They say seeing is believing, but in the era of deepfakes and easy editing, there’s plenty of reason to question what you see in a video or photo. Police, lawyers, journalists and social media companies use an ever-evolving set of fact-checking tools, examining everything from scenes to people to determine whether they are who they appear to be.
But what if you could figure out how reliable a video might be without even watching it? That’s the idea behind MedEx Forensics, a three-year-old Madison software company that helps its clients determine what device or program created a video file and whether it has been modified since then. Short for Media Examiner, the company rates videos by analyzing context rather than content.
“We really provide what we call provenance or context about a video file that can then prove or disprove claims about that video,” said Bert Lyons, Medex CEO and co-founder. While many people know how to check a file’s metadata to see when and where it was made, the company’s software doesn’t use any of that, since metadata can be edited and can be lost when the video is uploaded.
Vintage cell phones, chargers and batteries are spread out on a table in the MedEx Forensics lab in Madison.
Instead, the company’s software uses a patented process to compare the binary code of a video file against sample files from more than 1,200 devices and more than 180 software programs. In a small lab in its downtown office, the company has built a reference library that includes files captured by cellphones, drones, door cameras, surveillance cameras and more, as well as videos created by phone apps and deepfake platforms.
“It’s like a fingerprint library for devices,” Lyons said, comparing the process to how forensic analysts compare DNA samples. Depending on the client, the video could be potential evidence in a criminal case (such as video providing an alibi for a suspect or documenting child sexual abuse) or footage of a civil news event.
Police, journalists are asking for checks
Twelve million U.S. court cases each year involve video evidence, Lyons said. This includes videos provided to police by the public, such as those captured by Ring doorbell cameras.
“They have to prove that, yes, this was recorded on the Ringo bell and it wasn’t tampered with in any way,” said MedEx digital forensics consultant and research analyst Nicole Odom, who also works as a digital forensics investigator for the University of Wisconsin-Madison Police Department. . “Proving everything that happened to the file from point A to point B is very important in forensics.”
Digital forensics consultant and research analyst Nicole Odom works in the lab at MedEx Forensics in Madison.
If a client’s video matches something in the library, the software tells them so. If it doesn’t, it suggests that it was made with a non-library device or that it was modified after the fact.
Sometimes the results confirm the client’s theory about the video, such as when they were already told it was taken on a certain phone or downloaded from a certain social network. Other times, the results disprove the theory, prompting further investigation or alerting them that the video might be suspicious.
The lab at MedEx Forensics is packed with cell phones and cameras that the company uses to teach its software how to identify the “origin” of Madison client videos.
That alone may not tell a client everything they need to know, but it can help narrow a search or help clients prioritize when sifting through vast collections of video evidence, Lyons said.
In one case in Kentucky, state police were investigating a trove of child sexual abuse videos. They wanted to determine whether the person whose computer the videos came from made the videos, which is a far more serious crime than possession. Knowing this could also help investigators identify and help child victims. In one video, which did not contain illegal content, the detective noticed the camera’s instruction manual on a pendant. She provided the possible brand name and model to MedEx, where staff obtained one of these cameras, recorded sample videos, and compared the files to the videos in question.
“It was a perfect match, so we were able to help her prove her theory about the files,” Lyons said. This allowed detectives to obtain a warrant to search the suspect’s home for the camera. They found the camera and took the case to court. “They were able to identify that this person had that camera, and then they were finally able to take it to court. So we put the pieces together in a way that you couldn’t do it any other way.”
The company’s software is also used by news outlets and law enforcement agencies looking to verify the authenticity of videos submitted by members of the public. In 2022, the New York Times obtained videos allegedly taken by workers inside the besieged Zaporizhzhia nuclear power plant in southeastern Ukraine.
“They were sending videos through Telegram saying, ‘We’re here. This is extremely dangerous. If somebody hits this facility, it’s going to be a big meltdown,’ Lyons said. “The video that came out looked like something out of 1960s science fiction, there were a lot of people on the internet saying… ‘This can’t possibly be true. It looks like ‘Star Trek’ or something.'”
The publisher used MedEx software, combined with other tools, to determine whether the surreal videos were likely real. In other cases, newspapers covering breaking news use the company’s software to decide which of the hundreds of submitted videos to throw out at the outset — say, because they’re edited or pre-downloaded from social media — and which to scrutinize further. MedEx processed more than 60,000 videos for the New York Times alone.
Teaching the FBI
Trained as an archivist, Lyons first got the idea for the software in 2015 after running a training course for the FBI. As a partner at digital asset management firm AVP, he was hired to teach FBI agents how audio and video files function as digital objects. When he arrived at Quantico, he was surprised by what he found.
“They didn’t know anything about what we were teaching. It was like brand new,” Lyons said.
MedEx Forensics CEO Bert Lyons and Chief Technology Officer Dan Fischer are pictured at the MedEx Forensics Lab in Madison.
He started thinking about how to automate the process that he had taught agents to do manually. When he returned home, he began working on the project through AVP and recruited Dan Fischer, a software developer who worked near him at a local coworking space, to help. In 2021, the two teamed up with New Jersey detective Brandon Epstein and communications specialist Jeff Hulett to found MedEx.
Today, the company’s platform is used by 80 agencies across the U.S. and in countries from India and Norway to Singapore and Saudi Arabia, Lyons said.
Demand for such services is only growing, Lyons said, pointing to recent speculation surrounding an edited photo of Kate Middleton, Princess of Wales, as evidence that the public has become increasingly interested in vetting the media. In addition to growing its reference library and expanding its customer base within the industries it already serves, Lyons said MedEx is looking to offer additional services. The company is currently developing tools for analyzing image files. It also hopes to start helping insurance companies analyze videos that customers submit with their claims, to detect potential fraud.
“We do one thing very well … but there is interest in doing more things,” Lyons said. “We want to continue to develop what we’re doing now so we can serve and share this technology with more organizations around the world.”
Four questions
What are the most important values that drive your work?
Lyons: The concept of trust. We have a process that can create provenance information or contextual information that can help someone make a decision about how much they trust a particular piece of content at a particular time. We don’t say, “This one is the right one. This one is fake.” We describe the life cycle of evidence much like a forensic scientist looks at a bone.
How do you create the community you want to live in?
Lyons: I always value accuracy, transparency and truth. The communities we work in are investigative forensic communities. We’re trying to be a role model to say don’t trust the black box you’re looking at. Look at the thing in front of you with as much clarity as possible. See things as they are, not as you wish them to be. Don’t come at it with preconceived notions about it.
I leave: I think it’s just a matter of information. Whether you’re on the social media or law enforcement side looking at evidence, you want to be well informed. I think this tool allows the community to be well informed about what they are seeing.
What advice do you have for other future entrepreneurs?
Fischer: My advice would be to find something that I think you can come to every day and enjoy. I know it’s a cliché, but I honestly enjoy showing up and trying to innovate and think about things differently, and it makes a big difference.
Lyons: I would also say, find partners that you trust and enjoy and push you to be better and are game for a challenge. Find partners who care as much or more than you do. And (as you grow) find people who can make your team much better than it already is.
Are you hiring?
Lyons: I want. We’re not hiring just because we don’t have it in the budget right now. But as soon as we can, we will hire more.