The fragility of digital evidence in Polish courts: why we built EVIDION.pl (formerly known under the working name NEXguard)

Illustration generated by AI (GPT Image 2 model on the FOTOhub.app platform). Disclosed in line with Article 50 of the AI Act.

Poland's justice system still operates on an assumption that is technically false, yet widely accepted inside courtrooms: that a printed screenshot, notarized as a true copy of what appeared on a screen, counts as solid, reliable, and practically unassailable evidence. That assumption is shared by judges, litigators, and the parties to disputes alike, and its persistence has nothing to do with bad faith or incompetence. It stems from a fundamental generational and technological gap between an evidentiary framework designed for the age of paper documents and a digital reality in which every file, every message, and every database record is, by definition, a string of bits open to editing. The technical reality is blunt: text messages, chat app conversations, Office documents, spreadsheets, emails, and soon video and audio recordings, can all be altered in ways that are practically undetectable once printed, and often undetectable even under closer inspection of the source files, provided the person doing the tampering exercised basic care and a working knowledge of file-format internals.

The author of the blog informatykzakladowy.pl, a practicing security specialist, didn't stop at a theoretical description of the problem. He ran his own hands-on experiment: on a rooted phone, he edited the content of a text message, then had the manipulated result notarized as a faithful copy of what appeared on the device's screen. The outcome is damning for the current evidentiary model: a notarized, forged text message receives exactly the same procedural status as an authentic one, because the notary is only certifying that they observed a given piece of content on a screen at a given moment, not that the content matches the real, unaltered record stored in the phone's database. That distinction, between certifying an observation and certifying the authenticity of the underlying source data, is the crux of the entire problem, and it is the foundation on which EVIDION.pl is built.

Anatomy of the problem: why every category of digital evidence fails for a different technical reason

To grasp the true scale of the threat, each category of digital evidence needs to be examined on its own terms, because each one is vulnerable for a distinct technical reason, not a single, universal weakness.

Text messages are exploitable because, architecturally, there is no independent third-party reference point that a court or expert witness can turn to for verification. Telecom carriers do not retain message content, only network-level transmission metadata, which means the only repositories of the actual content are the local databases sitting on the sender's and recipient's phones. Since both of those databases are physically in the hands of the parties to the dispute, rather than held by a neutral third party, the entire question of verification collapses into whether a given party had the motive and the technical know-how to alter their own device before handing it over for inspection. Gaining administrative privileges on a phone (rooting on Android, jailbreaking on iOS) grants full access to the SMS app's database files, which in most cases are ordinary SQLite files, freely editable with database tools available at no cost online.

Messaging apps such as WhatsApp, Messenger, Telegram, or Signal are, in theory, better protected, since most of them rely on end-to-end encryption plus encrypted local storage. In practice, that protection secures the transmission between devices, not the integrity of data already sitting on the end device. Once administrative access to a phone is obtained, it becomes possible to extract the decryption keys for the local chat database, edit its contents outside the app, and restore the modified database onto the device so that the app displays it identically to the original, with no visible trace of tampering from the user interface's perspective. This exposes a common and dangerous misconception: end-to-end encryption is routinely assumed to guarantee the unassailability of a conversation's content, when in fact it only protects against interception in transit, not against manipulation of data already stored locally.

Microsoft Office documents, in DOCX, XLSX, and PPTX format, are arguably the easiest target of all, because their internal structure is publicly documented and has been standardized for years. Under the hood, these formats are simply ZIP archives containing a set of XML files describing content, formatting, and metadata. Anyone can unzip such a file with an ordinary archive manager, open the core.xml file holding metadata such as creation date, last-modified date, and author name, edit those values as plain text, repack the archive under the original .docx or .xlsx extension, and end up with a document that looks, to any operating system, any office suite, and any expert witness lacking specialized knowledge of the Office Open XML format's internals, exactly like a document genuinely created on the stated date. Critically, this manipulation doesn't even require Microsoft Word itself; the entire process can be carried out with a free text editor and an archive utility that ship by default with virtually every operating system.

Emails present less of a challenge to a forger than most non-technical people would assume, because the core transport protocols of email, chiefly SMTP, date back to the 1970s and 80s, an era when the internet was a closed network built on mutual trust among academic institutions, not a public infrastructure designed to authenticate senders or guarantee content integrity in transit. If two parties to a dispute submit conflicting versions of the same email exchange, there is no simple, widely available mechanism for definitively determining which version is authentic, because the message identifier generated by the sender's mail client contains no checksum of the content and no cryptographic signature binding that specific content to the specific moment it was sent. Newer sender-authentication mechanisms, such as SPF, DKIM, and DMARC, improve the picture, but only partially: they bind a message to a sending domain, not to a specific individual or to specific, unmodified content later read by a recipient, and beyond that, few litigators or judges know how to read and interpret the technical headers required to actually make use of these mechanisms in practice.

