The Camera Did It

Open any photo you've taken and read the metadata. Make. Model. Lens, down to the serial number. Firmware revision. Focal length, aperture, shutter, ISO, flash, colourspace, GPS if you let it. Forty-odd fields describing the machine.

The field for who took it is called Artist, tag 0x013B. It has been in the TIFF spec since 1988, basically older than the web and definitely older than your digital camera. Your camera has never written a byte to it.

Your phone knows exactly who you are. It unlocked with your face seconds before the shutter fired. It is signed in to your mail, your bank, your photo library. Look in its camera settings for the option to put your name in your own pictures. iOS doesn't have one. Android doesn't have one. A DSLR buries an owner-name field three menus deep, blank from the factory.

And once the shutter fires, the omission is permanent. There is no deeper copy to dig out. Not with motivation, not with a warrant. A court can compel almost anything except a byte that was never written.

Every field describes the instrument.
None describe the human.

What gets signed today

Since 2023 you can buy a camera that signs every frame at capture: Leica's M-series, on the C2PA standard. The cryptography is real and done properly. The key lives in a chip inside the body and never leaves it. Nobody can forge a Leica frame.

Read what the signature actually says, tho.

• The certificate names Leica. The claim is a genuine Leica produced these bytes. Not who was holding it.
• You can type your name into a menu. It gets sealed under the camera's signature like any other field. Any owner of the same model, typing any name, gets an equally valid file.
• The capture time is the camera's clock. Which of course you set.

Verification runs against a list of member companies. Edit the file in Photoshop and Adobe signs the edit. Want your name certified? That's an Adobe account.

They built the right machine and pointed it at the wrong subject. The signature proves the camera and the system but not the human.

Fun fact. Stripping or faking attribution metadata has been a federal offence since 1998: 17 U.S.C. §1202, "copyright management information," and courts have held an EXIF field counts. The law has teeth. It has been chewing on nothing, because the field is empty.

What a byline takes

Four things. None of them new.

Write the field. At capture, by default, the way the date is written. A handle, a name, whatever you go by. It doesn't need to be unforgeable to be useful. A signature on a painting isn't unforgeable either. It's a claim by a person, and a false one is a lie you can be called on.

Sign as the person. The key that signs belongs to you and lives in hardware you hold. The camera's own signature rides along as a witness, one field among forty. Now the claim is this person, thru this device, on these bytes, and nobody with the same model and a menu can make it.

Your name is your name everywhere. That is what a byline is for; you can't shed it by picking a different one. So the field gets a third state. It can hold your name, or nothing, or your name sealed: a commitment only you can open, later, on your terms, to only certain individuals. A war photographer files a year of work sealed and opens it when it's safe, and every frame proves it was theirs at the moment of capture. Legal name, location, anything beyond the byline works the same way. Sealed at capture, opened one field at a time, to whoever you choose, whenever you choose.

Bound the time. A clock you set can't testify. Two things can. Fold the latest cryptocurrency block hash into the file before signing: the photo can't predate a number that didn't exist yet. Then anchor the signed file's hash back into the chain; OpenTimestamps does it for free. The photo existed by then. Anyone who could fake either bound would take the mining reward instead. Created after the one, sealed before the other. The claimed capture time lands inside that window or the file impeaches itself.

Leave arrows. Every edit signs the hash of the version before it, so the file carries its own history. Change one bit without signing and the chain ends there, visibly. Not "fake": authentic up to that point, then unattested. A crop nobody signed is still provably a crop of a signed original.

Which is why nothing gets stripped. Every field the photographer wanted public is public; everything else is sealed. There is nobody left to protect. A platform that strips it anyway is removing a named author's attribution from a signed work, and §1202 finally has a victim. The stripped copy proves nothing, same as a photo of a screen. The original still exists. That's what originals are for.

None of this proves the image is real. Point a signed camera at a screen and every check above passes, correctly, because every claim above is true. Anyone selling you "verified real" is selling something.

What it proves is narrower. A specific person put their name on specific bytes inside a specific hour, and every hand that touched them since left a signature or a break. That is what authorship has ever been.

Fields describing the machine: forty-odd.
Fields describing you: one, since 1988.
Bits your camera has written to it: