There’s an ongoing trend with big news events. First, many news reports are so eager to be “first!” that they will report unvetted information as fact. This coincides with the news broadcasts that report baseless speculation as fact. Shortly after that comes the slow trickle of real information. Unfortunately, this real information is typically buried under fake reports and random conspiracy theories.
Add in a war scene that already has propaganda and false reports, and you have the makings for a lot of confusion and false information.
Let’s start with the only facts that nobody seems to be debating.
On 17-July-2014, Malaysia Airlines flight MH17 was shot down over the Ukraine. The plane was struck by Russian Buk — a type of surface to air missile (SAM).
Currently, the news reports (that can be vetted) are showing indications that one side (Russia) is totally lying about the facts, preventing access to the debris, and interfering with the investigation. You just know that, when a second government-sponsored news reporter publicly quits because she refuses to report the false information coming out of the Kremlin, the propaganda has got to be really bad.
Shortly after the reports about the airliner were made public, a few details came out on social media. A couple of people asked me to evaluate a picture found on Facebook. This picture comes from Cor Pan’s facebook page. He was a passenger on flight MH17 and he posted one of the last photos of the airplane prior to take-off.
Sadly, when any major event happens, we receive false reports and people who make stuff up just for the shock factor. I was asked to determine if this picture is real. And since the passenger manifest had not, at the time, been made public, we couldn’t just look for his name. Is this picture real or a hoax?
The problem with everything at Facebook is that pictures get stripped, resaved, and passed around. It is relatively easy for someone to create a fake Facebook page just for the shock value. And no amount of metadata analysis on a Facebook image will identify even a real photo as being real.
Fortunately, there are other data points we can analyze. For example, last month Facebook rolled out a new JPEG compression system. This system leaves very distinct JPEG attributes that are detectable. Evaluating the picture shows these artifacts and indicates that it was uploaded recently — this is not an old picture at Facebook. However, if someone downloads a photo and then uploads it, it will be processed by the new JPEG encoder and it will look “new”.
The other clue comes from the Facebook profile itself. This picture was uploaded to Facebook on Thu, 17 Jul 2014 09:03:30 GMT. This timestamp comes from the HTTP metadata’s “Last-Modified” field. According to news reports, the flight took off around 10:15 GMT from Schiphol airport near Amsterdam, or about 75 minutes after the photo was posted to Facebook. This creates a very narrow timeframe: the person arrived at the airport, snapped the photo and posted it shortly before the flight, then the flight took off and was shot down hours later (14:15 GMT).
Since it’s virtually impossible to predict a horrific event such as this, this posting to Facebook — which predates the flight and mentions someone believed to be on the flight — has every reason to appear to be real.
Or to put it another way, had the Facebook account been created after the plane was destroyed, or the photo posted after the explosion, then we would have been certain it was fake. Similarly, if the photo was posted long before the flight, it would likely be fake. However, this is not the case, so we can conclude that it appears to be real.
In contrast to this picture, some of the short video clips that claim to show MH17 crashing predate the event and are posted days later. These indicate inconsistent timelines and identify many of the video clips as fake. A few of these fakes have been debunked in the Open Newsroom.
It did not take long for some people to start intentionally evaluating pictures incorrectly in order to propagate conspiracies. For example, Shane Kimmins tweeted a screenshot from Peter J Kuehlen. (Peter claims to be an “Oil Armageddon specialist”, but I think he’s a certified paranoid nutjob. And since Kimmins is gullible enough to believe what Kuehlen says, well, it means Kimmins can’t be very intelligent even if he is very vocal.)
Here’s the screenshot that Kimmins posted to Twitter:
In this posting, Kuehler asks, “How come fotoforensics show the date of January 25 2012 for the making of this picture?” The answer is really simple: it doesn’t.
The FotoForensics metadata for this picture identifies a color profile attached to this picture. Facebook attaches the same color profile to every uploaded picture (that’s one of my complaints about Facebook). You can clearly see that the “Profile Copyright” says “FB”, indicating Facebook. An ICC Profile is just a file that gets embedded with the picture during a resave. The profile creation date says “2012:01:25 03:41:57″ — so Facebook created their color profile back in 2012 and has been attaching it to every uploaded picture ever since then. (I even have a tutorial that describes how ICC Profiles work.)
Since Facebook strips out metadata, we don’t know the actual time this photo was taken. In contrast, the Facebook HTTP header tells us that the photo was uploaded 75 minutes before the flight. We don’t know when the photo was taken; we only know when it was uploaded to Facebook.
When I pointed this out to Shane Kimmins that the timestamp did not indicate when the photo was created, he tweeted back a reply that shows willful ignorance and a desire to further propagate his paranoid and conspiratorial views.
The two links that Kimmins provided point the Clues Forum. This forum seems to spend nearly all of their time propagating paranoid fantasies and seeing who can come up with the best conspiracy. One of the postings even has “A Little Trivia“, where they point out three airplane crashes that included the deaths of AIDS researchers. This has led to the conspiracy that someone is systematically killing leaders in AIDS research.
As my friend, Mr. Masters, put it:
Given enough data to cherry pick, any asinine idea can be supported. I think there is evidence that planes crash. Here we have three cases of flights and all three fell from the air and killed everyone. Coincidence?
Kimmins tweeted one other message that really irked me. He wrote:
While I do permit people to use FotoForensics in an unsupervised fashion, I also actively debunk the most gross examples of misuse for supporting conspiracies. I repeatedly debunked the Birthers, who believe so strongly that Obama’s birth certificate is fake, that they will explicitly and intentionally make up fake findings in order to support their claims. I have debunked staged and faked Syrian war photos and conspiracies related to other missing aircraft. (And that’s just the start of the list. I have plenty of blog entries where I debunk photos and conspiracies, and even a few where I debunk conspiracies by proving photos are real.)
Unfortunately, these false flags planted by Kimmins, Kuehler, and their ilk are dwarfed by the flood of misleading photos associated with the Ukraine on social sites like Twitter and Facebook, along with the insane cover-up statements coming out of Russia regarding MH17. When it comes to staged pictures, misrepresented photos, and false facts, Kimmins/Kuehler are wannabe’s, while the manipulators in Syria are mostly amateurs. Make no mistake: the Russians are the professionals, but even they can get tripped up. I’ll cover some of these other forms of propaganda in future blog entries.