After unrest, thousands of clips circulate. Some are useful; others are cropped, recompressed, old or generated. Volume encourages automation, but speed does not replace method.

Authenticate before identifying

Investigators preserve the original and metadata, calculate an integrity hash, document transfers and compare the scene with independent landmarks. This proves continuity of the file, not a person’s identity.

Visual geolocation, chronology and multiple angles can then test a hypothesis. A screenshot or repost is insufficient.

AI speeds triage and can be wrong

Software can group similar clips, build timelines or detect manipulation indicators. It can also miss edits or confuse clothing. Results require human review.

Publishing a face with an accusation invites collective error and harassment. An algorithmic suspicion must not become public conviction.

Protect city systems too

Physical disorder may coincide with attempts against municipal websites, information panels or transport services.

Organizations should separate physical crisis management from cyber response, retain logs, protect administrator accounts and communicate only confirmed facts.

Conclusion

Finding offenders does not mean indiscriminately monitoring a crowd. Good technology protects evidence integrity and reduces attribution errors.