Audio Authentication and the Electric Network Frequency Method

In an AC power grid the nominal frequency (50 Hz in Europe, the Middle East, Africa, and most of Asia; 60 Hz in North America and parts of South America) is maintained by the collective inertia of spinning generators. When demand rises faster than generation, the extra load slightly slows the generators and the frequency dips below nominal. When generation briefly exceeds demand, the frequency climbs above nominal. Grid operators have automatic frequency response systems that correct these deviations within seconds, but the corrections are never instantaneous, so the frequency never sits exactly at 50.000 or 60.000 Hz.

The deviations are small, typically a few millihertz, but they are continuous, complex, and sensitive to thousands of simultaneous events across the grid. The pattern of deviations over any given minute is effectively unique, because the same combination of demand events has never been reproduced. Multiple researchers, notably Grigoras and Cooper, demonstrated that a recording's embedded ENF trace could match a reference archive with sufficient statistical confidence to place the recording in time with a resolution of around a minute. Grigoras published foundational ENF criterion papers in 2005 and 2007 while affiliated with institutions in Romania before joining the University of Colorado Denver as director of the National Center for Media Forensics in September 2010.

The ENF signal in a recording is not the easily visible background hum of poorly screened equipment. It is a very low-amplitude component at the fundamental mains frequency and at its odd harmonics (150 Hz, 250 Hz in a 50 Hz grid; 180 Hz, 300 Hz in a 60 Hz grid). Speech energy and environmental noise can dwarf it by 40 dB or more. Extraction begins with narrow bandpass filtering around the target harmonic, usually the first harmonic (100 Hz or 120 Hz) because it carries more energy and sits in a region less crowded by room resonances.

1. Harmonic selection
   Choose the harmonic with the best signal-to-noise ratio in the recording. The 100 Hz (or 120 Hz) first harmonic is the default; for recordings with strong low-frequency interference, a higher harmonic may be cleaner.
2. Narrow bandpass filtering
   Apply a tight filter (typically ±0.5 Hz around the target harmonic) to isolate the ENF component from competing spectral content. The filter must track possible frequency drift.
3. Instantaneous frequency estimation
   Use short-time Fourier analysis or a Hilbert-transform-based phase unwrapping method to estimate the instantaneous frequency every second or half-second, building the ENF time series.
4. Quality assessment
   Check the signal-to-noise ratio of the extracted trace. A trace with many dropouts (sections where the ENF is indistinguishable from noise) cannot be reliably matched and the examiner must document the degraded coverage.

Once the ENF time series is extracted, the examiner computes the cross-correlation between the recording's trace and successive windows in the reference database. The computation slides the recording's trace one second at a time across the archived grid measurements and produces a correlation coefficient at each offset. A sharp peak in this correlation surface indicates the time in the database where the two series best agree, which corresponds to when and on which grid the recording was made.

A well-matched recording typically shows a single dominant peak well above the background correlation level. Examiners express confidence in the match using the peak-to-sidelobe ratio: if the highest peak is substantially larger than all others (commonly reported as a ratio above 3:1 or as a statistical significance threshold), the match is considered strong enough to report. If multiple peaks reach similar heights, the match is ambiguous and should not be reported as a definitive timestamp.

ENF authentication asks a narrower question than provenance: is this recording continuous and unedited? If a recording has been cut and segments rearranged, the ENF trace from the edited version will not match any single window in the reference database. Instead, the cross-correlation surface will show either no clean peak, or multiple moderate peaks corresponding to the different segments of the original source material.

A subtler edit, such as a brief deletion of a sentence, may be difficult to detect by the break alone if the deleted segment was short. But a deletion always shortens the recording relative to what the reference expects, so the examiner can look for the mismatch between the recording's length and the expected duration of the matched segment. Insertions from different recordings are easier to detect because the inserted material typically came from a different time (with a different ENF trace) or from a battery-powered device (with no ENF at all), creating a clear discontinuity.

The ENF database developed at the University of Colorado Denver's National Center for Media Forensics, with Grigoras as a leading contributor around 2010-2012, was among the first publicly documented archives designed specifically to support forensic casework in the United States. It records the 60 Hz grid frequency at several geographic nodes with one-second resolution, enabling retrospective matching for recordings made near those nodes. Similar archives for the UK National Grid have been used in criminal cases in England, where courts have accepted ENF testimony from accredited examiners.

Published casework reports (from IAFPA and the AES forensic audio working groups) have described ENF used to expose fabricated confessions where investigators suspected the recordings had been edited. In several instances the ENF trace showed the recording could not have been made at the stated time, supporting challenges to the authenticity of the evidence. In other cases a clean ENF match to a specific grid window corroborated the stated recording date and helped close down alibi arguments.

The ENF method fails in four main scenarios, and an examiner must document each before concluding the method is applicable:

• Outdoor recordings: without grid-powered equipment nearby, there is no electromagnetic or optical ENF source to couple into the recording. The absence of ENF does not authenticate or discredit the recording.
• Battery-powered devices in shielded environments: a phone recording in a basement with no powered lighting can produce a clean recording with no ENF component, even indoors.
• No reference database for the grid: many national grids, particularly in parts of Africa, Southeast Asia, and Latin America, have no maintained forensic-grade archive. ENF extraction may succeed but matching remains impossible without a reference.
• Codec and compression artefacts: heavy lossy compression (MP3 at low bit rates, mobile voice codecs) can distort or destroy the ENF component. The examiner should check the ENF SNR of the recovered trace before drawing any conclusion.