The burden of proving an electronic document’s authenticity falls on the party offering it, under the Supreme Court’s Rules on Electronic Evidence, which require a showing of integrity and reliability that satisfies the court. That standard is now being tested in the impeachment trial of Vice President Sara Duterte, where a preserved copy of a Nov. 23, 2024 press briefing has become the prosecution’s opening exhibit.
Two New Zealand-based specialists examined the forensic steps described by National Bureau of Investigation Senior Agent John Mark Calilung and found the methods sound as far as they go — but limited in what they actually establish.
Adam Burns, a cybersecurity expert with BlackVeil Security, drew a line between preserving a file and proving what that file depicts. “It can show that a specific file has not changed since the hash was generated,” he said of the hash value Calilung generated.
That protection covers the copy, not the source. Burns said the agent’s side-by-side check and subsequent hashing lend weight to the integrity of the OBS screen recording itself, though a screen capture leaves behind Facebook’s native file, server-side records, upload history and metadata.
“But that is different from independently authenticating the original Facebook livestream,” he said.
“It does not, by itself, prove that the original Facebook livestream was genuine, complete, unedited before preservation, or correctly attributed.”
“For fuller authentication, investigators would usually look to chain of custody, URL/account records, timestamps, capture settings, platform records or metadata, network logs, and corroborating evidence.”
Computer scientist and software engineer James Noble explained the mechanics behind the technique, describing hashing as a shortcut that sidesteps the work of matching large volumes of data by reducing them to far smaller values.
“The rule is that two absolutely identical data items will always have the same hash value; but it’s much quicker to compare those hashes than to compare all the data,” he said.
Collisions — two different files yielding the same hash — remain possible, Noble said, though the odds are remote. “That’s because hashes necessarily lose information: they are much smaller than the underlying data.”
Calilung, testifying as the prosecution’s first witness, told the tribunal he tracked down the livestream on Harry Roque’s Facebook account and filed a preservation request with Meta so the material would stay accessible. He recorded it using Open Broadcaster Software, then compared his copy against the live version by hand before running the hash calculation to guard against tampering ahead of its submission.
Sen. Panfilo Lacson pressed the point during his questioning of the agent on the trial’s third day, arguing that artificial intelligence has blurred the line between doctored and authentic recordings to the extent that courts must apply sharper scrutiny to digital exhibits. Lacson said he was not challenging the video’s authenticity, only testing whether it could survive judicial examination.
