Look at a video file. You cannot tell from it whether a camera recorded what it shows. Not by eye, and not reliably by running a detector over it afterward. What answers the question is provenance: a signature the camera applies as it records, plus a record of everything that touched the file after that. Detection is the fallback for when nobody bothered with any of that.
That distinction used to be an academic one. It stopped being academic in the last twelve months, because judges started throwing out video.
The short version Signed-at-capture video is proof. A clean detector score is only an absence of evidence. If your footage might ever matter legally, fix the capture side now, because you cannot retroactively add provenance to a file you already exported.
Courts stopped taking video at face value
Start with California. In September 2025, Alameda County Superior Court threw out Mendones v. Cushman & Wakefield entirely. What sank it was Exhibit 6C, a video witness statement. Judge Victoria Kolakowski noticed the voice ran flat, the face looked soft, and a few expressions kept repeating on a loop. The witness was a real person who appeared in other evidence that was genuine. That particular video was fabricated.
The court ended up suspecting nine exhibits of being altered or generated, including doctored photos and fabricated text messages, and issued a terminating sanction against the plaintiffs. Reconsideration was denied that November.
Then the standard itself moved. On February 17, 2026, New York's Court of Appeals decided Matter of M.S. (M.H.), with Chief Judge Rowan Wilson writing for the majority. The court reversed the lower courts and held that the video clips at issue had never been properly authenticated. Showing that a video accurately depicts a location is no longer enough. Under that ruling, a party offering video has to close the gaps: chain of custody, whether the footage is complete or clipped, testimony from whoever created it, and testimony that it is unaltered. Doubts get resolved before admission, not left to the jury to weigh.
Federal rules are heading the same way, just slower. Proposed Federal Rule of Evidence 707 would put machine-generated evidence through the same reliability gatekeeping that Rule 702 applies to expert testimony. Comment closed February 16, 2026. The earliest it could take effect is December 1, 2027. One detail matters if you run cameras. In its comment, the American Association for Justice argued the rule reaches too far into routine material, and it named surveillance footage as an example.
AI made footage easier to find and easier to doubt
The retrieval side of this genuinely improved. Older recorders stored video and left you to scrub through it, so investigating a missing overnight shipment meant an hour of scrolling across four camera angles.
Modern platforms index what is in the frame. A Cloud NVR like Coram's connects to existing IP cameras and adds AI search on top, keeping video stored locally on the appliance while making it reachable from a browser or phone without VPN or firewall changes. Coram states a ten-minute setup and runs its models on NVIDIA accelerators. You search for the thing instead of the timestamp, and the hour becomes a minute.
Now the part that gets skipped. How fast you found the clip tells you nothing about whether the clip is real. The same convenience cuts both ways. A manager exports from a phone in twenty seconds, and what lands with the lawyer or the insurer or the reporter is a re-encoded copy sitting several hops from the recorder that made it. Ask whether it is authentic at that point and you are asking too late. Whatever would have answered you got stripped out somewhere around hop two.
And the generation side improved too. The Mendones deepfake was caught because it was mediocre. Betting your next incident on the fake being mediocre is not a strategy.
Signing at the point of capture
The industry answer to this is to stop treating authenticity as something you assess later. In June 2025, ONVIF announced a collaboration with the C2PA, pairing two complementary approaches.
ONVIF's media signing specification handles the capture end. Footage gets signed cryptographically as it is recorded, with a key belonging to that one camera and no other. The signature rides inside the video, so a verification tool can later check whether any frames changed anywhere along the chain of custody. C2PA Content Credentials cover the history instead. Think of a nutrition label for a media file: where it came from, what software edited it, whether generative AI had a hand in it.
Together they answer the two questions a court actually asks. Which device captured this, and has anything changed since. If you are specifying cameras or a recorder this year, ask the vendor directly whether it supports ONVIF media signing. It is a purchasing decision now and an evidentiary problem later.
What to do when the footage is not signed
Most footage in circulation today carries no provenance at all. That is where detection comes in, with realistic expectations about what it can do.
- Pull the original, not the copy. Get the file off the recorder itself. Re-encoding through a phone, a chat app, or a slide deck destroys most of what forensic analysis would use.
- Keep the whole timeline. The New York ruling treats clipping as a gap you have to explain. Export the surrounding footage, not just the moment.
- Check the audio separately. Synthetic speech is a different detection problem from synthetic video and often the weaker link in a fabricated clip. An AI voice detector handles the track independently.
- Check the paperwork around it. The Mendones case involved fabricated text messages and statements alongside the video. Running the incident report and written statements through an AI detector is often more informative than analyzing the video.
- Document who touched it. Names, times, systems. Unglamorous, and the thing most likely to decide admissibility.
The honest limitation
Video deepfake detection is probabilistic, and it degrades exactly where surveillance lives. These models perform worst on low-resolution, heavily compressed, poorly lit footage, which describes most CCTV. A clean score on a grainy night-time clip is weak evidence, not a clearance.
This is why the framing matters. Detection tools, including ours, produce a probability and a set of flags, and we are direct about how our detection models reach a score and where calibration gets harder. Provenance produces a verifiable fact. When you can have the second one, take it. For the broader picture on where video and audio detection stands, see our breakdowns of deepfake audio and video detection and how deepfake detection technology has developed.
Before your footage has to prove itself
- Ask your camera or recorder vendor whether ONVIF media signing is supported
-
Set retention long enough that you still have originals when a claim arrives -
Write down an export procedure: original file, full timeline, logged handler -
Decide who is authorized to export, and log every export -
Verify audio and accompanying documents separately, not just the video -
Treat any clip that reached you through chat or email as unverified by default
Frequently asked questions
Can an AI detector tell me if security camera footage is fake?
It can give you a probability and flag artifacts, and that is genuinely useful as a first pass. It cannot give you certainty, and it is least reliable on the compressed, low-light video that security cameras produce. Treat a result as a reason to investigate further, not as a verdict.
What is signed video, in plain terms?
The camera adds a cryptographic signature to the footage as it records, using a key that belongs to that specific camera. Anyone can later check the signature. If a single frame was altered after capture, the check fails. It proves origin and integrity rather than guessing at them.
Does storing footage in the cloud make it less trustworthy?
Not inherently, and cloud-connected recorders that keep the original on local storage while syncing access can actually strengthen chain of custody through better access logs. The risk is behavioral: easy export means clips travel widely, and the version people end up arguing about is rarely the original.
What should I do if footage might be used in a legal matter?
Preserve the original file on the recorder immediately, export the full surrounding timeline rather than a clip, record who accessed it and when, and get counsel involved before circulating anything. Under the current authentication standard, you will likely need someone who can testify to how the video was made and that it is unaltered.
Where this leaves you
The question is shifting from whether you have cameras to whether what they record can be proven. AI search made surveillance video far more useful day to day, and the same technology made a clean-looking video a much weaker claim on its own.
Provenance is the durable fix, and it has to be built in at capture. Detection is the fallback for everything already recorded, and it earns its place as long as nobody oversells it. If you are also thinking about how synthetic media intersects with fraud and automated attacks more broadly, our piece on AI detection in cybersecurity covers that ground.