its own, its authenticity could be sufficient established by reference to the admitted CCTV video evidence. In short, the authenticated CCTV video could be used to authenticate the Facebook image.

The appellate court reviewed the relevant law on authentication in Maryland and noted that the authentication threshold for the tendering party is low – there need only be sufficient evidence such that a jury might find the evidence to be authentic. In this case, the authenticated bar CCTV video evidence was the foundation for arguing the authenticity of the Facebook image. As to whether the Facebook image showed the appellant and whether the person depicted had a knife in his hand, those were questions for counsel to argue before the jury.

Discussion

Authenticating images requires that the tendering party establish that the images are that which they are purported to be. Fundamentally, this requires proof of date, time, location, and image integrity. But the bar is low. There need only be some showing of evidence on these points. Once that threshold is met, the trier of fact will be permitted to see the evidence and assign whatever weight to it they deem suitable. There are several articles on this website on image authentication and I encourage readers to review them for more details. In this commentary, I will focus on circumstantial proof of authenticity.

There is a tendency to think of image authentication as something that must be proven directly. As a prosecutor, I was always able to establish authenticity by direct evidence. Indeed, that is the easier route and therefore the most preferable approach. Direct proof can come from the photographer, an eyewitness to the event, a homeowner or business owner who can comment on their surveillance system, the person who exported the video from the recording device, or an attending police officer who viewed the video on location. There are times when direct proof may not be available. A good example, as occurred in Harmon, is when apparently relevant video or other images are located on social media or other open source sites. When the photographer is unknown and there is no access to the original media, there must be a way to link the questioned images to the event in question. Two key methods for accomplishing this task are through linkage media and eyewitnesses.

Linkage media refers to images that can be independently authenticated and which may then be used to circumstantially establish the authenticity of other images that cannot be independently authenticated. For example, broadcast news recordings of an event can be used to authenticate an anonymous video or still image found on social media if it can be shown that there is a clear overlap or convergence of content. Similarly, CCTV or authenticated cell phone recordings can also provide the linkage foundation necessary to prop up errant images. This is the approach that was followed in Harmon. Once the CCTV was authenticated, the single screenshot of the same event could be assigned an authentication foundation because of the content overlap. Other examples of this authentication method are given in articles on this site.

Eyewitnesses can also be used to authenticate media that cannot otherwise be authenticated. This would require that an eyewitness to the recorded event be located and shown the questioned recording. The witness would have to confirm that they were at the event shown, that the video fairly depicted what they observed, and be able to substantiate its date and time. Ideally, the eyewitness would be able to identify people (perhaps themselves) or objects shown in the images, which would then open the door to further opportunities to pursue authentication witnesses. Relying upon eyewitnesses for authentication purposes engages the challenges that are often associated with eyewitness evidence but it would be preferable to have that option available than to have no method of authentication at all.

When relying upon circumstantial proof of authenticity, image integrity must also be addressed. Without access to the original images or the photographer, the tendering party must lead some evidence as to whether the images are trustworthy. This may be accomplished through eyewitnesses and investigators but in other cases, expert evidence may be required. Such evidence would be aimed at content-based analysis given that the original media is not available for metadata interrogation. This topic is addressed in other articles on this site.

For further information on image authentication, see Image-Based Evidence in International Criminal Prosecutions: Charting a Path Forward, where an entire chapter is devoted to this topic.