Hard Binding
The file is 4.2 megabytes and it is named PLAINTIFF-EXHIBIT-14.jpg and I have been looking at it since before my coffee went cold.
A girl on a bicycle in a crosswalk. A box truck coming down on her. The light over the crosswalk is green. The girl is Holly Brandt, nineteen, and by the time the phone took the picture she had less than a second. The truck hit her at forty-one miles an hour. She died on the asphalt before the paramedics cleared the far side of the intersection.
The defense calls the photograph their centerpiece. Green light, for the truck. It carries Content Credentials, signed and timestamped, the little checkmark that says this is what it says it is. Last year that checkmark was a technicality. In this hearing it is the case.
My name is Marisol Reyes and I authenticate images for courts. Not what they show. Whether they hold together. Those are two different sentences and the difference has cost me most of my hair.
I have the file open in three programs at once. The reference validator, the one the standards body ships. The verifier that comes attached to the biggest photo platform on earth. The enterprise tool my lab licenses for four thousand a month. I feed each one the exhibit and watch the colored boxes fill in.
Reference: PASS. Platform: PASS. Enterprise: FAIL.
I run the enterprise tool again.
PASS.
I run it a third time. The spinner turns. Somewhere in a server farm in Virginia a state machine reads the same claim it read ninety seconds ago and decides the other way. Now I have screenshots of three runs, two saying the manifest is valid and one saying it is not, and all three of them are right.
The signature on the exhibit is good. The certificate chains up to a root on the trust list. The timestamp is inside tolerance. Nothing in this file is broken. The file is wrong. Only one of those sentences is a crime.
I print the screenshots and staple them in order and write the times in the margin in pencil, which is a habit from before any of this, from when I verified film negatives with a loupe and a light table and the only signature was a notary’s stamp. I was good at that. I was never this tired.
Let me tell you how the lock works, because if you don’t know the lock you’ll think I’m lying.
The signature is stored inside the file it describes, in a JUMBF box in the JPEG’s header, just ahead of the scan. A hash cannot cover the bytes that store the hash, so the standard excludes them: it declares an exclusion range (the ground the signature stands on) and hashes everything else.
It is not a bug. It is in the spec in plain language, section and subsection, so that no one can ever say they were surprised. The standard is honest about the hole. It puts a fence around it and says, whatever is in here, we are not signing.
I pull the box length. 47,312 bytes. I pull the exclusion range out of the claim. 48,520. The claim is signed, so the exclusion is signed, and it is exactly 1,208 bytes larger than the box it is supposed to be protecting.
1,208 bytes of this file that no validator on the planet will hash. They spill past the manifest and over the first rows of the scan, which is where the light hangs. I go and look at them. They decode to the traffic signal. The traffic signal is red.
There is a version of this where I call the prosecutor and the thing blows open. I want to be clear that I tried. I fed the file to six validators total, mine and the county’s and two I downloaded off the internet on a burner laptop. Four said valid. One said invalid. One crashed. Last spring a group in Oslo ran twenty thousand signed files through six conformant implementations. They split on a few hundred of them, and the splits clustered on three things: unknown assertions, timestamps, and exclusions. The one thing the validators cannot agree on is the hole.
Here is what the signature actually attests. It attests that this manifest, these bytes, were signed by this certificate, and that the certificate chains to a root somebody on a committee decided to trust. It says nothing about the pixels. It has never said anything about the pixels. People hear the checkmark and think it means true. They hear a doctor say benign and think nothing will ever hurt them again.
I am not supposed to have a stake in this. I am court-appointed. I get paid by the hour either way. But I have a stake, and I’ll tell you why, and then I’ll get back to the file.
Four years ago I authenticated a still frame in a workers’ compensation case. A man in a warehouse, lifting a refrigerator off a pallet, timestamped and signed. The insurer used my report to cut off his benefits. A year later the opposing expert showed the refrigerator had been swapped in from another photograph. My signature analysis was correct. I was a stopped clock, right twice a day. The man lost his house. I did not lose my license, because I had not done anything wrong.
So when a file with a clean signature shows me a red light painted green, I do not get to call it a forgery. I get to call it a file with a clean signature. I have explained this to three attorneys this week and none of them have liked it.
The exhibit was signed by Meridian Provenance. Meridian is a company owned by a man named Gene Kaplan, who signs images for campaigns, insurers, and two newsrooms you have heard of. I looked him up the night the file landed on my desk. He is fifty-six. He has a face you would trust with your car keys.
I have met him once, at a conference, in the coat check line. He told me he had never once lied about a file. He said it like a man who had practiced saying it. I believed him then. I still believe him.
The deposition is in a conference room on the eleventh floor with a view of a parking garage. Kaplan comes in carrying his own coffee, which no one does, and sits down across from me and says good morning to everyone by name, including the court reporter, whose name is on a little card and also on her mug.
Plaintiff’s counsel is Nguyen, who is good and knows it. She starts with the exhibit. Kaplan answers in short sentences. Yes, Meridian signed it. Yes, Meridian’s process is automated. No, he does not personally review every file, there are eleven million files a month, no human reviews eleven million files a month. Yes, he is aware of the alteration now.
Then Nguyen hands him the box length and the exclusion length, and asks him to explain the difference.
He asks for a legal pad. She pushes one across. He draws a rectangle and then a small box inside it and shades the small box, and he does it slowly so the reporter can see, and there is nothing theatrical about it, which is somehow worse.
“This is the file,” he says. “This is where the signature lives. The signature can’t sign the part of the file it lives in, so the standard tells us to exclude these bytes and hash the rest. It’s called the exclusion range.” He taps the shaded box. “Mine is a little bigger than it needs to be. That’s allowed. The spec says the exclusion must cover the manifest. It doesn’t say how tight.”
