Lessons From and for Syria: The Authenticity of Digital Evidence in Court

[Isabelle Bienfait is a programme co-ordinator at eyeWitness to Atrocities]

Two recent convictions of Syrian nationals for crimes committed during the civil war merit attention. On 16 June 2025, Syrian-born Alaa M. was convicted by a Frankfurt court for crimes against humanity and war crimes committed at several medical and military facilities. A few weeks earlier, on 28 May 2025, a Paris court made headlines when it sentenced former spokesperson and senior official of the Syrian armed group Jaysh al-Islam, Majdi N., for complicity in the war crimes of conscripting minors and of participating in a group formed with the intent to commit war crimes. Their convictions are part of the countless cases to surface from the devastation of Syria’s long-running civil war and are a testament to the functioning of the principle of universal jurisdiction. 

In both cases, digital tools and evidence were crucial: in the German court the now well-known “Ceasar photos” provided compelling proof of torture, and in the French case, the civil parties’ lawyer relied upon digital evidence, including a July 2015 video showing children making weapons for Jaysh al-Islam. The lawyer used the video to question the defendant about his knowledge of crimes committed during his time as spokesperson for Jaysh al-Islam.

This post explores the evolving role of digital evidence of mass atrocity crimes for accountability in post-Assad Syria. Digital evidence is understood as evidence that originates from digital technology, including ‘cameras, satellites, and other “remote sensing technologies”’. Its growing use by prosecutors suggests it is increasingly becoming a central component in convictions. This post provides a snapshot of the complexities of using digital evidence to secure convictions, focusing in particular on authentication. It argues that while such evidence offers unprecedented opportunities for justice in Syria and beyond, its utility and full probative potential will increasingly require aligning documentation and preservation efforts with evolving legal and procedural requirements for authenticating evidence. Syria is used as an example not only because it is one of the most documented conflicts in history, with documentation still ongoing, but also because the recent fall of Assad has renewed momentum for accountability.

Syria in Context

It took just over a week for the Hay’at Tahrir al-Sham (HTS) rebel offensive to seize control of Damascus and topple the long-standing Assad regime on 8 December 2024 – a cautiously jubilant moment for most Syrians after decades of dictatorship and 13 years of on-and-off civil war that killed over half a million Syrians and displaced many more. But the fall of Assad did not necessarily bring peace – instead, simmering sectarian tensions and power struggles have led to renewed violence, including air strikes on Damascus and southern Syria and Bedouin-Druze clashes in Suwayda province.

The broader political transition raises pressing questions about how accountability will be pursued in a future Syria. It also reinforces calls for authorities to safeguard evidence of mass atrocities, including war crimes and crimes against humanity. With political deadlock continuing to prevent investigations at the International Criminal Court (ICC), civil society and international investigative mechanisms have played – and will continue to play – a crucial role in documenting serious past and ongoing crimes. Recent developments in the country hopefully set the stage for harnessing these meticulous documentation and evidence preservation efforts for accountability. 

Further, institutional mechanisms have played a pivotal role in the pursuit of justice in Syria. One such mechanism is the International, Impartial, Independent Mechanism (IIIM), which was established by the General Assembly Resolution in 2016 to assist in the investigation and prosecution of those who committed serious crimes in Syria. The establishment of the IIIM has been referred to as a watershed moment in international justice, as the institution is designed for case-building and evidence preservation without being linked to a specific court. 

Alongside these institutional efforts, Syrian civil society and frontline actors are known to have pioneered novel forms of digital evidence collection. Already in the spring of 2011, front-line opposition activists started leveraging social media and using their smartphones to broadcast mass atrocities. Documenters secured a range of evidence materials, including official reports and photographic evidence such as the now-famous Caesar Photographs. First responder groups such as the White Helmets provided crucial documentation of remnants of chemical munitions used in chemical attacks in Al-Lataminah, Khan Sheikhoun, Qaboun, and several other towns. The ISIS Prisons Museum produced a virtual museum to exhibit forensic investigations into the Islamic State’s crimes and will soon launch the same for prisons of the Assad regime.

Much of the digital evidence collection related to atrocities during the Syrian civil war has already taken place, often under difficult and dangerous conditions. Further documentation efforts are underway as the political and security context evolves. These new materials will not replace, but rather supplement the extensive body of witness testimony, expert reports, and other forms of traditional evidence already gathered.

Establishing the Authenticity of Digital Evidence

Despite the continuous development of documentation technologies and their widespread use in Syria, it is important to consider that authentication increasingly complicates the admissibility and use of digital evidence in legal proceedings. Authenticity, as understood in this post, is the idea of the truthfulness of the tendered evidence, that the evidence “is what it professes to be in origin or authorship” as articulated by the International Criminal Tribunal for the Former Yugoslavia (ICTY) Appeals Chamber (para. 34). The evidence must not have been tampered with between its creation and its submission in court. Often a disjunctive test, evidence can either be authentic in and of itself or not, although it can be corroborated by expert testimony or other pieces of evidence.

Several trends point to a growing emphasis on ensuring the authenticity of digital evidence.

