Both the Daily Mail and the Daily Mirror today – among with several others in the US (including the New York Post, which credits the image to AP) and other countries – published an image purporting to be that of the dead Osama Bin Laden.

It clearly wasn’t.

Any journalist with a drop of cynicism would have questioned the source of the images – even if they did appear on Pakistan television.

It certainly passed the ‘Too good to be true’ test.

Instead, it was users of Reddit and Twitter who first highlighted the dodgy provenance of the image, and the image it was probably based on. Knight News and MSNBC’s Photo blog‘s followed soon after.

It took me all of 10 seconds to verify that it is a fake – by using TinEye to find other instances of the image, I found this example from last April.

But instead of owning up that their image was a fake, both The Daily Mail and Mirror appear to have simply removed the image from their site, leaving that image to circulate amongst their users. Ego, pure and simple.

PS: More on verifying images and other hoax material here.

Image from jonnycampbell.com

Various parts of the media were hoaxed this week by Belfast student Jonny Campbell’s claim to have won a Twitter internship with Charlie Sheen. The hoax was well planned, and to be fair to the journalists, they did chase up documentation to confirm it. Where they made mistakes provides a good lesson in online verification.

Where did the journalist go wrong? They asked for the emails confirming the internship, but accepted a screengrab. This turned out to be photoshopped.

They then asked for further emails from earlier in the process, and he sent those (which were genuine) on.

They should have asked the source to forward the original email.

Of course, he could have faked that pretty easily as well (I’m not going to say how here), so you would need to check the IP address of the email against that of the company it was supposed to be from.

An IP address is basically the location of a computer (server). This may be owned by the ISP you are using, or the company which employs you and provides your computer and internet access.

This post explains how to find IP addresses in an email using email clients including Gmail, Yahoo! Mail and Outlook – and then how to track the IP address to a particular location.

This website will find out the IP address for a particular website – the IP address for Internships.com is 204.74.99.100, for example. So you’re looking for a match (assuming the same server is used for mail). You could also check other emails from that company to other people, or ideally to yourself (Watch out for fake websites as well, of course).

And of course, finally, it’s always worth looking at the content the hoaxer has provided and clues that they may have left in it – as Jonny did (see image, left).

For more on verifying online information see Content, context and code: verifying information online, which I’ll continue to update with examples.

When the telephone first entered the newsroom journalists were sceptical. “How can we be sure that the person at the other end is who they say they are?” The question seems odd now, because we have become so used to phone technology that we barely think of it as technology at all – and there are a range of techniques we use, almost unconsciously, to verify what the person on the other end of the phone is saying, from their tone of voice, to the number they are ringing from, and the information they are providing.

Dealing with online sources is no different. How do you know the source is telling the truth? You’re a journalist, for god’s sake: it’s your job to find out.

In many ways the internet gives us extra tools to verify information – certainly more than the phone ever did. The apparent ‘facelessness’ of the medium is misleading: every piece of information, and every person, leaves a trail of data that you can use to build a picture of its reliability.

The following is a three-level approach to verification: starting with the content itself, moving on to the context surrounding it; and finishing with the technical information underlying it. Most of the techniques outlined take very little time at all but the key thing is to look for warning signs and follow those up.

Level 1: Content

At its most basic level, alarm bells should ring if the information you’re looking at is simply too good to be true. The disgruntled sacked employee who makes lights up the exterior of Harrods with a farewell message fits this category. Ask yourself: would this really happen? And if so, who else would have known about it?

If the information is coming through social media you have to ask: is this bait? Jan Moir’s Twitter ‘apology’ is one good example – lending itself to easy retweeting. Peter Serafinowicz’s ‘deleted’ offensive joke is another. So are various Facebook rumours, such as paedophiles who want you to change your profile picture, or party gatecrashers, and the occasional protesting Facebook group. And forum rumours (sometimes placed intentionally to expose journalists who plagiarise without giving their source). And press releases.

Embarrassing emails that go viral can turn out to be PR tricks. Video diaries can be revealed as new forms of narrative. Spectacular video footage can turn out to be more PR (by the way, read through that thread to see how it is infiltrated by a PR person but their identity is challenged). Check the facts, and see what other people have uncovered. And click on all of these links: the more hoaxes you are familiar with, the more likely alarm bells are going to ring at the right time.

The frequency and recency of information will give you a clue as to its veracity: the more recent the information, the more up to date it is likely to be (although it may be based on out of date information – trace it back to its source). And the more frequently a source is updated (over a long period of time), the less likely it is to come from an opportunistic hoaxer. You can get browser bookmarklets that tell you when a webpage was last updated (as well as many other pieces of information).

