If the file can't prove itself, whoever holds its history wins
A person was indicted in a federal court in Texas on evidence of something that never happened. A confidential informant had handed the government fabricated audiovisual material, and it was convincing enough to produce charges. The case was later dismissed on the government's motion, with no explanation on the docket. The truth came out in open court only when the informant was sentenced for obstruction of justice.
Nobody has established that generative AI produced that evidence, and I am not going to pretend otherwise. What stays with me is how the fabrication surfaced. The docket of the dismissed case contains no ruling on authenticity. Nothing in the public record suggests that a forensic examination caught it. It reached the people who write the federal rules of evidence because one judge mentioned it in a survey response.
That is where I want to start, because it frames the question federal rulemakers have been circling since 2023. If a fabrication can travel that far without being tested, what will a court lean on when the next one is better made?
My answer, after reading the committee's materials, is uncomfortable. Courts will lean on the record of how a file came to exist. And that record usually belongs to someone.
On October 15, the Judicial Conference's Advisory Committee on Evidence Rules met in Boston and opened its meeting with a panel on deepfakes. Two of the panelists came from the companies whose models made synthetic media cheap. Shira Anderson, policy counsel at OpenAI, said AI images keep improving and that she does not believe a scientific method will exist in the future to detect them. She added that each company runs its own watermarking system, so there is no universal way to verify content, and that these systems will get better without ever becoming completely reliable. Devin Norder, a director of product management at Meta, said humans cannot distinguish media made by recent models from authentic material, and that producing it now takes little money and little time.
The detail that matters most sits in the panelists' biographies, which the committee published in its agenda book. Anderson's portfolio at OpenAI includes AI content provenance, and she works with the Coalition for Content Provenance and Authenticity, the group behind the C2PA standard and Content Credentials. Before OpenAI, she was regulation lead for AI safety and content provenance on Meta's global policy team. Norder has worked on content credentials under C2PA and on making sure Meta's generated media carries watermarks. That work has included assessing how well those marks survive ordinary handling and how far detection degrades against adversarial inputs.
So the people building the labeling layer told a federal court that you cannot reliably catch a fake by looking at it.
I take that as an honest assessment from people with every reason to know. I also take it as a prediction, not a proof, and they were not the only experts in the room. The panel included Dartmouth's Hany Farid, Northwestern's V.S. Subrahmanian, NIST's James Horan, a digital forensics expert witness, and a litigation support lead from the federal defender system. The coverage went to the industry warning, and the industry warning points in one direction. If a file cannot prove itself, its history will have to. Someone owns that history.
The committee's reporter, Fordham law professor Daniel Capra, set out the current version in a September 15 memo. It is labeled a working draft, and the committee has not approved it. In May, the committee pushed the question to this fall, and Judge Jesse Furman, who chairs it, called a one-year delay a reasonable price for getting the rule right.
Today, Rule 901 sets a low bar. The party offering evidence needs only enough support to show the item is what it claims to be, and testimony from a knowledgeable witness usually does the job.
The draft Rule 901(c) would add a separate track for one kind of dispute. A party claiming that an item was fabricated, in whole or in part, by generative AI would first have to present evidence sufficient to support a finding of fabrication. Saying "that's fake" would not be enough. Once the challenger made that showing, the item would come in only if the proponent persuaded the judge that it is more likely than not authentic.
That second step moves real weight. The draft committee note says plainly that testimony from a witness with knowledge will not ordinarily meet the higher standard, for the obvious reason that a person who was there can be fooled by a good fake. The rule would cover anything offered under Rules 901 or 902, not only audio and video. It would require reasonable pretrial notice of a fabrication challenge unless the court orders otherwise. It would not apply when a party offers a deepfake to prove that it is one. And an item that clears the judge would still be open to attack in front of the jury.
