Images cost nothing to produce now and arrive in unlimited numbers. The usual conclusion is that they have become disposable, and that being disposable, they can no longer be trusted.
The facts in that description are right. The conclusion moves too fast, because trusting a photograph has always meant two separate things at once, and abundance does not do the same thing to both.
The first is trust in the image as an object. This file is what it claims to be; it came from where it says it came from, and nothing has happened to it since. Call that object-trust.
The second is trust in the image as a depiction. What it shows corresponds to something that was there, arranged more or less as it appears. Call that depiction-trust.
Provenance in this sense is a recent arrangement. A record of where a file came from and what has been done to it since is bound to the file itself by cryptographic signature, so that anyone receiving the file can test that record instead of taking it on faith. The C2PA specification is where the binding is defined.
Provenance answers the first of those two trusts and leaves the second entirely open. The precedent is several centuries old. A notary certifies that a named person signed a document at a given time, and says nothing whatever about whether the statement inside the document is true. Everyone who has ever used one understands the distinction, and the profession functions because of it. Photography has just arrived at notarization, and a good part of the field is reading it as verification.
The bundle
The misreading has a history behind it. For most of the medium’s life the two trusts arrived together, delivered by the same event, and there was no occasion to pull them apart. The interpretive claim was collected on the credit of the causal one, and the credit was good because the alternative was expensive. Difficulty was doing quiet work on the side, since a picture that cost something to make was implicitly worth believing.
Nothing ever guaranteed the interpretive claim. The trust everybody actually cared about, that the scene was as the picture suggests, never had a mechanism at any point in the history of the medium. It was inferred, and the inference held for as long as the cost of a picture stood in for a guarantee nobody had issued.
The lies that survive
Gardner dragged a corpse across Devil’s Den to a spot that photographed better, and the resulting plate has never suffered a moment of tampering. Fenton’s cannonballs lie where somebody put them, in an image that is technically beyond reproach. A crop can empty a square of the crowd that filled it without disturbing a single pixel of what remains, a candid can be posed, and a caption can assign the wrong war to the right rubble, all of it leaving the file untouched. The newest member of that set is the generated image carrying a complete origin record, where the assertions are accurate, the integrity is intact, the signer is legitimate, and the image depicts nothing at all. Nothing that has existed.
Run the most rigorous provenance chain you can construct across any of these, and it returns a perfect result. The deception happened in front of the lens, or in the words printed beneath the picture, and no chain has ever reached either place. None of this is new knowledge. That a photograph can lie while remaining physically intact has been in the historical record since the 1850s and in the first week of every photography course since. The field set it aside the moment cryptographic provenance arrived and appeared to close the question.
Why one travels and the other cannot
The asymmetry follows from what a signature can be fastened to. What gets signed is the image data, reduced to a hash, along with statements about how the file came to exist: this device, this hour, this program opened it, these regions were changed. Whoever holds a certificate does the signing, which means the camera maker at capture, the editing tool at each alteration, the agency on the way out the door. All of it rides inside the file as metadata, and because platforms strip metadata on upload, the association is usually held outside the file as well, either as a fingerprint of the picture registered elsewhere or as a mark embedded in the pixels that survives compression.
Every one of those claims is a claim about the file, and every one can be tested against the file. A picture editor establishes in about a second that a photograph came off a particular camera on a particular morning and has not been altered by a single pixel since. The check is arithmetic, and it needs no witness and no knowledge of the event. Object-trust travels because it never asks about the world.
Depiction-trust asks about the world, and nothing inside a file can answer it. The image data records what reached the sensor and holds nothing about what the scene was, who arranged it, or what stood three feet outside the frame. So that information arrives the way it always has. Somebody types it, and it is stored in the same metadata as the hash. Sign it, and you have established who typed it and proved that nobody has touched it since. Whether it is true remains exactly as open as before. A lie, correctly signed, verifies perfectly.
Signing still does one thing for depiction-trust, and it is not a small thing. A signed caption is attributable, so a false one leads back to whoever put their name on it, and depiction-trust has never run on anything except the ability to find the person who spoke. It lives where it always lived, in the caption, the byline, the photographer’s standing, and the accountability of whoever published.
Which is why it has to be earned again at every publication. A photograph correctly captioned by the agency that distributed it in 2019 appears in 2026 above a story about a different war. The file is untouched, the signature verifies exactly as it did on the first day, and someone who bore no responsibility for that picture has just made a claim about it and now does. Depiction-trust attaches to a publication event rather than to an image. Object-trust travels with the artifact, and depiction-trust is renewed each time a new liable party puts the picture in front of an audience. We talk about verifying images, and there has never been any such thing. There are pictures with claims attached, and every claim has an author.
The domains sort themselves
The word photograph covers practices that behave nothing alike, and the present anxiety treats them as one.
