The hunt for the camera behind the imagery

Suppose we have a photograph or video recorded during a crime by its perpetrator (think child sexual abuse material, extremist propaganda, or pictures of illicit materials used by an OCG). Suppose, as is often the case for media transmitted over messaging apps or circulated online, its metadata is missing. How could we identify its author? How could we prove their authorship in court? How can we prove we have the so-called first generation image?

In cases where a camera has been confiscated from a suspect, these questions have a well-established answer: Sensor Pattern Noise (SPN). Modern digital cameras, such as those found in mobile phones, are arrays of photosensitive diodes. Each diode registers light intensity at its location as a pixel in the image produced by the camera. Ideally, all the diodes would register the same pixel value for the same intensity. However, like any manufactured component, these tiny semiconductors are imperfect, and each one over- or under-registers intensity up to some tolerance. When these unique cells are stacked into a phone’s sensor array, they form a kind of fingerprint, with the differences between them forming ridges and bumps in sensitivity, just like the pits and curves of the skin on a finger. Each phone’s sensor pack is completely unique (whether it has 1, 3, or even 5 sensors is immaterial), and will stamp its mark into every image and video it takes.

The imperfections are too small for SPN to be perceptible to the naked eye. However, with the aid of some relatively straightforward image processing, it is possible to compare the SPN in a given image to a known good pattern from a camera. The camera’s SPN is determined by taking many pictures of a blank surface in laboratory conditions. Forensic scientists routinely exploit these facts to prove that a given camera produced a certain photograph or video.

What if we don’t have the camera?

Suppose the physical camera that took an image has not yet been located (it may be hidden, destroyed, or simply not yet known to an investigation). To overcome this hurdle, research scientists at Polygeist, in collaboration with the UK MOD, have developed Hornet: a novel technology that tests whether two or more images or (for the first time) videos contain the same SPN. So, rather than looking for the physical camera, we can search for other photographs or videos taken by that camera. For instance, by trawling through those in hard drives confiscated from a suspect’s home, those a suspect has shared over email, messaging, or social media (such as on their publicly-visible Facebook profile), or even media present in potentially related or historical investigations. Using Hornet, we can check in milliseconds whether any of these share the same SPN as the photograph or video recorded during the crime. If any do, we have evidence that directly links the suspect to the crime - if required, with confidence levels higher than DNA evidence.

What if we don’t have a suspect?

This technology alone is remarkable, in fact we have heard “I am surprised this can even work at all” from photography experts that we have collaborated with. If you have holdings of millions of images, finding an unknown camera requires incredibly fast and scalable extraction and comparison of SPN patterns.

This is where the high performance computing experts have come in. At Polygeist we have developed a stack of technologies for processing huge amounts of evidential media, on hard drives and online. Combined with some computational optimisations, we have been able to process national scale data, allowing investigators to search for the camera behind the media.

Interested in Hornet? We’d love to tell you more about it. Book a briefing with our experts by clicking the link above.