This and its accompanying article are about the probability that the Trump hospital pictures were taken on the date and at the time appearing from the published screenshots of the EXIF viewer. This shouldn’t need saying, but they are not advanced treatises, still less advice, on all the technical and legal issues which can arise when handling electronic data. For that you will want to take specialist advice.
Years ago, just before I gave my first ever talk to judges about electronic Discovery, someone said “For God’s sake, don’t tell them about metadata”. He was probably right at that time, but we have moved on, and no one seriously involved in electronic Discovery will dispute the value of metadata as a means of identifying and validating electronic communications.
I refer quite often to the metadata (strictly EXIF – Exchangeable Image File Format data) which lurks behind most electronic photographs. It has proved crucial in uncovering the truth in many cases, both by directly contradicting what appears from the photograph itself, and by undermining the credibility of parties and witnesses who produce it.
President Trump or his social media advisers have inadvertently given us an example. Photographs appeared at the weekend of Mr Trump allegedly working while in hospital. He wore a jacket in one picture and not in the other, and was seen in different rooms. The obvious aim behind this variety was to show that Trump was hard at work on different occasions.
Rather incautiously as seen in retrospect, Trump’s advisers chose to publish the EXIF data behind each picture. That showed that only ten minutes separated the two pictures. If the aim was to show that the president was hard at work, it has backfired. What we see instead is a deliberate falsification of circumstances designed to allay public concern about the President’s health. We instead conclude exactly the opposite.
With one picture, we do not need to see the EXIF data to suspect that it is false. A folder sits on the table by Trump’s left hand. Some have questioned whether it was actually there at the time of shooting. The folder itself and the reflection of his hand and cuff looks odd. I think it is as shot, but I would not have looked twice or doubted it had the context not made me already suspicious. And that’s part of the point – once you have cause to doubt, you see falsification everywhere. That matters if your evidence is in front of the world’s press or in a court
With Trump, as with our own Boris Johnson, we rather assume that we are being lied to anyway – neither man seems to care if they are caught making false public assertions. Once you have been caught falsifying one bit of evidence, however, then all the rest becomes suspect. That point, as well as the importance of photograph metadata, is well illustrated by a case from the Admiralty Court of England and Wales called Kairos Shipping Ltd & Anor v Enka & Co LLC & Ors  which I have written about before.
The case involved the sinking of a vessel, Atlantik Confidence. The owner said it was an accident, but insurers thought otherwise. Among the evidence were pictures showing the sinking. The sequence of events was important, but could not be determined without knowing the timings of the pictures. Metadata from the Owner’s pictures turned up rather late in the day, on the eighth day of trial, causing the naval architects to “reconsider their work”. I give the whole of paragraph 22 of the judgment, mainly to suggest that you would rather know about these things somewhat earlier than the eighth day of trial:
The photographs were the most important evidence for the naval architects to study in forming their views as to the compartments which had flooded and in what sequence. This was observed by HFW when making an application for specific disclosure of the photographic metadata in March 2015. Captain Toran replied in his disclosure statement dated 14 May 2015 that “electronic copies of all photographs in the [Owners’] possession have been provided to HFW on 14 January 2015. Therefore, HFW have just as much access to the metadata as we have.” Notwithstanding this response, during the trial and following the electrician’s evidence, the Owners disclosed the metadata for the electrician’s photographs. This disclosure, on 22 April 2016, after Day 8 of the trial, required the naval architects to reconsider their work. Other “photographic” developments during the trial included (a) the evidence of Captain Taner (one of the superintendents who went to the vessel after she had been abandoned and before she sank) that he had taken photographs on 2 April 2013 when no photographs for that date had been identified at that time and (b) the evidence of Mr. Uzun (the Owners’ insurance broker) that photographs which had been disclosed as having been taken by the Omani coastguard had in fact been taken by a private company. Captain Toran was asked during his cross-examination to explain why the metadata from the electrician’s photographs had only been produced a few days earlier. He replied that he had not known what metadata was and had discovered from the internet that it was the date of the photograph. He said that it was very hard to collect all the metadata and so he had put all the photographs into one file (I assume an electronic file) which he sent to Clyde and Co. in 2013. Then, the week before he gave evidence, he said he had done the same again. He was asked again why the metadata from the electrician’s photographs had only been provided the week before. He replied that counsel would have to explain what is meant by metadata.
The story gave the judge an understandably cautious view of the evidence emanating from the captain. He said this in paragraph 25:
Captain Toran’s unsatisfactory evidence regarding disclosure of the photographic metadata and the circumstances in which the master altered course does not mean that he cannot have been telling the truth when he denied being part of a conspiracy to scuttle the vessel but it does mean that I must treat his evidence, like Mr. Agaoglu’s evidence, with caution.
We are almost past caring whether Trump is lying. As with Boris Johnson, it is easiest and best to disbelieve what is said by him or on his behalf unless some external evidence corroborates it. In this case, the unambiguous EXIF data shows the truth behind the reports that Trump was well enough to be working. Instead, all we know is that he was capable of sitting at a desk signing a blank piece of paper (its blankness is another part of the story).
Part of the purpose of discovery / disclosure is to provide support for the recollections of witnesses or to challenge them. A contemporaneous document which supports your evidence is good to have. Most forgeries are done retrospectively to prop up a story, and much detective work goes into showing that a document came into existence at a time later than its apparent date. In the old days, this may have involved analysis of paper and signatures; later cases have turned on typefaces and printer styles – remember the Pakistan story of the document dated 2006 but printed in Calibri which was not then available? Now the clues often lie in metadata.
The Trump pictures remind us that a document may have been created at the time to help create an illusion. Metadata and EXIF data can be altered, but if that had happened here, the dates would have been moved apart, not separated by only ten minutes.
Proportionality rules, of course. No-one is suggesting that the metadata of every document and picture must be examined for every case. In Trump’s case, the eyes of the world were on his health, and it was right to look closely at the self-serving pictures purporting to show that he was fine. In the Kairos case, the whole outcome might have turned on the timing of the pictures and, reading between the lines, the Owner’s bona fides were already under question.
No-one expects every lawyer to be expert in these things. What is required, however, is an extension of what they do anyway with other evidence – apply a kind of smell test to decide what may need closer examination.