A missing content-provenance credential is explained by dozens of ordinary processes, from screenshots to re-encoding to a platform stripping metadata, so its absence alone cannot be treated as evidence that media is fake.
Someone sent me a video with no content-provenance credential attached to it, and my first instinct was to treat the absence as evidence — no credential, therefore something to be suspicious of, therefore probably synthetic or altered. I caught myself doing exactly the thing I would criticise in someone else’s reasoning: treating the lack of a signal as if it were a signal itself, when the mechanism behind that kind of credential explains why its absence tells you almost nothing at all. It is an easy mistake to make, because the idea of a provenance credential is talked about publicly as though its presence or absence settles the question either way, when only one of those two states was ever built to settle anything.
The mechanism, where it exists, works roughly the same way across the tools that implement it. A capturing device or an editing tool generates a signed manifest alongside the media — a record of where the file came from, what tools touched it, and in what order — and attaches it to the file so that anyone downstream can verify the signature and read the history. Done properly, it is a genuinely useful piece of infrastructure: a way to ask a piece of media where it has been, answered cryptographically rather than by trusting whoever last handed it to you.
The trouble is everything that happens to a file between the moment it is created and the moment it reaches you. A screenshot of a credentialed image carries none of the original credential, because a screenshot is a new file made by a different tool that was never asked to preserve one. Re-encoding a video for a smaller file size routinely strips whatever manifest was attached, as an incidental side effect of a process aimed at something else entirely. Plenty of the platforms that video and images pass through on the way to a phone strip metadata wholesale, credentials included, as a matter of course rather than as a decision about this particular file. A file forwarded between messaging apps before it ever reaches someone often loses every credential along the way, several times over, without anyone in that chain intending to hide anything at all. And a device or tool that never implemented the mechanism in the first place produces uncredentialed media by default, which describes most of the cameras and editors that have ever existed and will keep describing most of them for a long while yet.
Which leaves the inference running backwards from where it is actually useful. A present, valid credential tells you something real and specific — this device or tool, at this point in the chain, attests to this history — and that is worth having. An absent one tells you only that no credential survived to reach you, for reasons that include every one of the ordinary, non-suspicious paths above alongside the genuinely suspicious one of someone deliberately stripping it to hide provenance. Those two explanations produce an identical observation. Treating the absence as proof of the second one, when the first covers the overwhelming majority of media anyone actually handles day to day, is drawing a conclusion the evidence does not carry.
I have settled on treating a missing credential as exactly the null result it is — worth noting, worth being a little more careful before I amplify something further, but not itself an argument that a piece of media is fake or altered. If I actually need to know where something came from and the credential is not there to tell me, I go looking for other evidence instead of manufacturing certainty out of an absence that a hundred ordinary processes could equally explain. The mechanism is worth having precisely because it can prove a positive. Asking it to also prove a negative is asking it to do a job it was never built to do.