Where the Image Came From

The question that once had a simple answer now requires infrastructure to answer.

A photograph was made at a specific moment, in a specific place, by a specific person with a specific camera. That's provenance — the origin story of a file. For most of photography's history, the image itself carried that evidence.

That's no longer sufficient.

Generative AI has made it possible to create convincing images from nothing — no camera, no location, no moment. Images from the conflict in Gaza were generated by AI and circulated as photographic evidence. The gap between what happened and what appears to have happened is now easy to manufacture at scale.

The photography and technology industries are responding with provenance — verifying where a file came from, who made it, and what changes were applied since capture. This effort is led by the Content Authenticity Initiative, built on an open technical standard called C2PA (Coalition for Content Provenance and Authenticity).

The approach rests on four pillars: detection (identifying manipulated content), policy (working with governments on transparency mandates), education (building public media literacy), and provenance (attaching verifiable origin data to files at the moment of capture).

Camera manufacturers are building this in at the hardware level. Leica released the M11-P — the first secure capture camera — which signs every image with a cryptographic certificate at the moment of capture. If the file is altered after the fact, the certificate breaks. Sony and Nikon are moving in the same direction.

Adobe is providing the toolchain: content credentials that travel with files, stored embedded in the file, in the cloud with a pointer, or on a distributed ledger.

It's early. Smartphones — where most images are made — remain largely outside this system. But the direction is clear.

For photographers, this matters practically. The value of a photograph has always rested partly on the claim that it was made — that someone was there, at that moment. That claim now needs to be verifiable. The tools to verify it are being built.