Restoring trust in photography

An unaltered image can also lie

A photograph can retain all its original pixels and still support a lie. It only takes attributing it to a different city, changing its date or placing a misleading caption beneath it. None of these actions touches the image; all of them alter its meaning.

The opposite is also true. A photograph edited to correct the exposure or blur a minor’s face can still be an impeccable journalistic document. Editing is not, in itself, synonymous with deception.

That is why the classic question, Has it been manipulated?, no longer goes far enough. What readers need to know is something else: where the image came from, what happened to it along the way and whether the claims made about it correspond to what it shows.

Joan Costa maintained that every photograph contains a threefold message, which he summed up in three words: eye, object and objective. Every image tells us, at once, who took it (the eye), how they took it (the objective) and what it shows (the object).

For decades, that answer has been sought after the fact. Forensic analysis examines files that have already been captured and distributed, looking for traces: double compression, inconsistent lighting, the sensor’s fingerprint. It is essential work, but slow, costly and sometimes inconclusive. Traditional metadata —EXIF, IPTC, XMP— tell part of the story, although they can be deleted or rewritten with disquieting ease, either accidentally or deliberately. Their mere presence does not prove that they are truthful or establish who wrote them.

A certificate of origin for images

In contrast to that reactive approach, the Coalition for Content Provenance and Authenticity (C2PA) proposes a change in mindset. Rather than deducing after the fact whether manipulation occurred, the aim is to declare and sign each significant stage in an image’s life —capture, editing, composition— so that anyone can verify it later.

C2PA is the coalition that writes the open, royalty-free technical specifications for representing, signing and validating that provenance information. The Content Authenticity Initiative (CAI) complements this work on another front: outreach, cross-sector collaboration and open-source tools to help cameras, editors and platforms adopt the standard. One writes the rules; the other helps put them into practice.

The visible result is what are known as Content Credentials, or content credentials. They should not be confused with a simple graphic badge in the corner of a photo. Behind the icon is a structure —the manifest— that functions like a record of interventions: who made changes, when, with which tool and what was changed.

That manifest brings together a series of assertions about the content and protects them with cryptography. A digital signature, backed by certificates, allows a third party to verify that nothing has been altered since it was signed and to assess who is being trusted. In addition, mathematical fingerprints (hashes) bind that information to the specific image data, so that it cannot simply be transferred to another file.

Credentials can travel within the file, in a sidecar file or on an external server. Each compatible application can add a new link to the chain when editing the image, and when a piece combines several materials, the system records those «ingredients» and the relationship between them.

An important nuance: these credentials are not indelible. They can be removed. What cannot be done is to modify them while retaining a valid signature. Deleting is not the same as falsifying.

What the signature guarantees, and what it does not

C2PA itself is explicit: credentials make it possible to assess the provenance of content, but they do not in themselves establish its factual truth. To understand the technology’s actual scope, it helps to separate four questions that are often conflated.

Dimension	The question it answers
Integrity	Is the protected information the same as the information that was signed?
Signer authentication	Which credential supports the signature, and why should we trust it?
Provenance	What origin and transformations are documented?
Veracity	Do the image and its context faithfully depict what happened?

The first three can be addressed through cryptography and sound procedures. The fourth cannot. Satisfactory answers to the first three provide valuable evidence for investigating the last, but they do not settle it.

Two examples illustrate this well. A photograph signed at the moment of capture may depict a staged scene. It may also show, with complete authenticity, a screen displaying another image. In both cases, the digital record is genuine; the event it appears to depict is not necessarily so. Authenticating a file and verifying a fact are different tasks, and journalism cannot delegate the latter to a machine.

Newsrooms are already testing it

In a newsroom, the most immediate benefit is the ability to reconstruct part of a photograph’s journey: what information accompanied it into the system, what operations were declared along the way, and how the published version relates to the preserved originals.

There is publicly documented experience in this area. In August 2023, Reuters, Canon and Starling Lab announced that they had completed a proof of concept integrating the capture, recording of modifications and distribution of photographs with C2PA information. It was a documented example of editorial integration, although it should be understood for what it was: a pilot. It does not establish widespread adoption or, on its own, measure how much disinformation it prevents.

In May 2026, Canon introduced its Authenticity Imaging System for selected equipment and markets, following earlier technical tests with Reuters. The move points toward tools designed specifically for newsrooms. But the fact that a camera offers a feature does not mean it will work throughout every real-world publishing workflow, from the photographer to the reader’s screen.

Documentary filmmaking can benefit from the same approach. Consider a production that combines its own interviews, archival footage and reconstructions. A well-designed provenance process would make it possible to preserve the relationship between those materials and their derivatives, document each intervention and facilitate subsequent review.