Finally does the style and personality of the information match the supposed source? Do they write in the same tone? Do they make spelling mistakes?

For images look for cloning and airbrushing. Cloning is the replication and repetition of small areas of a photograph to, for instance, make a crowd look bigger by duplicating faces; make an air attack look more dramatic by adding extra plumes of smoke, or to make an operations room look more active by filling blank screens.

Airbrushing is the removal of details – the Harrods image mentioned above was most likely created in this way, by removing lights so that those remaining spelled out the message. Also worth watching for are composite or staged images, such as the various Google Street View hoaxes.

This article suggests that inconsistent lighting, eye shapes and light reflections within eyes are all good clues to look for as well. And this related infographic allows you to explore how one image has been retouched. This article by Judith Townend goes into more detail about spotting manipulted images.

Level 2: Context

Social media lends itself particularly well to verification because, in our activity in social networks, we effectively verify each other. If your information comes from a social network account, ask yourself some of these questions:

How long has the account existed? If it’s only existed since a relevant story broke (e.g. Jan Moir’s column; an earthquake where someone claims to be a witness) then it’s likely to be opportunistic.

Who did the person first ‘follow’ or ‘friend’? These should be personal contacts, or fit the type of person you’re dealing with. If their first follow is ReadWriteWeb, then it may be that you’re not actually dealing with a Daily Mail columnist.

Who first followed them? Likewise, it should be their friends and colleagues.

Who has spoken to them online? Ditto.

Who has spoken about them? Here you may find friends and colleagues, but also people who have rumbled them. But don’t take anyone else’s word for their existence unless you can verify them too.

Can you correlate this account with others? The Firefox extension Identify is a useful tool here: it suggests related social network accounts which you can then try to cross-reference. For companies the Chrome extension Polaris Insights does something similar for companies.

For Twitter you might also try other tools including PeerIndex and Klout, both of which use algorithms to give extra information on the ‘human-ness’ and content of particular accounts. On Facebook there is the social commenting plugin which attempts to give a credibility score to commenters.

Finally, of course, you should try to speak to the person. Phone their office or their employer and confirm whether they do indeed have the account in question.

For websites the checks are broadly similar. On Google you can use the advanced search facility to look for other pages that link to the one you’re checking. These might include other website that have rumbled the hoax before you – or are bragging about it.

Similarly look what links the webpage contains to other sites: does this fit what you would expect? The browser bookmarklets mentioned above will collate these for you. At this point we’re starting to move onto the third level…

Level 3: Code

First, look at the website address. If it is purporting to be a governmental website it should end in .gov, .gov.uk etc. Health websites may end in .nhs, police in .police, defence in .mod and so on. Academic websites should end in .ac.uk or .edu but this is no guarantee: less reputable ‘establishments’ have managed to obtain web addresses with these extensions. And of course .com addresses offer no guarantees.

Murray Dick gives more advice on the other elements of a web address, and recommends using an open directory to check your searches, as these are maintained by people, not computers, are less likely to contain hoax websites.

Use a Whois service to find out who the web address is registered to. This isn’t immune to fakery but the hoaxer may not have thought about it, and if the details are hidden you may wonder why. Try variations of the domain – when the viral ‘Labservative’ campaign first began it was not clear who was behind it, and I started by looking at Whois details – the company had kept their details private for the .com address, but they had forgotten to do so for the .co.uk variation. I then called up the company and tried to call their bluff by asking who was managing the campaign.

If you are asking for emails verifying a story, make sure you are forwarded the original email, and not a screengrab, and follow this process to check the IP address of the email against who it’s supposed to be from.

Archives and caches can be useful to compare the latest version of a webpage with older versions. Conducting a relevant Google search and clicking on ‘cache’ next to the relevant result can show up recent changes. The Internet Archive‘s Wayback Machine (recently revamped) can give you snapshots going further back. On Wikipedia and other wiki-based sources, look for ‘history’ and ‘discussion’ links where you can see what changes have been made and the discussions about those.

For images you can check out the EXIF data – this is information about when the image was taken, on which camera, and with what settings. This online tool (there’s a Chrome extension too) allows you to quickly see the EXIF data on any web-based image. This information is best used when speaking to the photographer – ask them when to give you the details that you can verify against the EXIF data. This isn’t a foolproof method but it will screen out most hoaxers.

