What’s OSINT, hash values? Impeachment trial shows nuances in preserving digital evidence

MANILA, Philippines – On the second day of the impeachment trial of Vice President Sara Duterte on Tuesday, July 7, the House panel of prosecutors presented its first witness, Senior NBI Agent John Mark Calilung, for the first article of impeachment among 4 to be tackled: Sara’s alleged grave threats against President Ferdinand Marcos Jr., First Lady Liza Marcos, and former House speaker Martin Romualdez.

Central to the hearing was an online video of a briefing by Duterte held via Zoom on November 23, 2024, where she said that if something happened to her, there was already an alleged assassin ready to attack the aforementioned targets.

The video was livestreamed on Facebook via the page of the former spokesperson of Rodrigo Duterte, Harry Roque.

That is the video that Calilung, the agent assigned to the case, had screen-recorded on Facebook to preserve as evidence of Sara Duterte’s utterances.

Calilung said he has training in digital forensics, along with two weeks of training on photo and video verification — a length of training that some senator-judges appeared to question.

During his testimony, Calilung mentioned a few things that might not readily appear in the vocabulary of the less tech-incliined: OSINT and hash codes.

OSINT stands for Open Source Intelligence.

When one scours through a subject’s Facebook page and posts to gather evidence on their personal connections, working connections or a subject’s potential activities, that is OSINT. When you look at old blog posts or old websites where the person in question had written down something that would give you a clue to their activities, that is OSINT. When you get into Discord or Telegram channels to investigate how a certain group is acting, that is also OSINT.

It is merely one looking at all available public information that is accessible on the internet. It’s mostly associated with digital media nowadays but old newspaper clippings or archives can be considered OSINT as well.

Police perform OSINT. Journalists perform OSINT as do cybersecurity researchers.

By locating and reviewing the publicly available Facebook livestream, Calilung was conducting an OSINT process because the evidence came from publicly accessible online sources rather than private or covert collection.

Calilung later testified that the NBI conducted further OSINT as well, which led to them finding an October 18, 2024 online press conference where Sara also made remarks about having imagined cutting off President Marcos Jr.’s head, and exhuming his father’s remains and throwing them into the West Philippine Sea.

Calilung provided Senate President Win Gatchalian with an explanation of what OSINT is.

Must Read

SPECIAL COVERAGE: Impeachment trial of Sara Duterte

Once the publicly available video was identified, the next step was preserving it in a way that could later withstand scrutiny in court.

First, he verified that the video he recorded was the same as the video on Facebook by comparing the two. “After screen recording, there’s an output video. I compared the output video with the November 23, 2024 video and ensured that the contents are identical,” he said.

This speaks to the nature of digital files. When a person screen records, there could be a glitch of some sort that garbles the speech or image in the video. Rechecking the video ensures that there are no serious glitches that occurred in the process of preservation.

Next, Calilung testified that he generated a hash value for the video.

A hash value is a string of characters generated by a mathematical algorithm that serves as a digital fingerprint for a file. The smallest change, even just one pixel, will result in a different hash value.

A hashing tool, running a hashing algorithm, is used to generate a hash value.

By generating a hash value immediately after preserving the file, investigators can later demonstrate that the file has not been altered.

“After ensuring that the contents are identical, I generated a hash value calculation on the video to ensure that the video won’t be tampered until presented in court,” he said.

While the hash value protected the video’s integrity, Calilung explained that they also made a preservation request to Meta, Facebook’s parent company, which preserves the page in which the video appears. This provides provenance — its origin and history — of the data, allowing investigators to show that indeed the video publicly appeared on Facebook.

The locally preserved copy and the platform preservation request serve different purposes. The first protects the evidence investigators collected, while the second preserves records held by Meta that can later corroborate where and when the content appeared.

Further, Calilung also testified that several former reporters including Bonz Magsambol of Rappler and the late Dempsey Reyes of Inquirer were previously interviewed by the NBI about the online briefing in question to provide further authentication. Both confirmed they were present during the briefing, and heard the Vice President’s alleged grave threats.

When most people record their screen, they record and that’s it.

But in cases where one wants to be able to point to a file’s authenticity, there are indeed steps to take to protect a digital file’s integrity. Digital files are prone to manipulation, especially when it comes to videos in the era of deepfakes.

All of these steps help establish what is called a “chain of custody” in digital forensics, whose goal is to demonstrate that the evidence presented in court is the same evidence originally collected.

Calilung will appear again on Wednesday, July 8, for the defense’s cross-examination. – Rappler.com

SPECIAL COVERAGE: Impeachment trial of Sara Duterte

What’s OSINT, hash values? Impeachment trial shows nuances in preserving digital evidence

Related News & Content

Defense says objections during Calilung testimony "natural"