Reconstruction · Case 2: Harlan County · A complete case in 13 parts
This case: policing and evidence. The agent keeps and deletes records. The person hurt is a defendant, and then a court.
Why this case this week: New York’s highest court has just thrown out video evidence in a split decision because nobody could show where it came from, and the federal rules committee is still weighing a rule for “deepfake” challenges. Both are about proving a file is real. Neither is about proving what is missing.
Part 1: Two minutes
The Harlan County Sheriff’s Office has 240 deputies and about 11,000 hours of body-camera footage a month. Nobody watches it. An AI agent called CURATOR does. It tags each recording, applies the retention rules, redacts faces and plates for release, and deletes what the rules say to delete. It has done this for two years. That was the point of it.
On a Thursday in March, Deputy Marsh stops a car on Route 9. There is an argument, a short struggle, an arrest. Nobody is hurt. The charge is resisting.
In August the court asks for the footage from 14:00 to 16:00 on the camera’s clock. Lena, the evidence technician, asks CURATOR. It exports the window, redacts two faces and one plate, verifies the file against the fingerprint it took the night of the upload, and sends it. In court the video shows a struggle that starts at 14:03.
Maya, the defence lawyer, asks a question nobody expected. “What happened at 13:58?”
Lena pulls the record. It is four lines long.
Case 26-4471 Request: 14:00:00 to 16:00:00
Source: Marsh-BWC-0318 Uploaded 23:41
CURATOR Redacted 2 faces, 1 plate Export 14:00-16:00
Hash verified Released to courtEverything a court asks for today is there. Where the minutes before 14:00 went is not.
Lesson 1. A verified file proves the file. It does not prove the file is all there was.
Question 1. If a court asked your company for one hour of a recording, could you prove the hour before it existed?
Part 2: Two clocks
Maya has a second recording. The patrol car’s dashcam was running, and the defence obtained it in discovery. Its clock and the body camera’s clock disagree by two minutes and ten seconds. Nobody set them against each other; nobody was asked to.
By the body camera’s clock the stop began at 14:01, inside the released window. By the dashcam’s clock it began at 13:58, outside it. Both files have fingerprints. Both fingerprints check. Both are, in the only sense the platform knows, authentic.
Lena explains to the prosecutor that a fingerprint binds the bytes of a file. It says this file has not changed since it was fingerprinted. It says nothing about what time it was, or about any other file. The prosecutor asks which clock is right. Lena says that is not a question the system can answer.
Lesson 2. A fingerprint binds bytes, not time.
Question 2. Which clock is the official one at your company, and who can prove it?
Part 3: The rule
The judge wants the footage from 13:50. Lena asks CURATOR. CURATOR reports that the segments before 14:00 are no longer held.
The retention rule, written when CURATOR was installed, says footage that is not tagged to an incident is deleted after 90 days. The stop was tagged. The three minutes before Deputy Marsh got out of the car were not. They were, as far as CURATOR could tell, a deputy sitting in a parked car, and CURATOR deleted them in June, on schedule.
The deletion is logged. It is logged by CURATOR, in CURATOR’s own log, at Evidentia, the company that hosts the footage and built CURATOR. The log says: retention delete, rule 4, 1,212 segments. It does not list them.
Lena has never seen a retention delete before. Nobody at Harlan has. The rule runs at night.
Lesson 3. The system that deletes is the system that reports the deletion.
Question 3. What at your company deletes data on a schedule, and who checks its reasons?
Part 4: The tag
Deputy Marsh says he tagged the whole stop at the scene, as trained: a press on the camera when he put the car in park. The camera’s own log shows a tag at 14:02, after the argument had started.
Lena asks Evidentia. In May, two months after the stop, Evidentia updated CURATOR’s model for where an incident begins. The old model started an incident at the first contact. The new one starts it at the first raised voice, because that produced fewer false tags in testing. The update was applied to everything in storage, including footage already tagged. Marsh’s tag was moved.
The May version is in production. The March version is not. Nobody can run the March model on the March footage to show where the tag would have been.
Lesson 4. When the software decides where the event begins, it decides what survives.
Question 4. Who defines where an “event” starts in your recordings, and could you rerun last year’s definition?
Part 5: Mistrial
Maya does not say the footage was edited. She does not have to. She asks the prosecutor to prove that the missing three minutes showed nothing, and the prosecutor cannot, because nobody can.
The judge declares a mistrial. Not because minute 13 showed anything, but because nobody can show that it did not.
The local paper runs it under a headline about deepfakes, which it was not. A county commissioner asks the sheriff how many other cases rest on footage with a hole in front of it. The sheriff asks Lena. Lena asks CURATOR. The answer is 340 cases in two years where the released window starts inside a retention delete.
The commission brings in Joan’s practice, an outside firm that reconstructs what happened when the records cannot. Rosa arrives on a Monday.
Lesson 5. The deepfake defence does not need a deepfake.
Question 5. Has anyone at your company ever been asked to prove a recording was not edited? What did you show them?
Part 6: Six questions
Rosa’s first week is six questions to the sheriff, with thirty days to answer. They are the questions any outsider would ask, and they are the ones the system was never built to answer.
Question three is the one that stops the room: “Who outside this building held a copy of the fingerprint on the night of the upload?”
The answer is nobody. Evidentia holds it. Harlan can see it. Nobody else has ever had it. When Harlan says the file is unchanged, it is Harlan’s word, verified by Harlan’s vendor, on Harlan’s vendor’s computer.
Lena, who has worked in evidence for nine years, says it is the first time anyone has put it that way.
Lesson 6. If only the owner holds the fingerprint, the fingerprint is the owner’s word.
