Synthetic Media in Casework and Legal Proceedings

In common-law jurisdictions, the party tendering a digital exhibit bears the initial burden of authentication: they must show it is what they claim it is. For video evidence this typically means presenting the chain-of-custody log, the hash value confirming integrity since collection, and if challenged, forensic evidence that the file has not been manipulated. This is the standard authentication framework developed for digital evidence since the 1990s and codified in rules such as the US Federal Rules of Evidence Rule 901 and the UK's Criminal Procedure Rules Part 19.

When a party alleges deepfake, they raise a different objection: not that the file was altered after collection, but that the content was entirely synthesised before collection. The legal question is whether a bare allegation of deepfake is sufficient to require the tendering party to adduce further authentication evidence, or whether the alleging party must produce positive evidence of synthesis. Current practice in most jurisdictions does not yet have a settled answer, but an emerging consensus in published academic commentary and early case law suggests that bare assertion without any forensic basis is insufficient to block admission, while a supported forensic allegation shifts the burden.

Standard digital forensic chain-of-custody practice requires: acquisition of the original file in a forensically sound manner (write-blocked imaging or verified download), cryptographic hash at acquisition, secure storage with access logs, and hash verification at each transfer and at court presentation. These steps answer the question of whether the file was altered after collection. They cannot answer whether the content was synthesised before collection.

• Source platform documentation: where was the file obtained? A direct legal-process download from a platform's evidence portal carries higher provenance weight than a screenshot or re-encoded copy provided by a party.
• Upload timestamp verification: platform upload logs obtained via legal process provide a timestamped record of when the file first appeared. This can establish a timeline relative to the alleged depicted events.
• Format and encoding provenance: the encoding history visible in the video container header can reveal re-encoding steps. Multiple re-encoding passes suggest post-production processing and may correlate with known deepfake distribution workflows.
• Device comparison: if the tendering party claims a specific device captured the video, the file's encoding parameters, noise characteristics, and optional EXIF data should be consistent with that device's known output profile.

Expert testimony on deepfake detection is relatively new, and courts have not yet uniformly agreed on the applicable admissibility framework. In the US, Daubert standard analysis (Federal Rules of Evidence Rule 702) requires the expert's methodology to be based on sufficient facts, employ reliable methods, and apply those methods to the facts in a reliable way. A deepfake detection opinion based on a published detector with documented false-positive and false-negative rates on a relevant test set is on firmer Daubert footing than one based solely on visual inspection or unpublished in-house methods.

The framing of expert opinion matters as much as the technical basis. An expert who testifies that the video is a deepfake makes a categorical claim that may overstate what the forensic signals support. An expert who testifies that the face region shows artefacts consistent with GAN upsampling and inconsistent with authentic camera capture, based on specific measured features, makes a more defensible claim. The distinction mirrors the established best practice in other forensic disciplines: opinions should be framed in terms of what the evidence is consistent or inconsistent with, not as certainties.

Signal-analysis deepfake detection answers one question: does this file carry artefacts of a synthetic generation pipeline? OSINT verification answers a different question: is there independent evidence that the depicted events occurred or did not occur? Both lines of inquiry are valuable, and in many cases OSINT provides faster or more conclusive answers than signal analysis, particularly when the generation method was sophisticated enough to suppress forensic artefacts.

1. Reverse image and video search
   Search engines and dedicated tools (Google Lens, TinEye, InVID) can identify prior appearances of the same image or video online, establishing whether the file predates the alleged event or was lifted from unrelated content.
2. Geolocation
   Visible landmarks, building styles, signage, and vegetation in the image can be matched against satellite imagery and street-view data to verify or contradict the claimed location. Bellingcat and similar open-source investigative groups have published methodology standards for this.
3. Temporal analysis
   Shadow directions can be cross-checked against solar position calculators for the claimed date, time, and location. Weather archives can corroborate or contradict visible weather conditions.
4. Witness and source corroboration
   Social media posts from accounts present at the location at the claimed time, contemporary news reporting, and official agency communications can independently establish whether the depicted scenario is plausible.

The most widely reported pattern involves deepfakes as a defence tool: an accused party claims a genuine incriminating video is synthetic. This has occurred in documented cases, including a 2023 Texas child exploitation case in which defence experts initially raised deepfake allegations before prosecution experts found no synthesis artefacts and the prosecution established authenticity through converging evidence.

The reverse pattern also arises: a prosecution presents synthetic media created by a defendant as evidence of intent, capacity, or planning. In fraud and harassment cases, the creation of a deepfake video targeting a victim is itself the offence, and the exhibit tendered is the synthetic file, not a genuine recording of the defendant. Here the prosecution must authenticate the file as synthetic, not as a genuine capture, which requires the same detection toolkit used in the opposite direction.

A third pattern, less discussed, is the use of deepfake allegations to discredit genuinely authentic evidence: the liar's dividend. A party may allege, with or without forensic support, that incriminating video is synthetic, relying on jury unfamiliarity with deepfake technology to create reasonable doubt. Courts and legal practitioners increasingly recognise this pattern, and several published judicial training materials in the UK and Australia address it explicitly.

Legislative responses to synthetic media have focused initially on non-consensual intimate deepfakes. The UK's Online Safety Act 2023 made it a criminal offence to share non-consensual intimate deepfakes; the Data (Use and Access) Act 2025 (Section 138, in force February 2026) extended liability to the creation of such content, regardless of whether it is shared; further provisions were added by the Crime and Policing Act 2026. Scotland enacted separate provisions under the Abusive Behaviour and Sexual Harm (Scotland) Act 2016 as amended. These statutes create evidentiary requirements for prosecutors to establish both the synthetic nature of the content and the absence of consent.

• United States: the DEFIANCE Act (2024) creates a federal civil cause of action for non-consensual intimate deepfakes. Several states (Texas, Virginia, California, Georgia) have criminal statutes; federal criminal provisions remain under legislative consideration as of mid-2024.
• European Union: the EU AI Act classifies high-risk AI systems used for impersonation and requires mandatory disclosure labelling on AI-generated content where it could deceive the public. Member states are required to implement enforcement mechanisms. The EU's proposed Media Freedom Act and the General Data Protection Regulation intersect with synthetic media in data-rights and image-rights contexts.
• India: the Ministry of Electronics and Information Technology issued advisory guidelines in 2023 requiring AI platforms to label deepfake content and making the generation and distribution of misleading deepfakes potentially actionable under existing IT Act provisions, pending specific legislation.
• Australia: state-level legislation on non-consensual intimate images applies to synthetic versions in several jurisdictions; the Online Safety Act 2021 gives the eSafety Commissioner removal powers over deepfake intimate content.

For forensic scientists, jurisdictional variation has practical consequences. The specific statutory elements that must be established, whether the image is synthetic, whether consent was absent, whether the person depicted is identifiable, vary by legislation and affect what the forensic report must address. A report prepared for UK proceedings under the Online Safety Act has different evidentiary requirements from one prepared for a US civil DEFIANCE Act claim.