The impeachment trial of Vice President Sara Duterte has brought to the forefront the nuances in preserving digital evidence. On the second day of the trial, Senior NBI Agent John Mark Calilung testified about the process of screen-recording a Facebook livestream of a briefing by Duterte, where she allegedly made grave threats against President Ferdinand Marcos Jr., First Lady Liza Marcos, and former House speaker Martin Romualdez.
Calilung has training in digital forensics and two weeks of training on photo and video verification. He explained that the video was livestreamed on Facebook via the page of former spokesperson of Rodrigo Duterte, Harry Roque. Calilung screen-recorded the video to preserve it as evidence of Sara Duterte's utterances. He then compared the screen-recorded video with the original video on Facebook to ensure they were identical.
During his testimony, Calilung mentioned open-source intelligence (OSINT), which involves scouring through a subject's Facebook page and posts to gather evidence on their personal connections, working connections, or potential activities. He explained that OSINT is not limited to digital media and can also include old newspaper clippings or archives.
To preserve the digital evidence, Calilung generated a hash value for the video. A hash value is a string of characters generated by a mathematical algorithm that serves as a digital fingerprint for a file. The smallest change, even just one pixel, will result in a different hash value. By generating a hash value immediately after preserving the file, investigators can later demonstrate that the file has not been altered.
The NBI also conducted further OSINT, which led to finding an October 18, 2024 online press conference where Sara Duterte made similar remarks. Calilung provided Senate President Win Gatchalian with an explanation of what OSINT is.
The impeachment trial has shed light on the complexities of preserving digital evidence and the importance of OSINT in investigations. As the trial continues, it will be essential to examine the digital evidence presented and consider the nuances in preserving digital evidence.
"After ensuring that the contents are identical, I generated a hash value calculation on the video to ensure that the video won’t be tampered until presented in court,” Calilung said.
The trial has sparked discussions about the use of digital evidence in investigations and the role of OSINT in uncovering wrongdoing. As the country grapples with the implications of digital evidence, it is essential to prioritize transparency and accountability in the use of OSINT.
The impeachment trial is ongoing, and it will be crucial to monitor the developments and examine the digital evidence presented.
The Philippines has seen a growing reliance on social media and digital platforms, making it essential to adapt investigative techniques to effectively use digital evidence. The impeachment trial has highlighted the complexities of preserving digital evidence and the importance of OSINT in investigations.