Contingency plan for maintaining system integrity while preserving photographer privacy.
The Birthmark Standard is designed to never need investigations. Camera compromise requires ~$100K-$1M per device. But we need a response plan for state-level attacks and credibility challenges. This documents our contingency—transparent safeguards for Coalition members, privacy advocates, and journalists evaluating the system.
Key point: Investigations don't create new risks. Anyone can submit images to forensic services today—we're formalizing it with oversight and stronger protections.
✓ Transaction ID (posted to Public Revocation List for manufacturer blacklisting)
✗ Camera serial number (manufacturers handle blacklisting internally)
✗ Photographer identity
✗ Image content (Foundation never sees the image)
✗ Capture locations or times
✗ Who you shared images with
Trigger cost: $500 (forfeited if rejected)
Evidence required: Professional forensic analysis of claimant-submitted image
Governance: 3-member committee (journalism orgs, 6-month rotation)
$500 claim fee, forfeited if rejected. $1,000 total return if camera blacklisted ($500 refund + $500 bounty). Makes frivolous claims expensive while rewarding legitimate concerns. Any Coalition Member can waive fees for credible cases.
Coalition contracts professional photography forensic analysts (e.g., Bellingcat). Claims require claimant to submit the image file. Analysts examine images for specific measurable anomalies: noise pattern inconsistencies, impossible lighting geometry, metadata violations, sensor artifact mismatches. "This looks suspicious" gets rejected immediately. Foundation never sees submitted images—only image hashes if committee approves action.
Regions on CPJ's Global Impunity Index or active conflict zones require:
Submission servers encrypt transaction logs after posting to blockchain. Decryption keys are stored on different geographic submission servers with rotating key schedules—each time window requires a different server for decryption. This prevents any single server compromise from revealing historical transaction data and requires sequential attacks within rotation windows.
Only Transaction ID is posted to Public Revocation List. Manufacturers handle device blacklisting internally by referencing the PRL against their own logs. Foundation and Coalition never see camera serial numbers. Historical images remain authenticated—blacklist blocks future submissions only. Successful appeals completely remove Transaction ID from PRL (no "reversed" notation).
Annual public reports (claims, blacklists, appeals, geographic distribution). Any Coalition Member can access investigation materials. Five-year recurring review with option to sunset investigations if Coalition determines capability has become harmful or unnecessary.
No. Investigations only reveal Transaction IDs posted to the Public Revocation List. Manufacturers handle device blacklisting internally by referencing the PRL against their own logs. The Coalition, Foundation, and submission servers never learn camera serial numbers. Manufacturers may not have purchaser records (secondhand sales, gifts). System designed so no entity correlates "this person took this photo" without already possessing the image.
CPJ Index regions and conflict zones get unanimous vote requirement, mandatory press freedom org consultation, higher evidence threshold, expedited appeals, and escalation rights. Investigations never reveal photographer identity, specific camera serial numbers, content, or location—only Transaction IDs on the PRL. Manufacturers handle blacklisting internally based on their own logs.
Images can only be investigated if shared with claimants who submit them for forensic analysis. At that point, risk equals existing forensic services (anyone can submit to FotoForensics today). Investigation doesn't reveal photographer identity or specific camera—only posts Transaction ID to PRL for manufacturer reference.
$500 non-refundable fee per rejected claim. Claims need professional forensic evidence before reaching committee. "This makes us look bad" gets rejected at preliminary review, fee forfeited.
Device owners who discover blacklisting (via failed future submissions) can appeal. Submit hashes of critical images immediately (authenticated while appeal proceeds). Provide technical explanation. Independent expert reviews forensic evidence. Committee votes (2 of 3, max 14 days; 7 days for high-risk contexts). If successful, Transaction ID completely removed from PRL with clean records. Coalition Members can expedite for photographers in high-risk contexts.
Coalition consists of journalism/press freedom orgs (NPPA, CPJ, RSF, IFCN) whose mission is protecting against surveillance expansions. Using investigations for non-technical purposes is explicit grounds for removal per Governance Charter. Annual public reports enable external monitoring. Five-year sunset reviews acknowledge this may not always be necessary.
Manufacturers handle device blacklisting internally—they can reference the PRL but Coalition never learns camera identities. Accessing encrypted transaction logs requires compromising multiple geographically distributed submission servers within key rotation windows. Government compulsion of Coalition nodes triggers removal, not compliance (per Governance Charter). Transaction IDs on PRL don't reveal photographer identity or which specific camera without manufacturer cooperation.
If compromised cameras can mint valid certificates for AI-generated images indefinitely, the system becomes worthless. The alternative is accepting a single breach authenticates unlimited fakes forever. Question isn't "should investigations exist?" but "how do we make them as safe as possible while maintaining integrity?" This framework balances system credibility with photographer protection.
Transparency: Annual public reports enable external monitoring.
Accountability: Any Coalition Member can access materials and escalate decisions.
Adaptability: Five-year reviews with sunset option as threats evolve.
Trust: Journalism orgs govern this system. If they determine investigations have become surveillance tools, they can vote to sunset the capability.
Coalition members can vote to sunset investigations entirely if they determine the capability has become harmful or is no longer necessary. This isn't permanent infrastructure—it's a contingency plan subject to ongoing evaluation by organizations whose mission is protecting press freedom.
Questions? contact@birthmarkstandard.org