“For open source information to be admissible as evidence in court, prosecutors and counsel must typically be able to establish its authenticity and chain of custody.”OHCHR & Human Rights Center, UC Berkeley School of Law · Berkeley Protocol on Digital Open Source Investigations · 2022 · «Berkeley Protocol on Digital Open Source Investigations» (ONU, New York și Geneva, 2022), capitolul I «Introduction»
Preserve before you interpret, because a deleted post can no longer be proven.
The Berkeley Protocol, published by the UN human rights office (OHCHR) together with the Human Rights Center at Berkeley, sets international standards for digital open source investigations. It grew out of a courtroom problem: smartphone photographs and videos posted online, some compromised or misattributed, cannot serve as evidence if they were collected and kept with unsound methods. The Protocol divides an investigation into six phases: online inquiries, preliminary assessment, collection, preservation, verification and investigative analysis. In practice the steps look like this: log every search (term, platform, date); capture the material in full, with its metadata, and record a cryptographic hash at collection; keep the original untouched and work on copies; verify the source (who posted it, when, from where) separately from the content (geolocation, chronology, shadows, weather); only then interpret. It pays off whenever a finding may end up before a court, a regulator or a hostile journalist. The trap is the reverse order: interpreting first and preserving later — by which time the post has been deleted or edited, and you can no longer show what you saw.
The card tells you what you must be able to show: origin, integrity, the material's path. The next step is less visible: everything is decided in the first minutes, before you know whether the material matters. The moment you click on a post is already the moment you can lose the evidence. If you don't capture the full page right away, with its address, time and context, the source can be edited or deleted before you decide it's relevant. That is why the Protocol treats preservation as a reflex, not as a step you take once you're convinced. A simple example: you see a video of an incident and tell yourself you'll come back to it. By then, the account that posted it is gone. What you remember can no longer be verified by anyone. The practical rule: capture first, judge later. And once you've captured it, the next question appears: how do you prove that copy is identical to the original?
The previous passage ended on a question: how do you prove your copy is identical to the original? The Protocol's answer is the cryptographic fingerprint. At the moment of collection, you compute a hash: a short code generated from the file's content. If the file changes by even one pixel, the code changes completely. You don't need to understand the math; you just need to record it at the same moment as the capture. A hash computed later, from a copy already handled, proves nothing about the original. An everyday example: it's like weighing the package at delivery, not the next day, after the box sat open on your desk. Collection is also when you set aside metadata: time, device, who made the capture. But a good fingerprint says nothing about who posted the material. That is where the next step begins.
Why it matters An open source finding that nobody can retrace step by step is an opinion, however good the image.