Why the legal system cannot close this gap on its own

The scale of the technical problem would be less alarming if the legal system had adequate compensating mechanisms in place. It does not, for several compounding structural reasons.

The first is inadequate preparation among the judiciary. Judges presiding over civil cases in Poland receive, over the course of their legal education and judicial training, a negligible amount of instruction on the technical side of electronic evidence, and coursework on cybercrime and digital forensics is frequently optional or simply absent from the curriculum altogether. This is not a personal indictment of individual judges; it is a description of a systemic mismatch between legal education and the technological reality underpinning today's commerce and private communication.

The second reason is procedural. Under Polish civil procedure, the burden of challenging the authenticity of a piece of evidence falls on the opposing party, not on the court acting on its own initiative. As a rule, a court has no obligation to independently examine the authenticity of a printed text message or a chat screenshot unless one of the parties raises an objection. Given how little awareness exists among litigators and litigants about the technical feasibility of digital tampering, this means, in practice, that an enormous number of civil cases are decided on material whose authenticity nobody ever thought to question, not out of bad faith on anyone's part, but simply because nobody realized such scrutiny was even necessary.

The third reason concerns the court-appointed expert witness system, which in theory should act as a safety net whenever a party does raise authenticity concerns. In practice, that safety net is broken for at least three reasons. First, appointing a forensic IT expert can extend proceedings by as much as a year, which discourages both parties and courts from using this route, particularly in disputes of relatively lower value. Second, a party has virtually no say in which specific expert from the regional court's roster gets the assignment, and that roster doesn't always include people whose narrow technical specialization matches the specific evidence at hand, say, tampering with a messaging app's SQLite database versus manipulation of an Office document's XML structure. Third, court-expert compensation rates in Poland are glaringly low by IT industry standards, capping out at roughly PLN 100 per hour even for experts holding professorial titles, which naturally discourages the most qualified security specialists from taking on this role at all, given that the commercial market for security auditing and digital forensics pays multiples of that figure. This is not a critique of expert witnesses as a profession; it is a description of an adverse-selection mechanism, in which the most technically demanding tasks are systematically routed to a segment of the services market that offers little financial appeal to the most highly qualified practitioners.

A fourth, less-discussed reason relates to how courts approach the sheer form of digital evidence submitted to them. It's not unusual for digital evidence, such as system logs consisting of a few megabytes of structured data, to be required in printed form, even though printing that data out inherently makes it harder to analyze, and courts sometimes refuse to accept evidence in electronic form even when a party has the full digital record ready and available for expert review. This collision between a paper-based logic and a digital-native logic plays out daily in Polish courtrooms, and the real cost is borne by actual people and actual businesses whose cases are decided on evidence of a lower quality than the available technology would otherwise allow.

The front line that hasn't fully opened yet: synthetic video and audio

Everything described above concerns a problem that is already real and measurable in thousands of court cases every year. A considerably more serious threat is only now taking shape, and it is developing at a pace that no national legal system in the world is currently able to absorb in full. Video and audio evidence has historically been considered relatively more resistant to forgery than text, since manipulating it required specialized equipment, editing skill, and time. The rise of generative artificial intelligence, particularly video-synthesis and voice-cloning models, is upending that calculus entirely. Today, it's still occasionally possible to spot visual artifacts betraying a video's synthetic origin, imperfections in lip movement, edge flicker, or inconsistent lighting. Within the next two to three years, that kind of detection is set to become practically impossible for the average observer, and even for a court lacking access to specialized analytical tools.

The consequences of this shift are twofold, and they reinforce each other in the worst possible way. On one hand, every genuine piece of video evidence showing a perpetrator's actions will become vulnerable to the simple argument that the material could just as easily have been synthetically generated, opening the door to systematic doubt-seeding against even authentic evidence by a party with an interest in dragging out proceedings or undermining a court's confidence. On the other hand, every fabricated video or audio clip generated synthetically will be just as hard to unmask as an edited screenshot from a chat app is today, except the scale of potential harm, in divorce proceedings, employment disputes, or criminal cases, is incomparably greater than that of a forged text message. A legal system that already struggles to detect manipulation of an Office document's XML structure has, statistically speaking, no chance of coping on its own with the coming wave of synthetic material, unless it is equipped with technical infrastructure capable of distinguishing verified from unverified material at the moment of creation, rather than after the fact, through a costly and time-consuming expert opinion.

Why we're building EVIDION.pl, formerly developed under the working name NEXguard

All of this, the fragility of every category of digital evidence, the structural dysfunction of the expert-witness system, the judiciary's lack of technical preparation, and the coming escalation driven by AI synthesis, converged into a single conviction: this is not a problem that awareness campaigns, ad hoc training for judicial trainees, or industry blog posts can solve, valuable as those efforts are in their own right. This is a structural problem that demands an infrastructural solution, and that conviction is precisely what gave rise to the project now known as EVIDION.pl, previously developed under the working name NEXguard.

