In February 2026, the Australian Federal Police released two photographs of Kazem Hamad following his arrest in Iraq. One showed him wearing a yellow shirt against a plain background. The other appeared to be a conventional custody photograph, with Hamad standing in front of a height chart and holding an identification board.
There was just one problem. The height chart didn’t make sense.
The measurements were inconsistent, with apparently random heights repeated at different positions. Journalists noticed the anomalies almost immediately. When questioned, the AFP confirmed that the photographs had been supplied by Iraqi law enforcement.
The arrest itself was not in question. Hamad had been detained by Iraqi authorities in January and was subsequently sentenced to life imprisonment for drug trafficking in July. The problem concerned the photographic representation of an event that had actually occurred.
Questions about the images continued. In May, a Freedom of Information request sought AFP records concerning their authentication, the response to media enquiries and policies for releasing AI-generated or enhanced imagery. Documents were released on 4 September 2026.
By November, the ABC was explicitly describing the questioned photograph as AI-altered.
For a forensic scientist, this raises a rather different question from whether the person depicted was genuinely in custody.
Was the photograph itself ever taken?
A real person does not make a real photograph
We have been manipulating photographs for almost as long as photography has existed. Digital editing made that process easier, and generative AI has substantially expanded what can now be manufactured.
During Stalin’s purges in the Soviet Union, photographs were routinely altered to remove political figures who had fallen from favour. One particularly well-known example involved Nikolai Yezhov, the former head of Stalin’s secret police. After his downfall and execution, Yezhov was removed from a photograph showing him walking alongside Stalin near the Moscow-Volga Canal. The retouchers replaced his figure with the water and embankment that would have appeared behind him.
This was done decades before Photoshop, using traditional photographic retouching techniques, including the manual alteration of negatives and prints.
The historical example demonstrates that the underlying problem is not artificial intelligence. It is the ability to construct a photographic representation that differs from what actually occurred.
The distinction matters because a photograph can contain genuine photographic material without representing a genuine photographic event.
Consider a simple composite. An existing photograph of a person is combined with a separately photographed background. The subject is real, the background is real, and both components may retain characteristics of physical camera capture. Nevertheless, the resulting scene never existed in front of a camera.
Generative AI extends this problem. A photographic face can be incorporated into a synthetically constructed scene, or an existing photograph can be modified to change selected elements.
In Hamad’s case, the inconsistent height markings provide an obvious reason to question how the scene was created. But an obvious anomaly is not sufficient to establish a forensic conclusion.
Forensic science requires us to move beyond visual impressions and test competing explanations against measurable evidence. An investigator’s suspicion may identify where an examination should begin, but it is the scientific evidence that determines what conclusions can be supported.
One possibility is that an existing photograph was altered. Another is that Hamad’s likeness was incorporated into a different photographic or synthetic scene.
These are competing hypotheses about the image’s production history, not findings that can be established from the height chart alone.
This is also why image authenticity cannot be established solely through recognition of the individual depicted, the credibility of the organisation supplying the file, or the presence of conventional photographic characteristics.
An image may have a legitimate institutional source and still have a production history that is unknown to the recipient.
We need to examine how the image came into existence, rather than simply asking whether it looks real.
What happened when we examined the photographs with SPOT?
In September 2026, RHEM Labs was asked to examine the two publicly released photographs using SPOT, our Sensor Pattern Origin Testing capability.
SPOT builds on my 2019 doctoral research into sensor pattern noise and subsequent peer-reviewed research into physical image formation. In April 2026, we published Challenges in Authenticating Synthetic Media: Forensic Insights from 6,000 DALL·E-Generated Images in the Australian Journal of Forensic Sciences.
The underlying approach is relatively straightforward.
Physical cameras produce images through an optical and electronic acquisition process. That process introduces measurable statistical characteristics, including contributions from the sensor and subsequent image processing.
Computationally generated images are created through different processes. Although they can look remarkably convincing, their statistical characteristics need not follow the same distributions as images produced through physical camera capture.
SPOT examines the noise residue of an image, extracts statistical measurements and compares those measurements against reference populations representing camera and synthetic origins.
Critically, we do not begin by asking whether an image was generated by artificial intelligence. We ask whether its measurable characteristics are consistent with having originated from a physical camera.
That distinction allows us to approach the problem through competing forensic hypotheses rather than relying on a binary assertion that an image is real or fake.
For the two Hamad photographs, we obtained the following results:
| Examination | Likelihood ratio (camera / synthetic) | Classification |
|---|---|---|
| Questioned custody photograph | 5.01 : 1 | Camera-class |
| Yellow-shirt photograph | 4.27 billion : 1 | Camera-class |
At first glance, these results appear unremarkable. Both images received a camera-class classification under the model’s decision rule.
But the classification conceals an enormous difference in the underlying evidence.
The yellow-shirt photograph produced a likelihood ratio of approximately 4.27 billion to one in favour of the camera-origin model. This represents extremely strong relative support for camera origin under the reference populations used.
The questioned custody photograph produced a likelihood ratio of just 5.01 to one.
To understand why that matters, we can express the results using the base-10 logarithm of the likelihood ratio, or log₁₀LR.
The questioned photograph produced a log₁₀LR of approximately 0.70, while the yellow-shirt photograph produced 9.63.
Logarithmic reporting makes it easier to work with evidence spanning many orders of magnitude. It also allows us to define thresholds for deciding when an image has sufficient support for camera origin to proceed through an assurance workflow.
For example, a log₁₀LR threshold of 0.5 corresponds to a likelihood ratio of approximately 3.16 to one. Under such a threshold, the questioned photograph would satisfy the camera-support criterion.