Some news organisations – such as the BBC, in its UGC hub – have systems that look for Photoshop modification (not necessarily a sign of hoax – a user could simply have cropped or lightened an image). You can also see this yourself by looking under “details” > “origin” > “program name”. JpegSnoop will provide more details on images. Error Level Analysis is another useful tool to detect possible alteration, although it’s not perfect.

Finally, right-click on the page and view the source code. Occasionally hoaxers intentionally leave clues here, but you can also find other clues such as the author, date, location, and technologies used.

Any other techniques?

Those are just the techniques and tools that I can call to mind but I’m sure there are others I’m not aware of. Any you can suggest?

UPDATE: The BBC College of Journalism’s post on verifying content adds some other useful tips on cross-verification with maps, weather reports and other details.

A few days ago status updates like this were doing the rounds on Facebook:

“Change your facebook profile picture to a cartoon from your childhood and invite your friends to do the same. Until Monday (December 6), there should be no human faces on facebook, but a stash of memories. This is for eliminating violence against children.”

Of course it is. Or maybe not. Today, the rumour changed poles:

“This cartoon thing has been set up by paedos using A registered charities name to entice kids. apparently on the 6th dec you will be kicked off fb if u have cartoon pics. The more folk that… put up cartoon pics the harder it is fo…r the police to catch these sickos!!”

There doesn’t appear to be any truth in the latter rumour. Internet hoax library Snopes has a similar hoax listed, and this seems to be variant of it. ThatsNonsense.com also covers the hoax.

SEO as a public service

Hoax updates do the rounds on social networks and text messages on a semi-regular basis. Remember the one about children being kidnapped in supermarket toilets? Or how about police banning English flags in pubs for fear of offending people?

In both cases the mainstream media was slow to react to the rumours. A Google search – which would be a typical reaction of anyone receiving such a message – would bring up nothing to counter those rumours. (Notably, perhaps because of its public and real-time nature, Twitter seems better at quashing hoaxes).

Search engine optimisation (SEO) is much derided for a perception that it leads news organisations to write for machines, or to aim for the lowest common denominator. But SEO has a very valuable role in serving the public: if searches on a particular rumour shoot up, or mentions of it increase on social networks, it’s worth verifying and getting up the facts quickly.

This is another reason why journalists should be on social networks, and why publishers should be monitoring them more broadly. Whether your motivations are civic, or commercial, it makes sense both ways.

Of course, on the other hand you could always recycle urban myths about councils banning Christmas…

PS: If you need any tips on methods and tools, see my Delicious bookmarks for verification.

(h/t to Conrad Quilty-Harper)

It is always fun when a hoaxed piece of research gets past all the filters and makes the newspapers, but what does it teach us? This is a video report from the Hungry Beast team in Australia, “proving” which part of Australia is the most gullible. The answer is, apparently, “the media”.

Link, in case the video doesn’t embed properly.

Here’s a different example from last week: Andrew Lansley’s insurance of a painting and medal on his Expenses as an MP.

All the papers quoted a value of 3500 ukp, except for the Independent which quoted a *premium* of 3500 ukp.

Independent:

“Other senior Tories also faced embarrassment over the latest expenses revelations. Andrew Lansley, the shadow Health Secretary, submitted a 3,500 claim for the cost of insuring a medal and a painting.”

FT

Among the more whimsical claims was a 58.67 whistling kettle bought by Tory MP Douglas Carswell, 400 of repairs to Crispin Blunt’s “waterwheel structure” and Andrew Lansley’s insurance of a medal and a painting.

Cambridge News

Andrew Lansley’s home insurance policy reveals he specifically paid for protection on a medal valued at 2,022 and a painting, Hotel Tropical Island by D D D Ferris, worth 1,506.

Times

Andrew Lansley, Shadow Health Secretary, claimed the 398.92 cost of a home insurance policy, which listed a medal valued at 2,022 and a painting by DDD Ferris, entitled Hotel Tropical Island, valued at 1,506.

So what conclusions can we draw?

These are my reflections as a blogger:

1. We have shifted to reading multiple sources on the same story presented together by Google News and other “headline summarizing” websites, such that variations are more visible.
2. Articles reported in the media are just another set of sources. Sometimes they will not be consistent amongst themselves.
3. If I am commenting, my reputation depends on the facts I’m commenting on being the accurate ones. If the big media source I quote is mistaken, then it takes part of my reputation with it too. So I have to do careful checking.
4. It is the easiest thing in the world to be provoked by an “outlier” report, such as the Independent above. That way lies madness, and a broken reputation.
5. Perhaps commentators’ need to fact-check is one factor driving more detailed scrutiny.
6. Tight deadlines and thinner journalistic resources perhaps exasperate any difficulties.

