Disclaimer:
As a condition to the use of this document and the information contained therein, the SWGDE requests notification by e-mail before or contemporaneous to the introduction of this document, or any portion thereof, as a marked exhibit offered for or moved into evidence in any judicial, administrative, legislative or adjudicatory hearing or other proceeding (including discovery proceedings) in the United States or any Foreign country. Such notification shall include: 1) The formal name of the proceeding, including docket number or similar identifier; 2) the name and location of the body conducting the hearing or proceeding; 3) subsequent to the use of this document in a formal proceeding please notify SWGDE as to its use and outcome; 4) the name, mailing address (if available) and contact information of the party offering or moving the document into evidence. Notifications should be sent to secretary@swgde.org.
It is the reader’s responsibility to ensure they have the most current version of this document. It is recommended that previous versions be archived.
Redistribution Policy:
SWGDE grants permission for redistribution and use of all publicly posted documents created by SWGDE, provided that the following conditions are met:
- Redistribution of documents or parts of documents must retain the SWGDE cover page containing the disclaimer.
- Neither the name of SWGDE nor the names of contributors may be used to endorse or promote products derived from its documents.
- Any reference or quote from a SWGDE document must include the version number (or create date) of the document and mention if the document is in a draft status.
Requests for Modification:
SWGDE encourages stakeholder participation in the preparation of documents. Suggestions for modifications are welcome and must be forwarded to the Secretary in writing at secretary@swgde.org. The following information is required as a part of the response:
- Submitter’s name
- Affiliation (agency/organization)
- Address
- Telephone number and email address
- Document title and version number
- Change from (note document section number)
- Change to (provide suggested text where appropriate; comments not including suggested text will not be considered)
- Basis for change
Intellectual Property:
Unauthorized use of the SWGDE logo or documents without written permission from SWGDE is a violation of our intellectual property rights.
Individuals may not misstate and/or over represent duties and responsibilities of SWGDE work. This includes claiming oneself as a contributing member without actively participating in SWGDE meetings; claiming oneself as an officer of SWGDE without serving as such; claiming sole authorship of a document; use the SWGDE logo on any material and/or curriculum vitae.
Any mention of specific products within SWGDE documents is for informational purposes only; it does not imply a recommendation or endorsement by SWGDE.
1. Purpose
The purpose of this document is to describe the potential use of electric network frequency (ENF) analysis in the United States for the forensic examination of audio recordings.
2. Introduction
One of the questions that arise in forensic audio is whether a particular recording is “authentic” – original, complete, continuous, or unaltered. Tools that help answer these questions facilitate examiners and make conclusions more reliable. Part of a robust authentication methodology includes analysis of the continuity of stable tones that can be isolated within a recording. A common tone found in audio recordings is the hum generated by the mains current powering a recording device and possibly induced into portable recorders [1] (directly or indirectly – EMF, acoustically, unbalanced audio connections, etc.). An ENF signal may provide further avenues of analysis.
The power that comes out of the wall socket is the result of a highly complex system of generators, transmission lines, transformers, and sub stations. Through all of this, the voltage and frequency must remain tightly regulated as they fluctuate due to changes in supply and demand. Independent system operators (ISOs) regionally coordinate multiple generators to ensure this stability. ISOs can tune the generators within a cycle or two to respond to changes in demand. Electric reliability organizations (EROs) regionally regulate the compliance of electricity delivery. The eight North American EROs are coordinated by the North American Electric Reliability Corporation (NERC).
Due to the widespread regulation of interconnected power facilities, the frequency of power grids are remarkably consistent. In recent years, some forensic labs have been exploiting this consistency to determine the date and time a recording was made by extracting the residual mains hum from a recording and comparing it to historical reference data continuously being collected.
The first proof of concept was done in continental Europe by Grigoras [2] and he followed this up with further study [3][4][5] . Building on this concept, Cooper published a comprehensive protocol for the collection, extraction, and comparison of ENF in the United Kingdom, which has a separate interconnected grid [6]. These efforts show promise for examiners to identify the date and time of recordings, and ENF analysis has been used in some European casework. A framework for developing a consistent methodology and best practices for using ENF has been published by The European Network of Forensic Science Institutes (ENFSI) [7]. The validation guidelines and analysis protocols provided by ENFSI can be applied in the U.S.
Unlike Europe, the United States has three major independent interconnections. These interconnections are themselves connected by DC lines, but maintain independent coordination resulting in three distinct power frequency signals that must be recorded continuously. For this process to be viable in the U.S., studies need to be done to understand how this complex grid structure affects the utility of ENF as a forensic tool. Preliminary work has been done by Sanders and others demonstrating that within each interconnection, frequency correlation appears strong at certain timescales [8][7][9].