But a threshold of 1.0 corresponds to a likelihood ratio of ten to one. Under that more demanding criterion, the questioned photograph would not qualify for camera assurance and would instead require further examination. The yellow-shirt photograph would comfortably exceed either threshold.
The lower threshold is arguably too permissive for an examination of this kind. A log₁₀LR threshold of 1.0 would have produced a more useful distinction between these two images.
That does not mean 1.0 is a universally appropriate threshold. Operational thresholds must be selected and validated against the intended application, the reference populations and the consequences of incorrect decisions. This case illustrates why the distinction matters; it does not independently establish the optimal threshold.
The two likelihood ratios differ by approximately 852 million times, despite producing the same classification.
There is another important consideration in interpreting these findings.
We did not select two unrelated photographs from the internet. Both images were supplied by Iraqi authorities and released through the AFP in connection with the same event.
This gives the comparison a meaningful common provenance.
It is reasonable to consider that the photographs may have been exposed to similar institutional handling, transmission and publication processes. Comparing them therefore provides a more informative assessment than examining the questioned image in isolation.
The common source does not guarantee that the files underwent identical processing. They differ in resolution and may have different capture and editing histories. However, the shared distribution context provides a basis for considering which characteristics might arise from common handling and which warrant a more specific explanation.
Against that background, the enormous difference in evidential support becomes particularly interesting.
A likelihood ratio does not tell us the probability that an image is genuine. It expresses how strongly the observed measurements favour one specified hypothesis over another, given the models used.
Nor does a weak camera-origin result automatically establish that an image is synthetic.
But the combination of visibly inconsistent scene characteristics, substantially weaker camera-origin support and a comparator obtained through the same institutional source gives us a reason to investigate the questioned photograph further.
One hypothesis is that the photograph contains a mixture of genuine photographic material and artificially constructed content. That could account for some remaining support for camera origin without requiring the entire image to represent an authentic photographic capture.
We have not established that mechanism through the whole-image examination. It remains a hypothesis that requires further testing.
What we have demonstrated is that reducing these findings to a binary classification discards information that may be useful to an investigator.
This is the difference between classifying an image and evaluating the strength of the forensic evidence.
From forensic research to evidence assurance
The original Hamad examination was conducted in September 2026 using SPOT’s existing analytical capability. Our findings were communicated to a journalist investigating the photographs on 2 September.
Since that examination, we have been developing SPOT Desktop Analyst, a dedicated forensic examination application intended to bring our research capability into the hands of practitioners.
On 4 November 2026, we imported the same two photographs into the developing Desktop Analyst application and generated the examination reports reproduced in this article.
These reports demonstrate the next stage of SPOT’s development: taking the underlying scientific capability and integrating it into a structured forensic workflow.
The application provides more than the numerical result. Each examination records the evidence identifier, original image, file characteristics, cryptographic hash and analytical findings in a format suitable for forensic reporting.
The November timestamps therefore represent a software development milestone, rather than the date of our original findings.
This progression is important because the underlying statistical examination is only one component of an operational forensic capability.
An analyst also needs to import evidence, preserve its identity, examine its characteristics, interpret the results and generate a report that another practitioner can understand and review.
By integrating these functions into SPOT Desktop Analyst, we are moving from experimental research and command-line analysis towards software intended for use in routine forensic workflows.
The Hamad case also illustrates why that work matters.
Investigative organisations routinely receive imagery from other agencies, overseas partners, open-source intelligence collections and members of the public. The recipient may know where an image came from without knowing how it was originally produced or subsequently processed.
Those are different aspects of provenance.
An image transmitted through a trusted institutional channel may have an uncertain creation history. Conversely, an image obtained from an unverified source may still contain measurable characteristics consistent with physical camera capture.
Neither observation, by itself, establishes whether the depicted event occurred.
The practical value of image-origin assessment is that it adds information to the decision process.
An analyst can consider the strength of the forensic support, the intended use of the image, its known processing history and whether additional examination is warranted.
This is where SPOT can contribute to evidence assurance rather than simply functioning as another binary AI detector.
There is also a further technical problem illustrated by the Hamad case.
Images are not necessarily homogeneous objects.
A photographic subject, an artificially constructed background and an altered identification board may coexist within a single file. A whole-image likelihood ratio cannot establish the individual origin of each region.
Our wider research therefore separates image forensic problems into three related areas: origin, zoning and transposition. Origin concerns how the image was created. Zoning concerns whether different regions have different creation histories. Transposition concerns the transformations that alter or obscure the evidence left by those processes.
SPOT’s current whole-image analysis contributes to the first of these. Extending that approach to regional analysis is a logical next development direction, requiring further experimentation and validation.
The Hamad photographs provide a useful example of why those distinctions matter.
An operational workflow does not necessarily require every question to be answered by a single tool. It requires enough reliable information to determine what the next examination should be and when further expertise is necessary.
Conclusion: Beyond binary detection
The Hamad case demonstrates why the authenticity of a photograph must be considered separately from the event it purports to document.
SPOT did not establish how the questioned photograph was constructed. It did, however, reveal an enormous difference in the strength of forensic support between two images that received the same broad classification.
Those findings were obtained in September using our existing Australian-developed capability and have now been reproduced through the examination and reporting workflow of SPOT Desktop Analyst, currently being developed for release.
The wider opportunity is to move beyond binary AI detection and provide investigators with measurable evidence that can inform decisions, identify uncertainty and direct further examination.
The capability already exists. The next step is putting it to work where that evidence can make a difference.
SPOT (Sensor Pattern Origin Testing) is an Australian-developed forensic capability created by RHEM Labs. Its scientific foundations include peer-reviewed research into sensor pattern noise and a 2026 experimental study of synthetic image origin. SPOT Desktop Analyst is currently under development for release. The Kazem Hamad examination used publicly released image files and was not commissioned by the Australian Federal Police.