Question 6. Does anyone outside your organisation hold a fingerprint of your records?
Part 7: Joan
Joan runs the practice. She comes for a week when a case turns on the vendor. She does not ask whether Deputy Marsh did anything wrong. She asks what CURATOR was told, by whom, and when.
Evidentia’s logs show that CURATOR ran a “storage optimisation” pass in the week of the stop, across 1,200 files, and that the segments before 14:00 on Marsh’s camera were among them. The pass was approved by a ticket. The ticket was raised by Evidentia, approved by someone at Harlan whose account has since been closed, and nobody at Harlan remembers it.
Joan asks whether the pass changed what the retention rule would later delete. Evidentia’s engineer says it is possible. Joan asks for the record that would show it. There is none. The pass wrote its results over the inputs.
Lesson 7. Your records live on someone else’s computer under someone else’s rules.
Question 7. Could your vendor delete something of yours without you noticing for 90 days?
Part 8: Reconstruction
Rosa rebuilds the afternoon of the stop from five sources: the body camera, the dashcam, the radio log, the 911 call, and Evidentia’s audit trail. Each is complete. Each is internally consistent. Each was made by a different system with a different clock and a different idea of when things start.
Laid side by side, they agree on most of the afternoon. They leave fifty seconds that none of them can place: fifty seconds in which, by one clock, Marsh was out of the car and, by another, he was not.
Rosa’s report says that five honest records can still leave a hole, and that the hole is where the case went.
Lesson 8. Five honest records can still leave a hole.
Question 8. How many systems would you need to open to rebuild one hour at your company?
Part 9: The second release
While Rosa is working, a journalist files a public records request for the same two minutes. CURATOR produces them: a different redaction (three faces this time, because the model has been updated again), and therefore a different file with a different fingerprint.
There are now two authentic releases of the same two minutes. Neither is linked to the other. Neither is linked to the original. A reader of either has no way to show it came from the whole.
Policy says a person reviews every release before it goes out. The reviewer’s record is a checkbox. The checkbox was ticked.
Lesson 9. Every redaction is a new document with no parent.
Question 9. When you release part of a record, can the reader prove it came from the whole?
Part 10: The cost
The case is dropped. The defendant sues. The county’s insurer, at renewal, asks for “verifiable retention” and does not define it. Evidentia offers a new tier that does something like it, for a price. The 340 cases are reviewed one by one; eleven are reopened.
Lena is moved to records. Deputy Marsh gets a new camera. Nobody is disciplined, because nobody did anything the rules did not allow.
Lesson 10. Insurers ask the question first.
Question 10. What would your insurer ask you to prove about your recordings?
Part 11: WHAT IF
This part did not happen. It is the same afternoon, imagined with the record in place.
The camera does what it did. But every ten seconds it also writes a short fingerprint of what it has recorded so far to a place the sheriff’s office does not control and cannot edit, and the fingerprints chain: each one includes the last.
In June the retention rule still deletes the three untagged minutes. But the deletion is itself a record: it names the rule, the segments, and the time, and it is chained to the fingerprints of the segments it removed. The footage is gone. The proof that it existed, and of exactly what it was, is not.
In August, Maya asks her question. Lena answers it in four minutes: here is the chain, here is the retention delete, here is the rule it cites, here is the fingerprint of what was deleted, and here is the outsider who has held all of it since March. The judge asks whether the deleted segment could have shown anything. Lena says she cannot know what it showed, and can prove exactly what it was.
No mistrial.
Lesson 11. You can delete the footage and keep the proof it existed.
Question 11. Which would you rather keep: the data, or the proof of what the data was?
Part 12: Four questions
Joan asks seven evidence-platform vendors the four questions she asks everyone.
Where is the decision recorded? In what form? Who outside your company can check it hasn’t changed? Can it be read now?
Six answer the first two and stop. “Our hash.” “Our audit log.” One answers all four.
Lesson 12. The difference between “we verify” and “anyone can verify”.
Question 12. Ask your records vendor Joan’s four questions. Post what you get back.
Part 13: The record
What the one vendor had was not a better camera or a better hash. It was a record that lived outside the sheriff’s office and outside the vendor, written as the footage was made and as the rules ran, that anyone with a copy could check and nobody could quietly change. Deletion became a thing you could prove instead of a thing you had to explain.
A protocol is not a product. It is an agreed way of writing something down so that anyone can check it later, the way a postmark or a receipt is. This one says three things. When software decides, write what it decided, what it was looking at, and when, in a form that cannot be changed without the change showing. Give a fingerprint of that record to someone outside your company. Let anyone with the fingerprint check the record, now or in ten years. Any vendor can follow it. The one vendor did.
Joan’s four questions, for any decision your software makes: Where is it recorded? In what form? Who outside your company can check it hasn’t changed? Can it be read now?
The one vendor used an open protocol called FORAY. Nothing changes quietly.
The honest claim: FORAY proves what was recorded, when, and that nobody has changed it since. It does not make a recording true, and it does not prove nothing was left out. It proves what was there.
Joan’s next case is somewhere else.
Lesson 13. A camera is just another agent. It needs the same record as the ones that decide.
Question 13. Which of the 13 lessons would your lawyer disagree with?
Harlan County Sheriff’s Office, CURATOR, Evidentia, Deputy Marsh, Lena, Maya, Rosa and Joan are fiction. The problem is not.
Every case in RECONSTRUCTION is listed in the Library. Case 1, First Harbor Bank, is running on LinkedIn and here, one part a week on Mondays.
I build tools for this problem through my company, DUNIN7.