Therefore, to capitalize on ENF data for forensic purposes, methods need to be validated for the collection of reference databases, the extraction of ENF signals from forensic recordings, the comparison of extracted data against the reference databases, and the interpretation of comparison results. This document describes an agenda for the validation research necessary to accomplish this.
3. The nature of ENF
The nature of the ENF must be understood to be effectively used in forensic audio.
ENF derives from a waveform of power amplitude over time. Ideally, this waveform is a sinusoid of a nominal amplitude (110 V, 220V) and nominal frequency (60 Hz, 50 Hz). In reality, the signal varies in amplitude and frequency and has additive noise.
The primary driver of frequency change is the difference between load and generation. Observable transient events such as line operations, generator trips, load shedding, and brake operations also happen but may look different at different points in the grid. Therefore, these transient events could possibly be used as a signature to confirm the time of recording if present in the audio data.
Different grid topologies and different generation capacities result in different grid characteristics. There are three major grids in the continental U.S., four in North America, which all differ in these respects. Statistical measures of these differences may indicate which grids are likely associated with a recording. In stable operating modes, there are no variations in the ENF across an interconnection. However, transients can affect frequency across an interconnection but these events are usually less than one minute in length.
The type of power generator (wind, nuclear, coal, etc.) has no effect on ENF.
Geographic location of an ENF source would require extremely accurate time correlation of the audio recording from multiple sources within a single interconnect. Virginia Tech’s Frequency Disturbance Recorders (FDRs) have been used to estimate the location of a major disturbance on an interconnection by comparing the time of the event as it propagates across the grid [10]. The accuracy of these estimates have been on the order of 100 miles with clean (non-forensic) data from the Eastern interconnect.
4. Issues to be addressed by the forensic community
If the engineering concerns about ENF are adequately addressed, more scientific questions must be answered by the forensic audio community in order to develop valid methodologies for using ENF in examinations. First, what forensic question needs to be answered? The question being asked may drive what techniques should be employed and how accurately it can be answered.
Some examples of forensic questions:
- Was the recorder that made this recording connected to a power grid, and if so, which one?
- Is this recording a duplicate?
- Is this recording a continuous representation of acoustical events or not? If multiple recording sessions are present in the recording, were they both made within the same grid?
- On what date and time was a recording made?
- Where was a recording made?
There are four elements of ENF analysis:
- Collecting a reference database that is representative of one or more target grids.
- Identifying and extracting available ENF signals from a forensic recording.
- Comparing the extracted ENF signals against one or more databases.
- Interpreting the results.
Methodologies employed to perform these elements or to answer a forensic question should be evaluated before being used on forensic casework. Evaluations should involve blind testing using ground-truth data to determine typical behavior and operational conditions. Optimal methodologies should be determined before being adopted consistently.
4.1 Collecting an ENF reference database
There are multiple issues to address to collect an ENF reference database. Steps must be taken to ensure that a reference database is appropriately characteristic of the grid it represents, whether that is a time-frequency signal or a statistical description.
4.1.1 Is there a preferred signal source?
The ENF of a grid can be measured at a transmission point or a distribution point. These points operate at different voltages requiring different equipment to collect the data. Wall sockets on the distribution side are ubiquitous, but the power signal there is likely to be most adversely affected by local sources of interference (arc welding down the street, circuit breaker tripping, etc.). ENF measured at transmission points may be impervious to such local effects [11], but it may require substantial effort to access those systems. Averaging multiple sources, such as multiple wall sockets throughout the grid or aggregate PMU data, might reduce local effects. An evaluation of these possible collection points should be undertaken to determine the preference of each for forensic use.
Even if a standard reference is determined, archived data will still be necessary to identify older recordings. Archived data may need to be reformatted into the standard format. See Appendix A for potential sources of archived data.
4.1.2 How much redundancy is necessary?
If data is collected at a wall socket, tripping a circuit breaker will result in data loss. A line failure can result in data loss at a transmission point. It seems clear that a robust reference collection will use multiple sources to protect against such effects.
4.1.3 Is there a preferred method for measuring time/frequency?
The published methods to generate a time vs. ENF frequency data set are varied, but to date no direct comparison of these methods on the same grid has been performed. Some methods measure frequency directly using a frequency counter on the ENF fundamental or harmonics, and others compute frequency data from the electrical waveform. The length and offset of sliding analysis windows can be varied as well each potentially producing different levels of accuracy. These multiple methods need to be compared, testing all of the variable parameters to find the optimal time resolution and frequency resolution that produces the most reliable comparisons. Too low a resolution will reduce the comparable data. Too high a resolution may introduce local noise that will reduce the reliability of the comparison.