Even so, responsibility remains human. A credential can record that a sequence is a reconstruction, but it is up to the production team to make that clear to the viewer. And knowing the origin of a shot says nothing about whether placing it next to another in the edit suggests a misleading association.

Limits worth remembering

Any technology that promises trust carries the risk of creating excessive confidence. Its limitations must therefore be part of how any credential is interpreted, not relegated to the fine print.

The beginning of the history matters. Adding credentials to an existing photograph documents how it is handled from that point onward, but does not reconstruct what happened before. A signature added when exporting from an editor is not equivalent to one generated by the camera at the moment of capture. In each case, the first link supported by verifiable evidence must be identified.

A protected claim can be wrong. If a date or location was entered incorrectly, protecting it against subsequent changes does not correct the error: it preserves it. Nor should the technical signer be confused with the human author. A credential may correspond to a device or a service without, by itself, identifying the person who took the photograph.

Credentials can be lost. Many platforms remove metadata when processing files. Complementary mechanisms, such as invisible watermarks or perceptual hashes, help recover credentials stored outside the file. Such recovery improves their persistence, but a recovered association does not prove that two files are identical.

The absence of credentials does not prove falsity. An image may come from an incompatible camera, a historical archive or a platform that removed its metadata. Automatically dismissing it would penalize legitimate sources, often the most vulnerable. Likewise, a credential stating that an image was generated with artificial intelligence can be perfectly valid: what matters is what it declares and how that content is used.

The specification is not the implementation. What a standard provides for and what each product does do not always align. A pre-publication study by Golaszewski and colleagues, released in April 2026, describes problems with timestamps, certificate revocation, integrity coverage and discrepancies between validators in versions 2.2 to 2.4 and the tools analyzed. This is critical evidence that deserves attention, without automatically extrapolating it to every product or later version.

Transparency, yes, but not at the expense of the person behind the camera

Transparency has a downside that journalism knows well. A precise location, a device identifier or the relationship between several files can reveal who took a photograph or who appears in it. For a reporter in a conflict zone or a human rights defender, that can pose a real threat. C2PA's own documentation acknowledges these risks, including their potential effects on independent media.

Before publishing credentials, each newsroom must decide which data to make public and which to keep in a restricted archive. Verifiable provenance should not become a tool for surveillance.

The reliability of the system also depends on something less visible: the custody of signing keys. The CAI recommends protecting them with hardware security modules or key management services. An institutional signature is only meaningful as long as the organization genuinely controls who can issue it.

Finally, there is the question of long-term preservation. Documentary archives must be capable of being validated ten or twenty years from now, when today's certificates have expired. Trusted timestamps help establish when something was signed, although they do not prove the moment when the scene was captured. Preserving the materials and the evidence of their validation will remain the responsibility of whoever has custody of the archive.

A practice, not a seal

None of these safeguards works if reduced to an icon that is on or off. Credentials add value only within a procedure that separates three stages: receipt of the material, technical validation and editorial assessment. A newsroom, archive or production company seeking to adopt them could start with these guidelines, adapting and testing them in its own environment.

1. Preserve what was received. Save the file exactly as it arrived, record its provenance and calculate its cryptographic hash. That hash makes it possible to check that the saved copy does not change over time; it does not prove that its contents are truthful.
2. Validate and document. Use an appropriate tool and record its version, the date and the full result. Check the signature, claims, binding to the image, ingredients, timestamps and certificate status. Seeing an icon is not equivalent to passing those checks.
3. Define what has been demonstrated. Identify where the history begins, which operations are recorded and where there are gaps. An image without credentials is not the same as one with a broken signature or an untrusted certificate.
4. Verify the content and its context. Verify authorship, location, date and caption against independent sources and, when necessary, through forensic analysis. This step remains essential even when the credentials are impeccable.
5. Document every intervention. Preserve the originals, identify derivatives, and record crops, adjustments, anonymization and the use of generative tools in accordance with an explicit editorial policy. Also check the file that ultimately reaches the public, because content management systems and platforms can alter it.
6. Archive and explain. Keep files, reports and records of decisions, and tell readers what has been verified and what uncertainties remain.

That last point is perhaps the most important. It is more honest to say that an image has a verifiable provenance from a specific point onward than to give it a generic label of “true image.” Readers do not need a promise of infallibility; they need to know what has been verified and what has not.

C2PA and the CAI provide a solid foundation for making a photograph’s journey examinable at last. They allow certain claims about an image to be accompanied by evidence whose integrity and authorship can be verified. For journalism and documentary work, this means greater editorial accountability and the possibility of audits.

But an algorithm cannot restore trust. If trust is restored, it will be through a combination of three things: cryptographic evidence, procedures that anyone can reproduce, and the old craft of verifying facts. Technology can tell us where an image comes from. Deciding what it tells us is still up to us.