White House Makes an eDiscovery Rookie Mistake

Oct 7, 2020 2:07:50 PM / by Ryan Short

A picture is worth a thousand words, but the metadata often helps illuminate whether those words are fact or faction.

Chris Dale, a UK attorney and eDiscovery expert, recently published a piece in which he shows that President Trump's working stay at Walter Reed Medical Center didn't go exactly as portrayed by White House social media accounts.


photos and images


What The Photos Showed

In the two photos, President Trump is seen in two different rooms; in one photo he has a jacket, in another, he does not. The implication is that the President was working long hours in various settings, ensuring the functions of government continue to operate uninterrupted. In short, he is Making Hospitalizations Productive Again.

What The Metadata Showed

There was one problem, though: the metadata was (presumably) accidentally published as well, so savvy journalists or technologists can easily spot a problem:

white house tweet


Does It Matter?

In short, yes and no.

President Trump is far from the first politician to stage a photo op - that act is as old as the camera itself. Presidents of both parties have famously used the media (sometimes compliant, other times unsuspecting) to project a preferred image. And of course, as Governor Dukakis, but not President Dukakis can state, the power of media imagery cuts in two directions.

But beyond political impressions or electoral ramifications, the consequences of this metadata availability extend into other realms. 

Dale writes about  Kairos Shipping Ltd & Anor v Enka & Co LLC & Ors [2016] in which photographs of a sinking ship were key evidence in whether a ship was intentionally scuttled for insurance money. The captain gave waffling answers as to what he knew of the photographs, their metadata, and the timing and manner of providing said information to his counsel, and the Owner was ultimately found guilty of intentionally sinking the ship.


As Dale succinctly and eloquently states [emphasis added]:

Part of the purpose of discovery/disclosure is to provide support for the recollections of witnesses or to challenge them. A contemporaneous document which supports your evidence is good to have. Most forgeries are done retrospectively to prop up a story, and much detective work goes into showing that a document came into existence at a time later than its apparent date. In the old days, this may have involved analysis of paper and signatures; later cases have turned on typefaces and printer styles...Now the clues often lie in metadata.

The Trump pictures remind us that a document may have been created at the time to help create an illusion. Metadata and EXIF data can be altered, but if that had happened here, the dates would have been moved apart, not separated by only ten minutes.

Proportionality rules, of course. No-one is suggesting that the metadata of every document and picture must be examined for every case. In Trump’s case, the eyes of the world were on his health, and it was right to look closely at the self-serving pictures purporting to show that he was fine. In the Kairos case, the whole outcome might have turned on the timing of the pictures and, reading between the lines, the Owner’s bona fides were already under question.

No-one expects every lawyer to be expert in these things. What is required, however, is an extension of what they do anyway with other evidence – apply a kind of smell test to decide what may need closer examination.

Tags: Forensics, Industry Analysis, eDiscovery

Ryan Short

Written by Ryan Short

Ryan joined Proteus in 2020. He is an MBA and a Certified eDiscovery Specialist with over a decade of experience in publicly traded, PE-backed, and bootstrapped entities focused on technology-enabled services. Ryan lives in Indianapolis with his wife and their 5 children under the age of 9. Consequently, his wife won't let him buy a dog.