Berkeley Protocol on Digital Open Source Investigations

1 card

1. 01

   Open source material becomes evidence only when you can show where it came from, that it has not been altered, and what you did with it from the first search onwards.

   Berkeley Protocol on Digital Open Source Investigations · 2022

   Preserve before you interpret, because a deleted post can no longer be proven.

   The Berkeley Protocol, published by the UN human rights office (OHCHR) together with the Human Rights Center at Berkeley, sets international standards for digital open source investigations. It grew out of a courtroom problem: smartphone photographs and videos posted online, some compromised or misattributed, cannot serve as evidence if they were collected and kept with unsound methods. The Protocol divides an investigation into six phases: online inquiries, preliminary assessment, collection, preservation, verification and investigative analysis. In practice the steps look like this: log every search (term, platform, date); capture the material in full, with its metadata, and record a cryptographic hash at collection; keep the original untouched and work on copies; verify the source (who posted it, when, from where) separately from the content (geolocation, chronology, shadows, weather); only then interpret. It pays off whenever a finding may end up before a court, a regulator or a hostile journalist. The trap is the reverse order: interpreting first and preserving later — by which time the post has been deleted or edited, and you can no longer show what you saw.

   “For open source information to be admissible as evidence in court, prosecutors and counsel must typically be able to establish its authenticity and chain of custody.”

   Open the card →