J3M: JSON Evidentiary Mobile Media Metadata
The JSON Evidentiary Mobile Multimedia Metadata Standard, or J3M Standard, is a format that can be used to easily describe the origins, context, and content of any image or video taken with a mobile device. The standard aims to:
- Maintain a trusted record of a media object’s chain-of-custody from the moment it is created, to the moment it is acquired by a trusted destination, such as a press outlet, or a legal clinic.
- Express the context surrounding the media object’s capture; including data points such as geolocation, orientation, device movement; as well as WiFi networks and bluetooth devices visible to the device, so as to provide corroboration in space and time.
- Embed extra user input from forms or surveys into the media object as signed metadata. The content of these forms can vary depending on each use case.
- Provide metrics for analyzing the content of the media object to mathematically determine that it was created by the device indicated in its metadata.
Technical Details
A J3M-valid application must, upon first use, generate a device-specific PGP key pair. The parameters of this key pair are unknown to the user, and is kept in an encrypted key store that only the device itself has access to. This key can be used to sign and verify the contents of any J3M-enabled media object.
The device also must, upon first use, provide a freshly-taken image, which persists in an encrypted database. This image is uploaded to any Trusted Destination and can be used to mathematically verify that any subsequent image submitted to the Trusted Destination did indeed issue from the same device.
After set-up, whenever a user takes a photo or video with the app, chain-of-custody begins. The app will immediately notify the Trusted Destination that a media object has been generated, including as metadata the timestamp of capture as well as the hash of either the pixel values (in the case of a still image) or the hash of all frames (in the case of video).
The user can then make their edits to the media object to blur/redact regions, add identifying tags, and complete case-specific forms before upload. The Informa library keeps record of these changes as the user interacts with the media.
Upon save, the gathered data is packaged into J3M-valid data, signed with the device’s key, and inserted into the media object either in the JPEG header (in the case of a still image) or as a timecoded data track (in the case of video).
If the user elects to encrypt to a Trusted Destination, the device then uploads the resulting media object over an encrypted connection to the chosen Trusted Destination using Tor’s Hidden Services. Otherwise, the media object can be shared over email, Dropbox, or any other application to whomever the user chooses.
J3M-Capable Apps
In order to generate and embed valid J3M data into a metadata object, the user must use a J3M-capable app to create media. J3M data is the output of Informa, a java library that gathers such data from the device in real-time, and inserts it into the media object upon save. So far, the only app capable of generating J3M-valid media is InformaCam by The Guardian Project. However, this library is available for other app developers who wish to incorporate Informa into their projects.