Evidence Capture Guide

Evidence Capture Guide

This guide goes beyond basic recording rights to provide a comprehensive toolkit for capturing, preserving, and protecting evidence during immigration enforcement encounters. Proper evidence documentation can support legal defenses, accountability efforts, and policy advocacy.

Know Your Rights First

You have a First Amendment right to record law enforcement in public spaces. Seven federal circuit courts have affirmed this right. For full details on your recording rights, see Recording Rights.

---

What to Capture: A Priority Checklist

When documenting an encounter, capture information in this order of priority:

1. Vehicle Identification (Highest Priority)

Vehicles are often the most identifiable element, especially when agents wear masks or hide badges.

Element	What to Capture	Why It Matters
License Plate	Full plate number, state, any “EXEMPT” markings	Primary identification; can be cross-referenced with databases
VIN	17-character number visible on dashboard	Cannot be changed like plates; permanently identifies the vehicle
Make/Model/Color	Year, manufacturer, model, exact color	Helps pattern analysis across sightings
Distinguishing Features	Damage, stickers, aftermarket parts, missing roof racks	Unique identifiers even if plates change
Number of Vehicles	Total count, formation, spacing	Indicates operation size

2. Agent Identification

Element	What to Capture	Why It Matters
Badge Numbers	Read aloud while filming if you can’t get clear video	Primary individual accountability
Agency Patches	ICE, CBP, ERO, HSI, local police with 287(g)	Determines jurisdiction and rules that apply
Physical Descriptions	Height, build, visible tattoos, voice characteristics	Identification when badges hidden
Gear/Uniforms	Tactical vests, masks, plain clothes, weapons visible	Documents what level of force was deployed
Vehicle Assignment	Which agent got into which vehicle	Links individuals to specific vehicles

3. Actions and Conduct

Element	What to Capture	Why It Matters
Use of Force	Any physical contact, weapons drawn, restraints	Documents potential excessive force
Statements Made	What agents say to detained person, witnesses	Can reveal rights violations, lies, or threats
Warrants	Whether shown, what type, who signed	Constitutional rights depend on warrant type
Entry Method	How they entered a location, consent given?	Fourth Amendment issues
Duration	How long the encounter lasted	Prolonged detention may be unconstitutional

4. Context and Environment

Element	What to Capture	Why It Matters
Location	Exact address, cross streets, landmarks	Establishes jurisdiction, proves location
Date and Time	State verbally at start of recording	Creates verifiable timeline
Witnesses	Names and contact info (with consent)	Corroborating testimony
Weather/Lighting	Conditions that affect visibility	Explains video quality limitations

Reference: WITNESS Media Lab: Eyes on Courts - Documenting ICE arrests

---

Vehicle Identification Deep Dive

ICE increasingly uses unmarked vehicles, switches license plates, and even uses vehicles with foreign plates to avoid identification. Here’s how to document vehicles effectively.

License Plates

ICE Plate-Switching Tactics

Activists have documented ICE agents changing license plates daily. In one video, an agent told a bystander filming his plate that he “needn’t bother because they change the plates out every day.” Don’t rely on plates alone.

What to look for:

Plate Type	Appearance	Meaning
EXEMPT plates	May say “EXEMPT” or have unusual format	Government vehicle, often law enforcement
Plain plates	No county name, no decorative design	Often government or fleet vehicles
State-specific formats	Some states have patterns (NC: “SHP-xxxx”)	May indicate specific agency
Foreign plates	Mexican state plates spotted on ICE vehicles	Documented tactic to avoid identification
Missing plates	No plate or plate covered	Federal law allows this if it interferes with “critical duties”

Recording plates effectively:

• Get the full plate, including state/jurisdiction
• Read it aloud while filming as backup
• Note any unusual characteristics (exempt, plain, damaged)
• Photograph from multiple angles if safe

Reference: NPR: Are ICE agents covering their license plates as well as their faces?

VIN (Vehicle Identification Number)

The VIN is a 17-character identifier that is permanently assigned to a vehicle and cannot be easily changed like license plates.

Where to find the VIN:

Location	How to Access
Dashboard	Visible through windshield, driver’s side, where hood meets glass
Driver’s door jamb	Sticker on the door frame when door is open
Engine block	Stamped into metal (harder to access)

VIN structure:

• Characters 1-3: Manufacturer and country
• Characters 4-8: Vehicle attributes (model, body, engine)
• Character 9: Check digit (validates the VIN)
• Character 10: Model year
• Character 11: Assembly plant
• Characters 12-17: Unique serial number

Decoding VINs:

• NHTSA VIN Decoder — Free government tool
• CARFAX VIN Lookup — Vehicle history

Reference: Geotab: How to Find a Vehicle Identification Number

Physical Vehicle Characteristics

Even without plates, vehicles can often be identified by their features.

