Publishing a blurred copy
Footage is not only for court. A collective may want to show what happened, quickly, without exposing the people filmed. From a closed session, Publish a blurred copy masks the faces in a passage and puts it online on a public ripoux.fr page, with the proof that the footage really comes from segments filmed, signed and timestamped while events unfolded.
It is reserved for the admins of a collective (legal team, observatory, newsroom), and the operator of the service can turn it off.
What becomes public, and what does not
This is the one exception to end-to-end encryption. The published copy is in clear on the server and visible to everyone: the masked video, its preview picture, the title, the description, the place, the date, the collective's public name, and the document that proves its origin.
Still encrypted and private: the session, its other segments, positions, written accounts, the session name. The originals are never modified: they alone are authoritative, and your collective keeps them.
1. Choose the passage
As for a verifiable extract: a take, a start and an end. Prepare the video decrypts these segments in your browser and assembles them, without sending anything.
The passage must be filmed throughout: no photo, no sound-only segment. iPhone takes (MP4) are not supported yet.
2. Mask
- Detect faces: a detection model, served by ripoux.fr itself (5.6 MB, loaded the first time), analyses five frames per second. Each face becomes a track, followed from one analysis to the next. The analysis takes about the length of the passage.
- Untick a track that is not a face (a poster, a logo). If a detection is no longer covered by any mask, a warning says so.
- Draw an area by dragging on the preview: a missed face, a number plate, a tattoo. It applies for 3 seconds from the frame shown; set its start and end.
- Mask the whole frame keeps only the sound: useful when nothing can be shown.
- Remove the sound when voices or names would let someone be recognised.
Masked preview shows the result; untick it to see the outlines of the masks over the original picture.
Masking is a coarse pixelation (blocks of at least 16 pixels, at most 5 blocks across a face), over the detected area enlarged by 20 %, with random noise: what was underneath cannot be rebuilt.
3. Render
Start the render plays the passage in real time and records the masked picture. Only this version will leave your browser. Keep the tab in front during the render, then watch the masked version in full: automatic detection misses faces in profile, from behind, blurred or very small.
4. Publish
Give a title, optionally a description, the place and the date, and your collective's public name. Two boxes to tick commit your collective: you watched the masked version in full, and you answer for what you publish.
Also choose its visibility:
- On the list of publications: it appears on /publications;
- Unlisted: it appears neither on the list nor in search engines; only the people you give the link to see it. Useful to pass a video to a newsroom or a lawyer without showing it to the public.
The visibility can be changed at any time from Publications (Remove from the list / Show on the list). An unlisted publication stays public for anyone with the link: it is not a private share. The service operator sees it like the others and can remove it.
On publication, your browser signs a derivation document with your account key: which source segments (their fingerprint and their path to the signed root of the session, never their key), which transformations, the fingerprint of the published video. The server checks the signature and the proofs, checks that the video received has that fingerprint, then signs and timestamps a publication receipt.
The owner of the source session, if it is not your collective (a shared contribution, for instance), is notified and the publication appears in the session journal.
The public page
Each publication has a stable address, ripoux.fr/p/…, with the video, the collective's name and a Where this footage comes from box. Verify now runs every check again in the viewer's browser: the collective's signature, each segment's membership of the signed, timestamped root, the server receipt, the video fingerprint. Download the proof gives a JSON file that can also be checked on /verifier, with or without the video.
Listed publications appear on /publications.
What the proof does not establish: that the masking changed nothing else. It says where the footage comes from, who publishes it, and that the video has not changed since. If authenticity is disputed, your collective can produce the unmasked verifiable extract of the same segments, to whoever is entitled to it.
Withdrawing
In Publications, Withdraw deletes the video and the preview picture from the server at once. The page stays, saying “withdrawn by its publisher”: a shared link does not lead to a silent error.
Reports
Under each video, Report this content lets anyone alert the operator: a recognisable face, a privacy breach, unlawful content. You see the number of pending reports in Publications. The operator hosts these copies: they review every report and may remove a publication; the page then says “removed by the operator”, and you are notified with the reason. See What the operator sees.
Good to know
- The published video counts against your account quota until it is withdrawn.
- A publication weighs at most 500 MB. For a long passage, publish several extracts.
- Nothing is indexed or tracked: the page loads no third-party resource.