Nguyen: “You left 1,208 bytes of unhashed room in a photograph you signed for a wrongful death case.”
Kaplan sets the pen down. “I left room in eleven million files. It’s a default. It protects against re-serialization. If a platform rewrites the box on export and the exclusion is tight, the hash breaks and the file goes invalid and my customer’s photo gets flagged. So I pad it. Everybody pads it.”
“And into that padding,” Nguyen says, “someone put a different traffic light.”
“Someone,” Kaplan says. “I don’t know who. I sign files. I don’t paint them.”
“You’re not accused of painting it.”
“Then we agree.”
She brings out the trust list next. The standard’s conformance program publishes a list of validators a court is supposed to rely on, and to get on that list a company certifies its implementation. Certifies, as in, files paperwork. The program does not run the validators against known forgeries. It has no test corpus of forgeries. It has a conformance checklist and a fee.
Kaplan looks at the list and finds his own name on it and does not look pleased.
“I sat for that checklist,” he says. “I paid the fee. I’m on the same list as your expert’s tool, which is the tool that says my file is invalid. We’re both approved. That’s the problem, and it’s not mine.”
Nguyen asks whether he thinks the standard is adequate.
He thinks about it. He takes a real amount of time.
“I was in an accident a few years ago,” he says. “Not a car. Somebody put my face into a video I never made. Tens of thousands of people that happened to this year, a few hundred documented incidents. Mine cost me a contract and a marriage. The standards that were supposed to protect me worked exactly as specified. Every signature verified. And it did me no good at all, because the thing that mattered was never the signature. It was whether anyone believed the signature.”
Nguyen: “So you built a company that sells belief.”
“I built a company that sells what the standard says,” Kaplan says. “You want the standard to mean what it doesn’t say. I sell what it says. The hole is yours, not mine.”
He drinks his coffee. Nobody says anything for a while. The court reporter’s fingers are still.
The court has to decide which validator is the law. Judge Ferro takes it up on a Tuesday.
The plaintiff wants the enterprise tool, which said FAIL. The defense wants Meridian’s own implementation, which is also conformant, which said PASS. Both are on the approved list. Ferro asks the parties whether there is a higher authority. There is not. The conformance program certifies implementations without technical review, and the standard itself is silent on which implementation a court should take judicial notice of.
Ferro rules from the bench, and she rules correctly. She says the court can only take notice of a manifest’s validity as determined by the reference implementation published by the standards body, because otherwise any court anywhere would be picking a favorite vendor. The reference implementation says PASS.
Nguyen stands up and points out that the reference implementation is the same tool that padded the exclusion default. Ferro says that is a policy question for a legislature, and this is a courtroom, and she moves on.
I understand the ruling. I would have ruled the same way.
They put me on the record Thursday morning, in a hearing room with bad acoustics and a radiator that ticks.
Nguyen asks the questions slowly because she knows what is coming and wants it clean.
“Ms. Reyes. You examined Plaintiff’s Exhibit 14?”
“I did.”
“Did you find any alteration to the image data?”
“I did.”
“Did you find that the alteration changes the color of the traffic signal from red to green?”
“I did.”
“And did the manifest on this file validate?”
I look at my own report, which is open in front of me, which I wrote, which is true.
“The manifest validated,” I say. “Manifest integrity is valid. The signature is trusted. The content authentication result is PASS.”
Nguyen lets it sit for one second. Then she asks the only question that matters.
“In plain language. Is the photograph real?”
I have answered this question in eleven other hearings and it is always the same answer.
“The standard does not attest that the content of an image is true. It attests that the file has not been altered since signing.”
There is a woman in the second row with a cardboard folder on her lap and a lanyard that says VICTIM ADVOCATE. She is Holly Brandt’s mother. Her name is Ellen. She has been in the room for all of it.
Nguyen asks her next question. It is a good one, and I hate her for it, and I would have asked it too.
“So the checkmark on this photograph means nothing?”
I think about the stopped clock. I think about a room full of people who came here because a signature was supposed to stand for something.
“The checkmark is a lock,” I say. “Every lock ships with a keyhole. Somebody else had the key.”
Ellen looks at the folder. It has a photograph of her daughter taped to the front, not the exhibit, a different one, a school portrait.
“So it’s the same as nothing,” she says.
“It’s the same as a checkmark,” I say.
I write the report that afternoon.
The form is nine pages and the first eight are method. The last page is the certification. Authentication result, one field. Manifest integrity, one field. Signature, one field, TRUSTED. Timestamp, one field, WITHIN TOLERANCE. Assertions present, four. Assertions failed, zero. There is a notes field at the bottom that no one reads, because the record only carries the fields.
Into the notes field I write what I know. That the exclusion range is 1,208 bytes wider than it needs to be. That the alteration sits inside it. That no validator on the approved list will ever find it there. That the file is a forgery with a valid signature. It is all true and it is all in the notes and the notes are the one part of the form that is not a field.
Then I open a blank text file on my own machine and type the same four sentences into it, because I have learned not to trust a form’s margins. I save it to a folder I keep for things I do not send. A note that is not part of the record is not evidence.
I attach the report to the filing portal and I type my certificate number into the box at the bottom and I check the certification box, and the form goes into the record.
The portal returns a receipt in nine seconds. Filed at 16:41:07. Docket 2026-CV-04188. Exhibit 14, manifest valid, signature trusted, authenticated, admitted.
The printer down the hall coughs twice. I get up to go collect it before the clerk throws it in the recycling.