Hand a file to the Digital Notary, the reference code for Chapter 10 that lives on this site, and it gives back one of four statuses: VERIFIED, WARNING, TAMPERED, or UNVERIFIED. That is the whole job. The chapter calls the exchange a reality handshake. The standard underneath it is C2PA, the Coalition for Content Provenance and Authenticity. Last week I said provenance is the one defense in the book that does not depend on the operators being careless. This is that defense, written as code.
The code starts by loading a public trust list kept by the Content Authenticity Initiative and binding those anchors to the reader. A comment in the snippet names Adobe, Microsoft, the BBC, Leica, Sony, and Nikon among them. The list itself is at https://contentcredentials.org/trust/anchors.pem. I do not know what has happened to that list since the manuscript locked. I have no sourced account of it, so I am leaving the gap open instead of guessing.
Go through the checks in order, because it is tempting to read the word verified as a synonym for true.
First the reader looks for a manifest, the credential bound to the file. If it finds none, it stops and returns UNVERIFIED, with the reason string “No credentials found (Gray Zone).” I expect most of the files a person actually meets to land here. All this status tells you is that nobody signed the file. The code does not call that file fake, and a reader should not either.
If there is a manifest, the reader checks the signing certificate against the trust anchors. A failure with a code beginning signingCredential comes back as WARNING, reason “Identity unknown or self-signed.” Someone signed, and that someone is not on the list the reader was handed. Tampering is a different fact. The code reports the two separately.
Integrity is a hash. The library checks the hard-binding hashes while it builds the reader, and a mismatch reported as assertion.dataHash.mismatch comes back as TAMPERED, reason “Hash mismatch (deepfake injection).” The parenthetical is the code’s own gloss. What the check knows is narrower: the bytes and the manifest no longer agree.
Pass both checks, identity and integrity, and the status is VERIFIED. The return carries the issuer, the claim generator, and the ingredients, which the comment calls the chain of edits. So a verified file has a signer on the trust list and content that still matches what was signed. Whether the scene in the frame happened is another question. A trusted newsroom can sign a false caption. The handshake checks who signed and whether the file changed, and it stops there.
Chapter 10’s second snippet, the Entropy Engine, is where a missing credential becomes part of a score. Chapter 5 already uses V for volume and R for rational deliberation and leaves P unused, so the newer code takes two-letter names to avoid a collision. Provenance Gap is the share of items in a stream with no C2PA credential. Its default weight is 1.5. The comment says what that means: unsigned content is treated as 50 percent more chaotic than signed content of equivalent reach. Above a chaos score of 0.85, the function says a circuit breaker should throttle. Those numbers are choices in a reference implementation. They do not describe how any platform behaves today, and I will not present them as if they did.
This lines up with what the column has already argued. In week eleven I wrote that detection arrives after the window and is itself disbelieved on schedule, so the way out is to mark the real rather than hunt the fake. In week fourteen I read Goldstein and Lohn’s three levers: norms against false claims of fakery, provenance technology, and public discernment. The third pulls against Chesney and Citron, because teaching people that fakes exist grows the liar’s dividend. In week sixteen I argued that the literacy worth paying for ends in a check. The handshake is that check, cut down to what a signature can say.
The bet is small, and it has to be. Of the four statuses, only TAMPERED comes near the word fake. A public that can see the other three has somewhere to put its doubt. A public with nothing but the word fake has nowhere. Who will ship this check, and when, I cannot say from here. The check itself is in the chapter, and it does not need the attacker to be sloppy.
Next week: the Verified Tier, a proposal for what a platform could do with those four statuses.
— J.W.B.
Note 19 of 24