Capra has also proposed adding to the note a list of facts that could support the challenger's initial showing: missing or anomalous metadata, inconsistent timestamps, unexplained edits or compression artifacts, the absence of the native file when a derivative is offered, gaps in chain of custody that create an opportunity for tampering, audio and synchronization glitches, known use of generative AI tools by the proponent, and independent evidence that contradicts the item.
Read that list again. At most two of the eight describe what you can see or hear in the item itself. The other six are about the file's paperwork and the world around it.
I want to be precise about the evidence of scale, because it is thin. In January, the Federal Judicial Center surveyed all federal district, magistrate, and bankruptcy judges, along with the judges of the Court of International Trade and the Court of Federal Claims. Its March 25 memo reports 931 responses, a 45 percent response rate. Fifteen judges said a litigant had challenged a photograph, video, or audio recording as a deepfake. Two did not answer the question. Most of the fifteen had seen it once.
That is not an epidemic, and I won't call it one. But a survey of challenges counts what someone noticed and chose to raise.
It cannot count the fakes nobody questioned, and the FJC itself observed that some of these disputes never produced a filing or a ruling on the docket. The Texas case is the proof. It reached the committee only because one judge remembered it while filling out a questionnaire. The survey also covers only federal courts, and a Virginia state judge told Law.com that family cases have become a hotbed for fabricated images.
Rulemakers are right to be wary of building a rule on fifteen survey answers. They would be wrong to wait for a stack of wrongful indictments first. Either way, a higher authentication burden costs something. The question I care about is who ends up paying it.
Detection, in the narrow sense, means examining a file for traces of generation. NIST's November 2024 report on synthetic content describes the limits without drama.
Detectors tend to perform best on the generators they were trained against, lose ground on unfamiliar ones, and show substantial error rates after ordinary post-processing like compression. A detector's verdict is one more piece of evidence to weigh. It is not an answer.
Watermarks help when the generating system cooperates. California and the EU have both written machine-readable marking requirements into law, and Capra's memo argues that California's version could make it significantly harder to get a deepfake into court. NIST, however, reports that most current watermarking schemes have been found vulnerable to removal, and Anderson's point about incompatible systems stands. The fake that matters in a courtroom will come from a tool that never marked anything, or from a file whose mark did not survive the trip. A missing watermark tells you nothing about whether an event happened.
That leaves history. C2PA's Content Credentials use cryptographic hashes and signatures to bind statements about a file's origin and edits to the file itself, so that tampering becomes evident. The C2PA's own explainer concedes that provenance is not always complete, that the metadata can be removed, and that provenance alone cannot tell you whether content is true. Chain of custody adds the human record of who handled the evidence, when, and why. NIST's evidence-preservation guidance tells handlers to document the original source and to store hashes separately, somewhere they cannot be changed. A hash shows that a file matches an earlier copy. It says nothing about whether the scene was real before that copy existed.
None of these tools settles authenticity alone. Together they move the question from what is in the frame to how the file came to exist and who can account for every step since. That is the question courts will increasingly ask, and every answer to it lives in a record somebody controls.
Capra's memo asks the panel whether experts will always be necessary when someone alleges a deepfake, and concedes the obvious consequence: trials get more expensive. Under the draft, once a challenger clears the threshold, the proponent needs more than a witness who was there. In practice, that means native files, metadata, logs, and often an expert to explain them.
The memo makes the same point from another angle when it criticizes Connecticut's new practice rule, which in Capra's reading pushes the burden of a deepfake inquiry onto lawyers. Lawyers do not make evidence. They receive it. Capra's example is a client who hands over a thumb drive and says a brother filmed everything. That client is the ordinary case, and the ordinary case has no forensic budget.
A true recording can lose because its owner cannot afford to prove it.
The obvious danger is a fake that gets admitted. Robert Chesney and Danielle Citron named the second danger in their 2019 California Law Review article on deepfakes.
They called it the liar's dividend. Once everyone knows convincing fakes exist, a person caught on a genuine recording can simply say it was fabricated. The liar does not need to make a fake. The possibility of one is enough.
