Hidden messages in seemingly innocuous videos, photos, audio or text. For example, a criminal can let it be known in which container drugs are hidden. Or display child pornography on a public platform. The hidden messages are difficult to recognize with the naked eye. The Netherlands Forensic Institute (NFI) is participating in the European project UNCOVER in which investigative services are developing tools with universities and companies to discover and read hidden messages in videos and images.
The art and science of hidden messages is called steganography, says Meike Kombrink, who works at the NFI on recognizing the messages. "It's art because it's creative, but it's science because you have to know how to hide it in digital images or videos. You have to understand how it works." Criminals and terrorists can use steganography to hide information and communicate with each other. "Crypto and stego are close to each other. With crypto you hide the content of the message and with stego you hide the existence of the message."
Al-Qaida allegedly used steganography to plan the 9/11 attack, according to a scholarly paper (Dalal and Juneja, 2021). The paper also reports that Russian spies used steganography to communicate secret messages to Moscow in 2010. The method was discovered by the FBI. In the Shadowz Brotherhood case, child pornography was hidden in innocent-looking images. International scholars warn that steganography is becoming increasingly popular since investigative agencies have shown with Encrochat that they can break crypto (O'Rourke, 2020).
In the Netherlands, there are some examples of criminal cases in which suspects used steganography. The NFI was then able to read out the hidden messages. 'Stego' was used in an extortion case back in 2003, for example. The suspect wanted to receive hidden bank information via an image on a certain website, or else the extortionist would actually take action. "We suspect it's being used," Kombrink says: "You don't recognize it with the naked eye. It's likely that it happens more often than we see it. We therefore tell about it regularly and draw the attention of investigative agencies."
An object in which shorthand is hidden is called a cover. There are three common ways to hide messages in images, and each way has different variations. The first way is to adjust the binary values of the colors in images. You then adjust the color intensity of, say, a pixel. "You add a small drop of red to the code of the color, as it were. You don't see that when you look at the picture. You can sometimes recognize it when you look at the binary values. The adjusted values can again display hidden text."
Another method of hiding messages is by transformation, another rendering of the image. An example is compressing the file, say shrinking it to save it. "Then you create a kind of summary of the image, so to speak," Kombrink explains. There are several ways to summarize images. The most important numbers of an image show up in the summary. When you know where those are, you can hide a message in there. "In the big image you don't see the message, you don't see that until you have made a summary of the image and know where in the summary the message is hidden."
The third way is that with the help of AI, images, audio or text can be created in which a message is hidden. Normally you have an original image in which something is modified to hide a message. "You then have to know well where to hide the message without changing anything about the image. For example, at the edges of the objects." For the third method, you don't need that knowledge. "Now you don't have an original, the neural network can then create an image itself with the hidden message in it right away."
The NFI is now investing with European partners in automated systems to recognize stego. The NFI is investigating whether neural networks are effective for detecting hidden messages. Neural networks are structurally inspired by the human brain. The models learn in a similar way to humans. Namely, by looking at lots of examples.
Recently, Eindhoven University of Technology student Mart Keizer investigated whether neural networks can detect hidden messages in video files (video steganalysis). For the study, the student created a large dataset of videos that did or did not contain hidden messages. By giving the neural network a lot of videos and also giving it the information whether or not they contain a hidden message, the network itself could detect a certain pattern. With that, it can then detect for itself whether there is a hidden message in a video or not. Once the network is "trained," it can be used to determine whether or not there is a hidden message in a video file. Further research is needed, but initial results were promising, the detection rate for two types of steganography studied was 99.96%.
Just developing tools for detection is not enough, Kombrink said. "Stego an sich is not punishable now. You can also hide an innocent message. So you have to know the content to recognize a less innocent message. So I also want to train neural networks to read the message automatically." Kombrink suspects that stego is not currently used a simple crime. "You still have to communicate the method to get the message out. I suspect this is only of interest to heavier criminals." Once the tool is ready, Kombrink thinks it would be good to add it to the digital search engine Hansken, which can be used to examine large amounts of digital data in criminal cases. "I am curious. Only when the tool is there will we know on what scale it will be applied in the Netherlands. Until then, we have to be alert to it with the manual search."
Kombrink's doctoral project is part of ICAI AI4forensics lab in formation with the University of Amsterdam and the NFI under the supervision of Prof. Marcel Worring and Prof. Zeno Geradts.