A reference data set must use a means of time synchronization. Time synchronization can be achieved by using web-based time servers or GPS satellites. Errors in any time synchronization method must be measured and factored into any analysis using that data set.
4.1.4 Certifying the database.
A credible reference database must maintain its integrity. If each lab generates its own database, how are we to know if the database is valid and therefore any comparison results? A validation protocol may be necessary. To avoid performing cumbersome validation requirements, the community may benefit from defining a central authority, such as the National Institute of Standards and Technology (NIST) or the Department of Energy, to maintain such a database for the use of the community.
Access to the raw ENF data creates the potential for deliberate falsification by overlaying a reference signal onto a recording. Should access to this data be restricted? Is all of this security moot since anyone can record from their wall socket?
4.2 Extracting ENF signals from forensic audio.
Many of the same concerns with collecting the reference database apply to extracting ENF signals from within forensic audio recordings. The presence of many other signals in forensic recordings, usually with substantially greater amplitude, complicates the matter further, and it is not even guaranteed that ENF is present or detectable.
Existing methods include tracking peak values within sliding window FFTs, using bandpass filtering to isolate ENF fundamentals and harmonics, and marking zero crossings. Whatever methods are used, their limitations must be well understood and they must be compatible with the reference database. Each of these methods may be subject to different confounding factors and they must be determined and compared before their evidentiary value can be determined.
If it is even possible due to wow and flutter, an examiner must be able to distinguish between ENF signals present in analog evidence captured by an analysis system and ENF signals present in the analysis system itself. This may require capturing a control signal of your system simultaneously with the capture of any other analog source signal. Similarly, duplicated recordings may contain two distinct ENF signals, one from the original recording and one from the duplication system. Methods must be developed to separate these two signals to evaluate them separately.
4.3 Comparison of ENF signals.
Once two ENF signals have been extracted, presumably one from a known database and one from an unknown forensic recording, they must be compared in a way that produces meaningful results. Assuming we have chosen methodologies that produce data sets that are directly comparable by matching the time and frequency resolutions, we must define an evaluation protocol. Robust testing must determine the optimal system parameters for each methodology. Systematic testing of variables such as sample length, analysis window length, overlap distance, SNR, relative harmonic strengths, original sampling rate, etc. must be done to map the error contours of the variable space to discover a method’s strengths and limitations.
Cyclical pattern within the ENF signal must be taken into account as they could bias comparison results. A noontime recording may be biased to match another noontime recording, etc. Such patterns may include the following:
- Load following (minutes)
- Scheduling (hourly)
- Load behavior, time correction (daily)
- Weekday vs. weekend (weekly)
- Special days (holidays, major sporting events, )
- Seasonal trends (DST, lighting, climate control)
Ideally, a method’s performance should be quantified using measures possibly including a decision error threshold (DET) or receiver operator characteristic (ROC) curve for various levels of relevant parameters.
Once a proposed method is understood, it can be compared against other methods by evaluating the performance contours. This should show when one method outperforms another and lead to a robust “best practices”. Ultimately, a set of peak “scores” should indicate the grid and timeframe with highest likelihood of being that of the unknown recording.
4.4 Interpreting the comparison results.
Once a “score” or other measure of similarity between a target and reference ENF signal pair has been calculated, the examiner must interpret that score. The interpretation framework should include the open set possibility that the ENF signal is not in the database. The ENF signal may have been from an unknown grid or recorded outside the time span of the database. The interpretation framework should be based on the performance contours determined in the previous section. There may be factors that increase or decrease the value of a statistical matching score. The mere presence of an ENF signal in a recording not expected to have one may be informative. To be considered a credible forensic technique, the interpretation framework must be written down and standardized.
5. Conclusions
To develop ENF as a viable forensic methodology, further research must be done. This research should investigate the impact of different variables on ENF signal extraction and comparison. Different methodologies of extraction and comparison must be explored and compared to determine their limitations under different conditions.
References
[1] Brixen, E., “ENF; Quantification of the Magnetic Field”, Proceedings of the Audio Engineering Society 33rd International Conference, Denver, CO, USA (2008).
[2] Grigoras, C., Forensic analysis of digital audio recordings – the Electric Network Frequency Criterion’, Forensic Science International, 136 (Supp.
[1]), 368–9 (2003).
[3] Grigoras, C., “Digital Audio Recording Analysis: The Electric Network Frequency (ENF) Criterion”, The International Journal of Speech Language and the Law, vol. 12, no. 1, pp. 63-76 (2005).
[4] Grigoras, C., “Applications of ENF Criterion in Forensic Audio, Video, Computer and Telecommunication Analysis”, Forensic Science international, vol. 167, pp. 136-143 (2007).
