Case Study 2 — The Number That Evaporated
The mirror image of Case Study 1: not a disciplined triage that protected people, but a single confident number offered as proof, in a case where a genuine recording was attacked as a deepfake. One examiner led with a commercial detector's "0.92 — fake" and built a report around it. On cross-examination the number dissolved in five minutes, and the liar's dividend nearly won — until a second examiner showed what authentication actually looks like.
Background
A workplace-harassment suit turned on a forty-second video: a phone recording, made by a bystander, of a manager's conduct at an off-site event. The plaintiff had the clip; the defense did not dispute that a recording existed but raised the most modern defense available — that in an age of deepfakes, the video "could be synthetic," and the burden was on the plaintiff to prove it real. This is the liar's dividend in its natural habitat: the mere existence of convincing fakes converts a genuine recording into something a party can wave away, and it is exactly the courtroom face of anchor case #4 the chapter warned about.
Each side retained an examiner. The defense's examiner was technically fluent but had never been cross-examined and was working to a deadline. The plaintiff's examiner was slower, duller on paper, and had testified often enough to be afraid of exactly one thing: a number she could not explain. The contrast between their two reports is the whole lesson.
What the defense examiner did
The defense examiner downloaded a well-reviewed commercial "deepfake detector," fed it the clip, and received a single headline figure: 0.92, labeled "likely manipulated." He built his report around it. The clip "scored 0.92 on a leading AI detection platform," the report stated, "indicating a high probability of synthetic manipulation." There was a screenshot of the dashboard, the vendor's name, and little else: no acquisition analysis, no container metadata, no provenance check, no second method, no control. The number felt like proof — vivid, confident, three significant figures — and that feeling was the trap the chapter names.
On cross, the plaintiff's counsel did not argue about deepfakes at all. She asked three questions.
CROSS-EXAMINATION — three questions, five minutes
Q1 "What is this tool's error rate on the KIND of generator you claim made
this clip?"
A The vendor had never published one for that class; the witness could not
state it. → error rate: UNKNOWN (Daubert)
Q2 "Explain WHY the model produced 0.92 — what in the pixels drove it?"
A The witness could not; the model is a black box and he had run no
explainability analysis. → unexplainable (Daubert)
Q3 "You ran a known-authentic control? What did the same tool score a clip
you KNOW is real?"
A He had not — and when run in the room, the same tool scored an admitted
authentic control 0.71. → reproducible bias, no baseline
The 0.92 evaporated. A tool with no stated error rate on the relevant generator, whose reasoning the witness could not explain, that scored a known-authentic clip 0.71, cannot support a "high probability of manipulation." Under Daubert and FRE 702 the method failed the error-rate and explainability factors at once; the witness's central conclusion — and with it his credibility — was gone. The liar's dividend was one ruling away from succeeding, not because the video was fake, but because the only evidence offered about it was a number nobody could defend.
What the plaintiff examiner did
The plaintiff's examiner never tried to prove the clip real with a detector, because she knew detection was the wrong tool for the job. She authenticated it, building the convergence the chapter describes and treating "real or fake" as a question of provenance and corroboration, not of a single score.
CONTESTED-VIDEO AUTHENTICATION — the disciplined report (FRE 901)
Test / artifact Result Weight & caveat
Chain of custody pulled direct from the bystander STRONG (Ch.14);
phone, imaged + hashed at intake source established
File hash matches the hashed extraction integrity confirmed
C2PA credential absent SILENT — neither way
Container creation time consistent w/ phone clock + corroborated (Ch.20/21)
independent event timeline
Encoder fingerprint device camera encoder consistent w/ original
(not Lavf/x264 transcode)
Detection battery (mean) 0.28 (low); NO convergence consistent w/ authentic*
Independent witnesses two attendees corroborate event STRONG
Overall AUTHENTICATED under FRE 901; no convergent evidence of synthesis.
*Cannot prove a negative — stated plainly as such.
