Private provenance for ocular capture
An image recorded through an implant should be provably unaltered, without proving who recorded it. Draft 0.4, open for public comment until 15 January 2027.
- Version
- Draft 0.4, published for comment 14 October 2026
- Comments
- Open until 15 January 2027. Send them to standards@kiroshi.org; all comments are published with the working group’s response.
- Background
- Follows Frothly’s report On Artificial Owls, which recommends that device makers sign images at capture in ways that protect the identity of the photographer
- Licence
- Text CC BY 4.0
1 Why
Synthetic images can no longer be told from real ones by eye. One of the strongest defences is to sign an image at the moment it is captured, so that anyone can later check that it came from a real device and has not been changed. An optical implant is the most personal capture device there is, and the person wearing it may be a journalist, a witness or someone at risk. A signature that identified them would be a danger to them.
2 Signing
2.1 When its wearer records an image or video, an implant shall sign it using a group signature scheme that proves the image was captured by a conforming device, without identifying the device or its wearer.
2.2 The signing key shall be held in the implant’s secure element and shall never leave it. The maker shall not be able to link a signature to a device.
2.3 Any change to the image after capture shall be recorded in an edit log that is signed in the same way.
3 Archiving
3.1 A wearer may deposit a signature and edit log, but never the image itself, with an independent archive, so that the record cannot be quietly altered later.
Note. Frothly’s Lazarus archive already accepts provenance deposits of this kind from newsrooms. The draft names no archive, so that makers and wearers can choose.
4 Questions for consultation
Should a wearer be able to choose a signature that does identify them, for example to prove authorship? Should makers be required to support deposit with any archive the wearer chooses? Is section 2.2 achievable with current secure elements? The working group would particularly like to hear from journalists who wear implants.