Unmarked law enforcement vehicle indicators:

Feature	What to Look For
Wheels	Black steel wheels, chunky tires (civilian versions have alloys)
Chrome	Lack of chrome trim; matte black replacements
Roof	Missing roof racks (removed on police SUVs)
Antennas	Extra antennas, small black disk antennas
Spotlights	Spotlight near driver’s mirror
Interior	Laptop/MDT mounts, radio equipment, push bumpers
Lights	LED strips near license plate, hidden lights in grille
Exhaust	Dual exhaust (performance package)
Height	Lower ride height (2WD police package vs 4WD civilian)

Reference: Daily Dot: How To Spot Undercover Cop Cars

Documenting Multiple Vehicles

When multiple vehicles are involved:

• Count total vehicles
• Note formation (convoy, spread out, blocking)
• Identify which appears to be “command” vehicle
• Track which agents exit which vehicles
• Note radio antenna patterns (command often has more)

---

Digital Identification Methods

Modern devices broadcast identifying information that can help track patterns even when visual identification fails.

AirDrop Discovery (Apple Devices)

When AirDrop is enabled on Apple devices (iPhones, iPads, Macs), they broadcast a discoverable name via Bluetooth Low Energy.

How it works:

1. Your iPhone scans for nearby AirDrop-enabled devices
2. Devices appear with their assigned names
3. These names often reveal personal information (“John’s iPhone”)
4. Government devices may show agency patterns (“DHS-iPhone-1234”)

To check for nearby AirDrop devices:

1. Open any file (photo, note)
2. Tap Share
3. Look at the AirDrop section
4. Note device names that appear

Limitations:

• Only works if target has AirDrop enabled
• Range is approximately 30 feet
• Names can be changed easily
• Privacy-conscious users disable AirDrop

Security note: Be aware that AirDrop has known security vulnerabilities that can reveal phone numbers and email addresses. Keep your own AirDrop set to “Contacts Only” or off.

Reference: Apple Support: AirDrop Security

Bluetooth Device Discovery

Bluetooth-enabled devices (phones, tablets, earpieces, radios) broadcast discoverable names when pairing mode is enabled or Bluetooth is set to visible.

To scan for Bluetooth devices:

• iPhone: Settings > Bluetooth (shows nearby devices)
• Android: Settings > Connected devices > Bluetooth (scan for new devices)

What you might see:

• Device names (“Samsung Galaxy S23”, “Motorola APX8000”)
• Paired device histories
• Government radio equipment may have identifiable naming patterns

Bluetooth trackers: If you suspect you’re being tracked, check for unknown Bluetooth trackers:

• iPhone: Settings > Privacy > Tracking
• Android: Use apps like “AirGuard” to detect AirTags/Tiles

Reference: EFF: How to Detect Bluetooth Trackers

WiFi Probe Requests

Phones constantly broadcast “probe requests” looking for known WiFi networks. These can reveal:

• Networks the device has connected to before
• Potentially identifying network names (“FBI-Field-Office-WiFi”)
• Device MAC addresses

This requires specialized equipment and is primarily useful for advanced researchers, but be aware that your phone also broadcasts this information.

Reference: Maltego: Integrating Wireless Data into Your OSINT Investigations

Location-Based Apps

Ethical Considerations

The following information is provided for awareness. Using dating or social apps to identify law enforcement may violate terms of service and could have legal implications. Use this knowledge defensively, not offensively.

Location-based apps (Tinder, Grindr, Bumble, etc.) show users within a certain radius. In theory:

• Agents with personal phones may appear on these apps
• Profile photos or usernames could be identifying
• Patterns of app usage near staging areas

This is NOT recommended as a primary identification method due to privacy concerns, unreliability, and ethical issues.

---

Recording Techniques

Video Best Practices

Before recording:

• Clear storage space
• Enable cloud backup (Signal, ProofMode, or secure service)
• Know your quick-start method
• Disable lock screen notifications

During recording:

Do	Don’t
Film horizontally (landscape)	Film vertically (limits usable frame)
State date, time, location verbally	Assume metadata will capture it
Keep steady (brace against object if possible)	Zoom excessively (causes shake, loses context)
Get wide establishing shots first	Only capture close-ups
Record continuously	Stop and start repeatedly
Narrate quietly what you observe	Shout or confront agents
Capture badge numbers, plates, faces	Focus only on the detained person
Stay 15-20 feet back minimum	Get so close you interfere

Focus priority:

Focus the camera on the officer or agent, NOT the person being detained. Footage of the detained person can be used against them in court.