The shift from NEXguard to EVIDION.pl wasn't cosmetic. It reflected the project's own evolution: from a concept narrowly focused on securing and protecting a single device or communication channel, toward a broader vision of evidentiary infrastructure spanning the entire lifecycle of a piece of digital evidence, from the moment it's created or captured, through storage and version control, to the moment it's presented before a court or administrative authority. The name EVIDION deliberately echoes the word "evidence" and signals an ambition to build not another protective app, but a full-fledged infrastructure layer for evidentiary material, conceptually similar to the governance-evidence systems now operating in more heavily regulated sectors of the economy, systems that tie contracts, policies, decisions, and incidents into a single, cryptographically secured, fully reconstructible evidentiary chain resistant to after-the-fact reconstruction under dispute pressure.

The architectural core of EVIDION.pl comes down to a single, fundamental shift in reference point: moving the moment of evidence preservation from the end of the evidentiary chain, where today a notarized screenshot taken weeks or months after the fact still dominates, to the very beginning of that chain, the moment a given piece of digital content is actually created, captured, or received by a party. Rather than assuming a party presenting evidence acts in good faith, and that the opposing side won't be able to effectively challenge its authenticity anyway given the procedural and technical gaps described above, the system generates an independent, cryptographically secured record of the material's state at the moment it's registered. That record covers not just the content itself but also the technical metadata needed for later, objective integrity verification, including a tamper-resistant timestamp, a content checksum, and a cryptographic chain of custody binding individual pieces of evidentiary material into a coherent structure immune to selective editing, conceptually similar to the evidence-ledger mechanisms already deployed in regulated financial and insurance sectors in the West.

This approach, while novel to the Polish legal-tech market, isn't invented from scratch. For several years now, financial, insurance, and technology regulation in the West has been building infrastructure of exactly this kind, in response to requirements under frameworks such as DORA, NIS2, and the AI Act, built on structured, fully reconstructible compliance evidence linking contracts, policies, decisions, and incidents into a single, immutable evidence graph, using cryptographic hashing to make the material tamper-evident and fully, chronologically reconstructible. The difference is that this kind of infrastructure has, until now, been built almost exclusively around financial-sector regulatory requirements and corporate compliance, not around the everyday reality of Polish civil and criminal proceedings, where millions of cases a year are decided on printouts that cannot be reliably verified by any technical means. EVIDION.pl is being built precisely in that gap, one nobody in Poland has yet addressed with sufficient determination and scale: the space between everyday courtroom practice built on paper printouts and notarized copies, and the modern evidentiary infrastructure that the world's most heavily regulated industries already take for granted.

Three pillars underpinning the entire concept

The first pillar is the conviction that the question of an evidence item's authenticity should become moot, rather than something resolved through a costly, months-long expert opinion. If a piece of material's integrity is mathematically verifiable from the moment of its creation, thanks to cryptographic mechanisms recording the file's state, a tamper-resistant timestamp, and a chain of custody, the question "is this real" stops requiring a subjective judgment call from a court lacking the relevant technical competence, and becomes a question that is objectively, repeatably, and unambiguously verifiable. This is the fundamental difference from today's practice of notarizing screenshots, which only certifies the fact of having observed a screen at a given moment, not the actual integrity of the underlying source content.

The second pillar is the conviction that the problem of digital-evidence tampering isn't going away, it's accelerating in direct proportion to the advance of generative AI, and a legal system that already struggles to detect manipulated Office XML files stands no realistic chance of coping with the coming wave of synthetic material on its own, absent technical infrastructure deployed well ahead of the curve, rather than in reaction to an already-materialized crisis of trust in video and audio evidence.

The third pillar is the conviction that relieving the court-expert system of tasks that are, technically speaking, trivial, such as confirming a document's authenticity when a properly engineered system could verify it in a matter of seconds, will free up the limited time and attention of expert witnesses for cases that genuinely require deep, specialized analysis, rather than resolving repetitive, technically simple questions about whether a printed text message or an Office document is genuine.

A conclusion that is, in truth, a starting point

The takeaways from the problem laid out by informatykzakladowy.pl are unambiguous, and for us, they amount to a mandate for action, not merely a topic for an industry blog post. Poland's judicial system currently runs on an evidentiary architecture designed for a world in which manipulating digital content required specialized equipment and expertise available only to a narrow group of experts. The world we actually live in now offers those same manipulation capabilities to anyone with a smartphone, a computer, and the motivation to win a case, regardless of whether they're actually in the right. That gap, between how easy it has become to forge evidence and how capable the legal system is of verifying it, will keep widening, not narrowing, as generative artificial intelligence extends its reach across an ever-broader range of media formats.

Building EVIDION.pl, previously developed under the working name NEXguard, is our answer to that specific, escalating risk. Not another commentary piece on how fragile digital evidence has become, but a genuine attempt to move the point of evidentiary preservation to the moment when tampering is still technically impossible, rather than merely difficult to prove after the fact, months after an event, through a costly proceeding involving an expert witness who is, themselves, operating inside a system that is underpaid and structurally overloaded.