The draft committee note uses that exact phrase. It admits that the rule does not directly address the broader worry that juries will stop trusting anything, and points to tools courts already have. In United States v. Peterson, the Fourth Circuit upheld the exclusion under Rule 403 of a demonstration of how easy it is to fake a text message, because it invited the jury to doubt all screenshots without any link to the case. In Lee v. City of Troy, a federal court in New York overturned a defense judgment after counsel told the jury, with no basis, that the plaintiff's videos were manufactured.
Those tools police what lawyers say. They do nothing about leverage. If a plausible fabrication challenge forces the other side to pay for experts and produce native files, raising one has value even when the recording is genuine. A defendant with deep pockets can make an honest plaintiff's video expensive to keep in the case. Set the threshold too high, and the opposite happens. The person facing a real fake cannot clear it, because the facts that would expose the fake sit in the other side's systems.
Look at Capra's list once more. Absence of the native file, gaps in chain of custody, anomalous metadata. You can only point to those if you can see the record.
This is the part of the debate I care most about, and the part almost nobody is discussing. Picture two files of the same real event. One belongs to an organization that holds the native recording, intact metadata, and access logs stored where nobody can quietly edit them. The other is a clip someone forwarded through a messaging app, and NIST notes that metadata is often stripped when files are shared. Both files are true. Only one of them comes with an account of itself.
Now give it a setting. A worker disputes an employer's account of a meeting that was recorded on the employer's platform. The employer holds the native file and the access history. The worker has an exported clip. Whichever version gets challenged, testing it depends on records the employer keeps, and the worker has to ask for. I made the example up, but every piece of it is ordinary.
The same dependency runs through vendors. Most recording, meeting, and messaging tools will happily export a file. Ask whether they will export the history that makes the file defensible, meaning the original capture data, the edit trail, and the access log, in a form someone else can verify. If proving a record requires the vendor's continued cooperation, then closing the account or switching providers can quietly weaken every record you ever made with it.
That is what I mean when I say proof is becoming a subscription. The recording is yours. The ability to vouch for it is rented.
It also concentrates a quiet kind of power in the companies whose systems produce the records everyone else will need in order to be believed. It is the pattern I keep running into in AI governance: the policy talks about trust, and the infrastructure decides who gets it. Interoperable exports and independently verifiable records are the counterweight. They belong in procurement requirements now, before the first dispute forces the question.
None of this is dictated by the draft rule. Rule 901(c) does not require any provenance product, and courts will have to keep it that way in practice. A missing commercial credential is not evidence of fabrication. A bystander's phone video should not become suspect because the bystander had no enterprise logging system. If evidence law starts treating the best-documented file as the most believable one, it will hand the advantage to whoever could afford the documentation.
For companies, preparing for this has less to do with buying a detector than with being able to explain a file under pressure. Keep native recordings in their original format for the kinds of media likely to end up in a dispute, and make every excerpt traceable to the file it came from. When software enhances, translates, or alters media, keep the input, the output, and a record of the tool, version, and operation. Then run one honest test. Pick a real recording, follow it through every system that touched it, and see whether you can connect the clip to its original and name each transformation in between. Run it again assuming your subscription ended last month. Do this with legal, security, and records teams in the room, set retention periods that respect privacy instead of keeping everything forever, and protect the history itself so that edits to it are detectable. None of it guarantees admissibility. It does mean you can answer the question a judge is going to ask.
Evidence law is moving from the image to the system behind it. I think that is the right direction. A file that cannot be verified by looking at it has to be verified some other way. But the other way comes with a bill, and the party holding the native file, the access logs, and the vendor contract is usually the party that walked in with more power. A rule can set the burden. It cannot make sure the evidence needed to carry it isn't sitting on the other side's servers.
The test for Rule 901(c), and for every company that records anything, is whether provenance makes the past more accountable or turns being believed into a service someone else sells you.