Reference: WITNESS: Eyes on Courts - Documenting ICE arrests

Audio Capture

Audio can be as important as video:

• Statements made by agents
• Commands given
• Rights violations (“You don’t have rights here”)
• Threats or coercion

To improve audio:

• Stay as close as safely possible
• Avoid areas with loud background noise
• If reading plates/badges aloud, speak clearly
• Consider a lavalier mic if you document regularly

Photography

Photos complement video by providing:

• High-resolution captures of plates, badges, VINs
• Clear facial images when video is shaky
• Documentation of evidence that might be removed

Photo technique:

• Capture overall scene first (context)
• Mid-range shots (relationship of elements)
• Close-ups of specific details (plates, badges, documents)
• Multiple angles when possible

---

Preserving Evidence

Your recording is only valuable if it’s preserved properly and can be authenticated.

Metadata: Your Evidence’s Digital Fingerprint

Photos and videos contain EXIF metadata including:

• Date and time of capture
• GPS coordinates
• Device make/model
• Camera settings

This metadata:

• Proves when and where evidence was captured
• Can authenticate your evidence in court
• May be stripped by some apps (social media, some messengers)

Reference: CaseGuard: Digital Evidence, EXIF Data, and Law Enforcement Agencies

What Preserves Metadata

Method	Metadata Preserved?	Notes
USB transfer	Yes	Best for forensic integrity
Email attachment	Yes	Original file attached
Signal (document mode)	Yes	Use “Document” not “Photo”
Proton Drive	Yes	Encrypted + metadata
Direct file copy	Yes	Original file unchanged

What Destroys Metadata

Method	Metadata Preserved?	Notes
Social media upload	No	Facebook, Instagram, Twitter strip EXIF
WhatsApp photo mode	No	Compresses and strips
Screenshots	No	Creates new file with new metadata
Editing then saving	Varies	Depends on software

Reference: Metadata Perspective: Camera Original Photos vs. Screenshots in Court

The 3-2-1 Backup Rule

For critical evidence:

• 3 copies of your data
• 2 different storage types (phone + cloud, or phone + external drive)
• 1 copy offsite (cloud or trusted person)

Secure Storage Options

Service	Features	Best For
Signal (send to self)	E2E encrypted, preserves metadata as document	Immediate secure backup
ProofMode	Adds verification metadata, designed for evidence	Serious documentation
Proton Drive	E2E encrypted, Swiss privacy laws	Secure cloud storage
Ente Photos	E2E encrypted, open source	Photo backup with privacy
NordLocker	AES-256 encryption, zero-knowledge	Secure file vault
iCloud (Advanced Data Protection)	E2E encryption when enabled	Apple users who enable ADP

Reference: Guardify: How to Secure Safer Faster Access to Evidence with Cloud Storage

Immediate Post-Recording Steps

1. Lock your phone immediately after recording
2. Do NOT edit the original file
3. Backup immediately to secure cloud
4. Note the filename and timestamp
5. Write down context while fresh (who, what, where, when)
6. Get witness info with consent
7. Secure your device (see Mobile Hardening)

---

Evidence Apps and Tools

Recording Apps

App	Features	Platform
ACLU Mobile Justice	Auto-upload, state-specific versions, alerts ACLU	iOS, Android
ProofMode	Adds verification metadata, designed for human rights evidence	Android
Native Camera	Reliable, familiar, fast to access	Both

Metadata Tools

Tool	Purpose	Link
ExifTool	View/edit metadata (advanced)	exiftool.org
Pixel Peeper	Online EXIF viewer	pixelpeeper.com
Forensically	Image analysis	29a.ch/photo-forensics

VIN Decoders

Tool	Purpose	Link
NHTSA VIN Decoder	Official US government decoder	vpic.nhtsa.dot.gov
CARFAX	Vehicle history	carfax.com
VINDecoderz	Free comprehensive decoder	vindecoderz.com

---

Protecting Yourself While Documenting

Physical Safety

• Maintain distance — 15-20 feet minimum
• Have an exit route — Know how to leave quickly
• Don’t interfere — Recording from a distance, not engaging
• Travel with others — Safer and provides corroboration
• Know when to stop — If directly threatened, your safety comes first

Digital Safety

• Use passcode, NOT biometrics — Passcodes have stronger Fifth Amendment protection
• Enable quick-lock — Power button 5x on most phones
• Disable 2G — Prevents Stingray surveillance
• Consider burner device — Dedicated documentation phone
• Encrypt everything — Full-device encryption enabled

See Mobile Hardening for complete guide.