First, the burden on prosecutors and courts to ensure the material is free from false information or AI-generated content has become especially high given the increasing sophistication of synthetic media. Mis- and disinformation were already issues during the civil war in Syria, and have continued to be since the fall of the regime. One example is a video allegedly showing underground cells in Saydnaya prison, which was later revealed to have been created using artificial intelligence. Prosecutors may be hesitant to introduce evidence lacking metadata or other forms of verification, as doing so could undermine their case. Presenting such evidence without rigorous scrutiny threatens the legal predictability that helps parties plan their strategies effectively. 

Relatedly, it has become more commonplace for the defence to challenge the authenticity of digital evidence in court. For instance, in the Yekatom and Ngaïssona case at the ICC, the defence suggested that Facebook material was “fake news” and lacked adequate verification. This challenge reflects broader concerns over the fair trial implications of digital evidence and how the ‘weaknesses’ of such evidence require defence teams to scrutinise it closely. 

Moreover, courts are starting to adapt to new realities of digital evidence and may formulate increasingly strict authentication practices. In some domestic settings, digital evidence has become an instrumental part of cases involving core international crimes, often working in cooperation with specialised investigation and prosecution units. Depending on the jurisdiction, there are prerequisites for admitting digital evidence that hinge on ensuring the origin and creation of the material. In the Netherlands, for example, prosecutors must prove the authenticity of the digital material and provide a statement, signed by a police officer, detailing how the evidence was collected and preserved. 

The authenticity of material is also often assessed by national forensic institutions, such as in Sweden, where the Swedish National Forensic Centre (NFC) conducts such investigations for criminal prosecutions. In the Saeed case before the Örebro district court, for example, the NFC went through thorough forensic examination to evaluate the authenticity of images published on Facebook to conclude that they had not been manipulated. A review of cases indicates that courts generally see a need to assess whether digital photos and videos are authentic.

Although not directly relevant to the Syrian context, the ICC has also been employing methods to test authenticity in line with Article 69(4) of the Rome Statute and Rule 68(3) of the Rules of Procedure and Evidence. These include independent expert reports to rely on videos published via Facebook, as seen in Al-Werfalli (see para. 18 in particular), and geolocation techniques to confirm the location of incidents through satellite imagery, as in the Al-Mahdi case. The Trial Chamber in Ntaganda declined to admit a video where the prosecution was unable to provide information as to the date and time the video was shot (para. 63), the Chamber noting that if the tendering party is “unable to demonstrate its relevance and probative value, including with regard to its authenticity, the document cannot be admitted” (para. 9). 

The ICC Office of the Prosecutor’s increasing familiarity with digital evidence itself is reflected in its own renewed working practices – for example, the use of artificial intelligence to streamline the review of information submitted via OTPLink (see also Goal 3 in the Strategic Plan 2023-2025). So, although there are no authoritative guidelines as to the specific evidentiary requirements, the ICC is expected to continue refining its approach to authentication evidence to better address the unique challenges posed by digital evidence. 

An overwhelming amount of digital evidence from Syria thus requires robust frameworks for authentication and metadata analysis to render it usable. This necessitates both technical infrastructure and procedural discipline at the point of documentation.

Strengthening Practices

As a starting point, if documentation projects are ongoing (of past or ongoing crimes), it is important to document with consistent procedures. Documentation should be grounded in methodological rigour, with attention to metadata preservation, chain of custody, and secure storage. To support consistent and reliable documentation, the Berkeley Human Rights Center (in cooperation with the UN Office of the High Commissioner for Human Rights) launched the Berkeley Protocol on Digital Open Source Investigations. This protocol outlines best practices and security considerations for the investigative process. Its comprehensive guidance helps harmonise methodologies across different actors, promoting the collection of accurate and potentially admissible evidence.

Initiatives like eyeWitness to Atrocities, developed by the International Bar Association, offer a practical tool for enhancing evidentiary reliability. The eyeWitness App embeds footage with metadata (date, time, and geolocation) and stores it in a secure server to create a trusted chain of custody. Such tools can help ensure that digital evidence from Syria withstands judicial scrutiny, particularly as it is a context plagued by disinformation.  

Finally, effective documentation also requires secure storage and encryption mechanisms to protect data integrity over time, particularly as cases can take a long time. Models such as Europol’s Analysis Project on Core International Crimes (AP-CIC) strengthen long-term data reliability and can support case-building efforts but do require evidence submitted by competent national authorities from EU Member States and agencies or non-EU countries with operational agreements. The IIIM also plays a crucial role in bridging local and international efforts for data collection and preservation: it works with Syrian civil society groups under formal cooperation agreements, helping to integrate locally collected evidence into broader accountability processes. This underscores the growing collaboration between grassroots efforts and international justice initiatives. 

These are just a few of the many valuable initiatives working to bridge the gap between documentation on the ground and the standards required for admissibility of evidence in legal proceedings.

Conclusion 

As this discussion (and that of several others) has outlined, the growing availability and sophistication of digital evidence offer unprecedented opportunities to document international crimes around the world. Since restrictions were lifted in Syria, there is an understandable eagerness to collect as much evidence as possible, especially to supplement existing evidence collected over the years.

Where such material is intended for use in accountability processes, however, documentation should be approached with rigour – captured and preserved in ways that align with evolving evidentiary standards of domestic and international courts. This applies to documentation in any context. Without this careful consideration, compelling evidence risks being inadmissible or undermining the integrity of legal proceedings.