In the ongoing waltz around the issue of nuclear power / nuclear weapons of Iran, recently Iran conducted a missile launch test using long-range missiles capable of hitting Tel Aviv and other cities of Israel. This test was obviously in response to Israel’s earlier military exercise in the Mediterranean. And that was in response to the fear of Iranian nuclear weapons and threatening political rhetoric by Iran’s leaders, and so on and so on.

Anyway, some pictures and video were released from the missile test. In the pictures, due to self-similarities in the dust clouds resulting from a missile launch, claims were made that Iran’s missile test pictures had been digitally altered. And, of all things, using the simple “stamp” aka. clone aka. copy-move tool available in most image editing software…

It is as if the propaganda creators had not learnt anything from the doctored Beirut images!

I became interested in how could this kind of manipulation be detected automatically. After some googling I found John Graham-Cumming’s blog article about how he implemented Jessica Fridrich’s copy-move detection algorithm as a program called “copymove”. The Fridrich copy-move algorithm is not perfect but seems to work in many of the cases where the clone tool has been used.

After taking the speed optimized copymove version, I also grabbed the missile pictures from Mike Nizza’s blog, and then I was all set to let my computer sweat.

For technical details, check the paper by Fridrich for technical details how the algorithm works. To understand the results below, the copymove program colors similar areas in the resulting picture with red and blue; each red block has been swapped with or originates from a blue block shown somewhere else in the picture. If there’s a monotonic pattern which repeats appropriately, then the algorithm incorrectly detects that as a copy-move manipulation. So some care should (of course) be taken when interpreting the results.

The results

The image with four missiles, which was claimed to be forged, is shown below:

Quality value was 10, threshold 20. Note, how the dust/smoke area between the third and the fourth missile is detected to be a cloned area. It looks like to be a copy-move manipulation.

The image with three missiles and the missile launcher is shown below:

Quality value was 10, threshold 20. Note how only the fence seen in the foreground seems to be detected as cloned area, my guess is that it happens to be a suitably-sized repetitive pattern. The missiles do not seem to be photoshopped. Also, the missiles in this photograph seem to be lower in altitude than in the first picture (with four missiles), plus the launcher is visible, which would indicate this picture having been taken earlier.

Therefore, to me it seems seemed that:

• Missiles do not seem photoshopped. I.e. at least 4 missiles were launched, no launch failures.
• Smoke/dust definitely seems photoshopped. But this doesn’t make sense at all. Either it’s a really insane coincidence, or it was photoshopped maybe to hide something (but what?). Or, maybe someone is sending signals using the crappy photoshopping – those pictures are sure to end up in newspapers and get maximal media coverage. Repeating smoke was also seen in the doctored AP photos during the Beirut bombings of 2006. Who knows?
• The picture with launcher is taken a mere moment earlier. Although picture position has changed, the missiles are flying already at a slightly higher altitude in the sky.

Unless it wasn’t obvious, I’m definitely not a professional intelligence image analyst, and this analysis was merely some intellectual pastime for a lazy Saturday. Time will tell how many missiles there were and what is the real story behind the weird smoke/dust. So please don’t start World War III based on this blog post, OK?

The last thing I did just for fun, to try out the limits of the copy-move algorithm.

Or maybe there were just two missiles? :)

The following picture was done in Gimp, using the Resynthesizer plugin. First, I captured a rectangular piece of the empty sky, resized it to the same size as the picture with missiles. Then I freehand-selected an area with the missile and the exhaust plume, and then resynthesized it a few times with varying the selection to make it look nice.

The copy-move algorithm does not detect these kind of changes, as there is no “clone” function as such being used, but the resynthesizer rather sort of rebuilds the image data from scratch. But you can, nevertheless, see an empty area at the position where the missile was. Unlike in other parts of the sky, no cloned areas are detected there. So, for some pictures this could be a sign of manipulation – i.e. an area of uniform color appears “too random” for the copy-move algorithm.

And, if you want to see some funny photoshoppings, check this out.

Update

After sleeping over it, I realized there was something I obviously missed: the copy-move algorithm does not detect resized copies. The exhaust plume of the claimed-to-be photoshopped missile is smaller, therefore assuming it was cloned, it would not be detected by copymove due to resizing.

So I took the Sepah News images and did some more analysis.

The two pictures, with three missiles and four missiles, are taken from different distances. I searched for image elements which are clearly the same in both images. Then, I marked them in Gimp using the guide tool. Next, I looked at the distances of these markers using the distance-tool. The ratios of distances seemed to be approximately the same.

Using these markers and distances as a clue, it was obvious that something had to have been removed from the place of the launcher – otherwise it would be partially visible, or the smoke would have to be lower.

The image with three missiles:

The image with four missiles:

Here are the new conclusions:

• The picture taken further away was also taken later. This is because the missiles are higher. It would make sense too to whoever is taking pictures, to zoom out while the missiles are flying higher, and this would make the appearance of picture having been taken further away.
• The launcher has disappeared, but there it cannot hide under the smoke/dust. Considering that the smoke/dust of the third missile seems to be cloned from the smoke of the fourth missile, the third smoke must be an image manipulation. The reason for this would be to hide the launcher which didn’t fire.
• The third missile is also photoshopped, source being from the second missile. It is resized and thus not detected by Fridrich’s copy-move algorithm.

These conclusions match the ones presented in the media, which were probably done by high-paid intelligence image analysts working deep within Langley in a jackbaueresque hectic world with shaking camera angles and highly efficient image analysis tools. Or maybe those people just have superior eyes!

Anyway, I agree with the analysis that someone within the Iranian government photoshopped the missile pictures to hide a missile which did not launch. But why would anyone do it with such obviously bad results – were there time pressures involved to get a convincing picture out as soon as possible?

Lesson learnt: the human vision system is quite robust and well-built. Tools can help augment it, but are no match to its performance. Oh, and should I ever need a career change, analyzing images might be fun. And using the clone tool for smoke and/or dust is bad.