Art photography is never asked for depiction-trust and loses nothing in an era that cannot supply it. Fashion sits in between. Its claim is interpretive rather than evidentiary, and it is enforced by advertising regulators and by return rates rather than by anything inside the file.
Personal and family photography runs almost entirely on it and draws it from the relationship, which is why you believe the picture your sister sent you because your sister sent it. Forensic and scientific imaging requires both and solved the problem a century before anyone proposed signing a file, since chain of custody governs the room, the operator, the procedure and the sequence, and secures the situation of capture instead of trying to reconstruct it from the artifact afterward. That is the only place depiction-trust has ever been securable.
Photojournalism stands alone in demanding both from an artifact produced under conditions it does not control, which makes its difficulty structural and older than any recent technology.
What actually moved
Object-trust used to live in the physical negative. A dispute was settled by producing it, examining the print against it, reading the frame numbers, checking the contact sheet for what was happening in the thirty seconds either side. The negative vouched for itself. It required no institution to confirm it, only physical possession, which made it the closest photography ever came to verification that depended on nobody’s word. It was also available only to editors, courts and insurers with the standing to demand the film. Readers never had it and never expected to.
Depiction-trust lived in the photographer’s name, the agency and the publisher, and the mechanism under all three was liability. Magnum, the AP and Sygma were businesses whose entire capital was reputational, and a fabrication traced back to any of them cost real money. A picture editor’s job included interrogating the photographer about what had been happening outside the frame, and careers ended over staging. The arrangement worked because the number of parties who could publish was small, every one of them was identifiable, and each had assets that could be taken away.
The wire services proved the two trusts were separable and nobody drew the conclusion. A wirephoto arrived degraded and severed from its negative, its object-trust destroyed in transmission, and editors ran it because an agency’s name was attached and the agency was answerable. Object-trust could be discarded wholesale with no loss of credibility, provided a liable institution stood behind the picture.
Then the negative went away, and nothing took its place for thirty years. A digital file has no unique original, since every copy is bit-identical to every other, so there is nothing to produce when a dispute arises and nothing in the file that testifies to its own history. The arbiter that had settled photographic questions since the 1840s stopped existing around the late 1990s, and the industry carried on without appointing a successor.
What newsrooms improvised was the raw file, which functions as a negative purely by convention. The demand to produce your raws is the first move in any fabrication inquiry, and it worked in the Hansen and Contreras cases, but a raw file serves only for as long as the photographer chose to retain it and agrees to surrender it. Object-trust became a contractual undertaking, enforceable by employment rather than by physics, and the rest was written into codes of conduct that specified what processing was permissible and were enforced by firing people.
For a quarter of a century, then, object-trust was guaranteed by institutional liability, which is exactly where depiction-trust had always lived. Two trusts that had been kept in separate places by entirely different means came to rest on a single guarantor, and what the wire services had demonstrated about a few pictures became true of every photograph in existence. Nothing available at the time could restore the separation. Embedded metadata described a file’s origins without authenticating them, editable by anyone with a text editor and stripped wholesale on upload. Image forensics infers what a file has been through from error levels, sensor noise, and compression artifacts, expensively and only after somebody has already objected, and where the negative asserted its own history, forensics guesses at it.
Signing ends that arrangement without restoring the earlier one. Object-trust is now a cryptographic assertion (via Content Credentials) that depends on whoever issued it, because every chain terminates in a signer whose honesty sits outside the system that verifies him, and whether an institution is telling the truth has never been a cryptographic question. Object-trust is therefore more institution-bound today than it was in 1970. What changed for depiction-trust is arithmetic: the population of publishers went from hundreds to hundreds of millions, and liability thinned to nothing as it spread across them.
What the audit found
Provenance performed a measurement, and the result is uncomfortable. By isolating the portion of photographic credibility that can be mechanically guaranteed, it revealed the size of that portion: narrow. It is far narrower than the reputation the medium enjoyed for a hundred and eighty years, and narrower than most working photographers assumed when they defended that reputation.
This is what explains the flatness people report on meeting an origin record for the first time. They receive a precise, verifiable, entirely honest answer to a question they were not asking, which is an object-trust reply to a depiction-trust question.
What they are feeling is the discovery of how little photography was ever able to prove, which turns out to be a good deal less than the medium spent its whole life implying. The discovery lands hard in proportion to what we asked photographs to settle, in courtrooms, in newsrooms, and in every argument that was ever ended by producing a picture.
The abundance does not take anything away. It removes a price that had been standing in for a guarantee everyone assumed and nobody ever issued.
Author: Paul Melcher
Paul Melcher is a highly influential and visionary leader in visual tech, with 20+ years of experience in licensing, tech innovation, and entrepreneurship. He is the Managing Director of MelcherSystem and has held executive roles at Corbis, Gamma Press, Stipple, and more. Melcher received a Digital Media Licensing Association Award and has been named among the “100 most influential individuals in American photography”
Comments are closed, but trackbacks and pingbacks are open.