Crucially, she had imaged the bystander's phone, not worked from a forwarded copy; the file's hash tied it to that extraction; the container's creation time and the device-camera encoder fingerprint were consistent with a genuine capture, read with the Chapter 20 discipline; the detection battery she did run came back low and without convergence, which she reported as "consistent with an authentic recording" while stating she could not prove a negative; and two independent witnesses placed the event. The absence of a C2PA credential she reported as silent — neither incriminating nor exonerating — precisely the reading the chapter demands.
Asked on direct whether the video was "definitely real," she declined the word, and that refusal is what made her believed. Her finding was that the recording was authenticated under FRE 901 — sourced, hashed, internally consistent, corroborated, and showing no convergent evidence of synthesis — and that "it could be a deepfake," unsupported by any artifact, was not evidence against that wall. The court agreed. Provenance defeated the liar's dividend where a pixel detector could not have.
Recovery vs. Forensics. Note what neither examiner could do: prove the negative. The disciplined witness did not claim a detector showed the video was real — no detector can, and she said so. Her strength was the same as a recovery technician's honesty about an unrecoverable file: she stated exactly what the evidence supported and exactly where it stopped. The overreaching witness lost not because his suspicion was impossible but because he claimed more than any tool could deliver — the cardinal sin in both disciplines.
The analysis
-
A model score is a lead, never a finding — and a finding built on one collapses. The 0.92 had no stated error rate on the relevant generator, no explanation, and no control. The chapter's single most important rule — findings cite artifacts, not scores — is exactly the rule the defense examiner broke, and cross-examination found the break in three questions.
-
The liar's dividend is answered by authentication, not by a better detector. The genuine video survived because it was sourced from a hashed extraction, internally consistent, and corroborated — the FRE 901 discipline of Chapter 14, 20, and 21. No detector can prove a video real; provenance can establish that it is what it claims to be.
-
The generalization gap is a courtroom fact, not an academic one. A detector's reliability against an unknown generator is itself unknown; the defense examiner treated a tool validated on familiar fakes as authoritative on whatever he imagined made this clip. The DFDC's collapse to ~65% on unseen fakes is exactly why his number could not bear weight.
-
A control would have saved him from himself. Running the same tool on a known-authentic clip — which scored 0.71 — would have shown, before he wrote a word, that the tool was not trustworthy for this task. Skipping the baseline is how an examiner walks into an impeachment he built himself.
-
Refusing the absolute is what makes a witness credible. "I cannot prove a negative; the recording is authenticated and shows no convergent evidence of synthesis" beat "0.92, likely fake" decisively. The honest limit, stated plainly, is more persuasive than a confident number — the same humility Chapter 27 — Expert Testimony demands of every expert.
Discussion questions
-
Rewrite the defense examiner's central sentence — "the clip scored 0.92 on a leading platform, indicating a high probability of synthetic manipulation" — into a finding that a competent cross could not have dismantled, preserving any genuine investigative value while stating the tool's limits.
-
The plaintiff's examiner reported the absence of a C2PA credential as "silent." Explain why this was correct, and what a defense examiner could have improperly argued if she had instead written "no credential, therefore unverified — possibly fake."
-
Counsel broke the 0.92 with three questions about error rate, explainability, and a control. Map each question to a specific Daubert/FRE 702 factor, and write a fourth question you would ask to test the tool's reproducibility.
-
⭐ Suppose the disciplined examiner's detection battery had come back high and convergent — a clear blend boundary, a frequency-domain fingerprint, and a missing rPPG signal all agreeing — and the acquisition trail still tied the file to the bystander's phone. Write the finding she should give, holding both facts at once, and explain why "it is fake" is still the wrong sentence even then.
-
The defense examiner's suspicion may have been sincere, and a genuine deepfake might one day appear in such a case. Argue, drawing on this chapter and Chapter 26 — The Forensic Report, why "a forensic opinion is not paid to be privately suspicious; it is paid to be defensible in public," and draft the five-line pre-report checklist that would have stopped his report from ever being filed.