I think that both bloggers and MSM writers need to re-emphasise traditional craft disciplines – dual sourcing, fact checking, sweating the detail. In other words, all the boring stuff.

The fake Jan Moir lays some too-good-to-be-true bait on Twitter

If you were following the Jan Moir-Stephen Gateley story that was all over Twitter today you may have come across a Twitter account claiming to be Jan Moir herself – @janmoir_uk. It wasn’t her – but it was a convincing attempt, and I thought it might be worth picking out how I and other Twitter users tried to work out the account’s legitimacy.

The too-good-to-be-true test

The first test in these cases is the too-good-to-be-true test, and this works on a number of levels. Jan Moir tweeting in itself was a great story – but not completely unbelievable. Her second tweet said “I have been advised by my editor to create a twitter account and offer my sincere apologies for any upset and distress i have caus” [sic] – a superficially plausible story. Would you buy it?

But there were some other too-good-to-be-true claims in her tweets. One said “My son is gay. I am not homophobic. Please read my article properly.” Does Jan Moir have a son? Is he gay? Would she announce it on Twitter?

And finally, the promise of a formal apology and the tweeted apology itself ticked the too-good-to-be-true box.

Style and personality

Jan is a journalist, and so is unlikely to use a lower case ‘i’ to refer to herself, regardless of the medium. She would also probably capitalise Twitter. And a later tweet uses the phrase “heart felt” which should be one word. Not all journalists have impeccable grammar, but this should raise suspicions.

More suspicious is the fact that the link she gives to her statement takes us to… The Independent newspaper. Would a Mail journalist link to a competitor?

Finally, Jan uses the hashtag #janmoir – unusual on someone’s first day using Twitter – although you might suggest a more experienced user was guiding her.

Who’s following?

One of the first things to check with a potential hoax account is who is following them. If they genuinely work for the Daily Mail, you could expect other staffers to be following them, or official accounts. That wasn’t the case here.

Who’s she following?

Likewise, is this account following the sort of people you would expect, particularly the first few? In this case the first person followed was an American footballer, followed by a US government agency, ReadWriteWeb, Wired magazine, the LA Lakers, 50 Cent, Flaming Lips and various others. That was a real alarm bell. At best they might have been followed on her behalf by a tech support person who was helping her, but more likely is that the hoaxer is either leaving clues or – more likely – following accounts that are likely to get them noticed. The numbers of tech websites in the list suggest that the latter was the case.

Messages to/about them

Who’s talking to this account? What are they saying? Again, if this person genuinely works for the Daily Mail there may be others there talking to her; conversely, if this is a fake account people may be pointing to proof of that fakery.

Suspicious behaviour (bait)

This is similar to the too-good-to-be-true test – the promise of a formal apology and an appearance on Channel 4 News were teases – bait to get people to retweet. And it worked. But ask: why was Channel 4 not talking about the interview they’d supposedly obtained? (After all, this was the top trend on Twitter for a while) Why was Jan Moir issuing apologies on Twitter, and not in a more ‘official’ setting? What was lacking here was…

External verification

This was what really sealed it with @janmoir_uk  - she said she would be appearing on Channel 4 News that night to apologise. A couple of Twitter users asked Channel 4 reporter Krishnan Guru-Murthy whether this was true. “No,” he replied, twice (h/t Todd Nash for pointing me to this). Of course you could have called The Daily Mail to check, too…

Anything else?

What techniques have you used to verify the authenticity of Twitter accounts? It would be great to compile more examples.

UPDATE: It seems even ‘Verified’ Twitter accounts can turn out to be fakes, such as that pretending to be the wife of Rupert Murdoch, Wendi Deng. Note her tweet below about the clues she left.

The Fake Wendi Deng points out her Twitter clues

Good to see final year journalism degree student Todd Nash has his hoax-spotting eyes on. He’s kicked off a new journalism blog with an overview of some pretty obvious photoshopping that managed to get past the people at Sky News:

“The best pranks are the ones where the victim has absolutely no idea what is happening and this is true here. Some photoshop happy forummers on the Football365 Forum began adapting marathon photos from Flickr, Google Images and anywhere else they could get their hands on them.

“They then sent them in to the unsuspecting Sky News team with spectacular results:

“How they didn’t see Tron amazes me.

“A cruel sense of humour from Daniel Carr as the Grim Reaper makes an appearance (and not as a runner)”