Signed provenance, and where the chain breaks

The idea

Instead of examining a file for signs of generation, attach a signed statement about where it came from and what was done to it.

The main standard for this is the C2PA specification, whose user-facing name is Content Credentials. It was built by a coalition of camera manufacturers, software companies, news organisations and chip makers, and it is moving into formal international standardisation.

The mechanism is ordinary public-key cryptography applied to a manifest:

1. A capture device or a piece of software creates a manifest — a structured record: what made this, when, with what settings, and what actions were applied.
2. The manifest is signed with a certificate belonging to the device or software vendor.
3. The manifest travels with the file, and a hash binds it to the content, so altering the pixels invalidates the signature.
4. An editor that supports the standard adds a new signed manifest referencing the previous one, building a chain.

Anyone can then verify the chain: this was captured by that model of camera at that time, opened in that editor, cropped and colour-corrected, and exported. Or: this was generated by that model, then edited.

What it does and does not claim

This is the part people get wrong in both directions.

It attests to a process, not to truth. A signed manifest saying "captured by a camera" does not mean the scene was not staged, that the caption is accurate, or that the photograph was not taken somewhere else entirely. Provenance answers where a file came from and nothing about what it means.

It does not detect anything. There is no analysis of the pixels. If a file has no credentials, the system has nothing to say, which is the same absence problem as watermarking.

A valid signature is only as good as the certificate. Trust flows from a list of accepted signers. A compromised or improperly issued certificate signs false manifests that verify correctly.

Where the chain breaks in practice

This is the honest part, and it is where the technology currently stands.

Most software does not participate. Open a credentialed file in an editor without support and export it, and the credentials are gone. Much of the free toolchain this course recommends does not yet carry them.

Most platforms strip metadata on upload, historically for privacy and file size. Several major platforms now preserve or re-attach credentials, and many do not.

Screenshots break everything. A screenshot is a new file with no history, and screenshots are how an enormous share of images travel.

Cameras are only starting to ship it. Support arrived first in a small number of professional bodies and by firmware update on some others. The overwhelming majority of photographs are taken on phones, where deployment is partial and recent.

The consequence: today, a file with valid credentials tells you something useful, and a file without them tells you nothing, which describes almost everything you will encounter.

Why it is still the right direction

Two reasons it deserves support despite the gaps.

It improves as generators improve. Detection gets harder every year. A signature does not care how good the generator is.

It handles the harder half of the problem. The urgent question is increasingly not "is this fake" but "is this real" — a genuine recording that somebody wants to dismiss. Only provenance can answer that, and no detector ever will.

What to do now

If you make things: turn credentials on where your tools support them. Recording that a piece is generated, and what was done to it, is the same discipline as keeping the layered file, and it costs a setting.

If you assess things: check for credentials as a first step, treat their absence as uninformative, and remember that a valid manifest tells you about a process rather than about a claim.

There is a privacy consideration that deserves stating, because it is the strongest objection to the whole approach. A provenance record can carry device identifiers, timestamps and edit history, and a photographer working somewhere dangerous may need none of that attached to their file. The specification allows redaction and selective disclosure for exactly this reason, and whether those controls are used well in practice is a live question. Anyone advocating provenance as a default should be able to answer what it means for a source photographing a protest, and "you can turn it off" is only an answer if turning it off does not itself become evidence of something.

And keep expectations calibrated. This is infrastructure being built while it is needed, with real gaps between the specification and what actually happens to a file on its way through the world. Saying so is not scepticism about the project. It is the difference between using it correctly and trusting it wrongly.