[5] Grigoras, C., “Applications of ENF Analysis in Forensic Authentication of Digital Audio and Video Recordings,” Journal of the Audio Engineering Society, Vol. 57, No. 9 (2009).
[6] Cooper, A., “The Electric Network Frequency (ENF) As An Aid To Authenticating Forensic Digital Audio Recordings – An Automated Approach”, Proceedings of AES 33rd International Conference, Denver, CO, USA (2008).
[7] “Best Practice Guidelines for ENF Analysis In Forensic Authentication Of Digital Evidence,” ENFSI Forensic Speech And Audio Analysis Working Group, FSAAWG- BPM-ENF-001 (2009).
[8] Sanders, R., “Digital Audio Authenticity Using The Electric Network Frequency”, Proceedings of AES 33rd International Conference, Denver, CO, USA (2008).
[9] Kundur, P., “Power System Stability and Control,” in The EPRI Power System Engineering Series. New York: McGraw-Hill (1994).
[10] Nystrom, L., “Virginia Tech engineers have developed technology to monitor and secure the electric grid,” Research Magazine, Virginia Tech (2006).
[11] “Frequency Control Concerns in the North American Electric Power System”, Oak Ridge National Laboratory, ORNL/TM-2003/41 (2002).
[12] Huijbrechtse, M., Geradts, Z., “Determination of Time of Recording With Electric Network Frequency (ENF)”, Proceedings of the American Academy of Forensic Sciences (2009).
[13] Smith, J., “Building a Database of Electric Network Frequency Variations for Use in Digital Media Authenticity”, Proceedings of the American Academy of Forensic Sciences (2010).
[14] Hinton, W., Marr, K., Snyder, D., “An Alternative Method for ENF Analysis”, Proceedings of the American Academy of Forensic Sciences (2010).
[15] Cooper, A., “An Automated Approach to the Electric Network Frequency (ENF) Criterion – Theory and practice”, International Journal of Speech Language and the Law, Vol. 16, No. 2 (2009).
[16] Kajstura, M., Trawinska, A., Hebenstreit, J., “Application of the Electrical Network Frequency (ENF) Criterion: A case of a digital recording,” Forensic Science International, Vol. 155, No. 2 (2005).
Appendix A: Potential sources of historical ENF data.
Western Interconnect
- The Pacific Northwest National Laboratory (PNNL) records Phasor Measurement Unit (PMU) data from the Bonneville Power Administration (BPA), and wall socket data. The PNNL wall socket data exists for approximately 90% of May 2002 to the present with some gaps. PNNL’s PMU data spans from 2004 to the present with some gaps in collection.
- Phasor Data Concentrator (PDC) data may be available from BPA, the California Independent System Operator (CalISO), the Los Angeles Department of Water & Power (LADWP).
- Virginia Tech (VT) has FDR data from 2004 to the present.
- The University of Colorado Denver has been collecting discontinuous wall socket data for the Western Interconnect from mid-2008 to present.
Texas Interconnect
- Virginia Tech has FDR data from 2005 to the present with some gaps.
- Electric Reliability Council of Texas (ERCOT).
Eastern Interconnect
- Virginia Tech has FDR data from 2004 to the present.
- Tennessee Valley Authority (TVA) has PDC data.
Other potential sources of ENF data
- Power generators
- Power transmitters
- ISOs
- EROs (NERC, others)
- Other universities
- Other national labs
- CERTS (Oak Ridge National Lab)
- SmartGrid (PNNL)
- GridStat (WSU)
- North American SynchroPhasor Initiative (NASPI)
Concerns with archived ENF data
- What format is the archived data?
- How long is data archived?
- Is it publicly available?
- What are conditions of use?
- Liability and other legal issues.
- Are there other concerns that we should be aware of?
History
| Revision | Issue Date | Section | History |
|---|---|---|---|
|
1.0 |
01/15/2009 |
All |
Approved by SWGDE for release. |
|
1.1 |
05/20/2009 |
All |
Revisions from 2009-05 Committee meeting. Approved by SWGDE for release. |
|
1.2 |
05/20/2010 |
All |
Revisions from 2010-05 Committee meeting. Approved by SWGDE for release. |
|
1.2 |
01/16/2014 |
All |
Approved by SWGDE for release without changes. |
|
1.2 |
02/06/2014 |
All |
Formatted and published as an Approved Document. |
|
1.2 |
— |
— |
Updated document per current SWGDE Policy with: new disclaimer, removed Definitions section, and
corrected SWGDE hyperlinks. No changes to content and no version/publication date change. (9/27/2014) |
Version: 1.2 (February 6, 2014)