Legal Considerations

If your phone is seized:

• Do NOT unlock it
• Do NOT provide passcode
• State: “I do not consent to a search”
• Request an attorney
• Document who seized it and when

If ordered to delete:

• You are NOT legally required to delete
• Cloud backups may still exist
• Document the demand for later complaint

---

Sharing Evidence Responsibly

Before Sharing Publicly

Consider:

• Does this identify the detained person? — This can harm them legally
• Are witnesses identifiable? — They may face retaliation
• Is there consent from community members shown?
• Could this compromise an ongoing case?
• Should a lawyer review first?

Stripping Metadata for Public Sharing

When sharing publicly, strip metadata to protect yourself:

• Use ExifTool to remove all metadata
• Many apps strip automatically (but verify)
• Keep originals with metadata for legal purposes

Providing to Attorneys/Organizations

When providing evidence for legal use:

• Keep originals untouched
• Provide chain of custody documentation
• Share via secure, metadata-preserving methods
• Be prepared to testify about authenticity

---

Community Documentation Resources

Public Databases

Resource	Description	Link
ICE License Plate Database	Community-compiled plate database	The Intercept coverage
ICE Detention Lookup	Find detained individuals	locator.ice.gov

Organizations That Accept Evidence

Organization	What They Accept	Contact
ACLU (local chapters)	Rights violation documentation	aclu.org
Immigrant Defense Project	ICE tactics documentation	immigrantdefenseproject.org
WITNESS	Human rights documentation	witness.org
National Immigration Law Center	Legal evidence	nilc.org

---

Quick Reference Card

At an Encounter — What to Capture

1. Date/Time/Location — State verbally
2. Vehicle plates — Read aloud
3. Vehicle VIN — Dashboard through windshield
4. Vehicle description — Make, model, color, features
5. Badge numbers — Read aloud if possible
6. Agency patches — ICE, CBP, ERO, HSI
7. Agent descriptions — Height, build, distinguishing features
8. Actions — Use of force, statements, warrant shown?
9. Witnesses — Names/contact with consent

After Recording

1. Lock phone immediately
2. Backup to secure cloud
3. Note filename and time
4. Write down context
5. Do NOT edit original
6. Get witness contact info
7. Contact attorney if needed

What NOT to Do

• Don’t focus camera on detained person’s face
• Don’t state anything about their immigration status
• Don’t interfere with enforcement
• Don’t delete footage if demanded
• Don’t edit original files
• Don’t share publicly without considering consequences

---

Long-Term Evidence Preservation

Evidence May Be Needed for Years

Documenting immigration enforcement isn’t just about immediate legal defense. This evidence may be critical for future accountability — investigations, congressional hearings, civil rights lawsuits, or truth commissions that may not happen until a future administration. Preserve evidence as if it will be needed a decade from now.

Why Long-Term Preservation Matters

• Statute of limitations on civil rights violations can be years
• Pattern evidence requires multiple incidents documented over time
• Policy changes may enable accountability that’s impossible today
• Historical record matters regardless of legal outcomes
• Eyewitness memory fades — contemporaneous documentation doesn’t

Creating Court-Quality Documentation

Eyewitness accounts alone are weak evidence. To create documentation that can survive legal scrutiny years later:

Element	Why It Matters	How to Achieve
Chain of custody	Proves evidence wasn’t tampered with	Document every transfer; use hash verification
Contemporaneous creation	Proves timing	Preserve original metadata; don’t edit
Corroboration	Multiple sources strengthen evidence	Coordinate with other witnesses; capture same event from multiple angles
Authentication	Proves you captured it	Use ProofMode; photograph yourself at scene
Context documentation	Explains what evidence shows	Write detailed notes immediately after

Hash Verification

A cryptographic hash (like SHA-256) creates a unique “fingerprint” of a file. If even one pixel changes, the hash changes completely.

To verify file integrity:

# On Mac/Linux terminal:
shasum -a 256 filename.mp4

# On Windows PowerShell:
Get-FileHash filename.mp4 -Algorithm SHA256

Best practice:

1. Immediately after capturing evidence, generate a hash
2. Store the hash separately from the file
3. Years later, regenerate the hash to prove the file is unchanged

Long-Term Storage Strategies

Strategy	Pros	Cons	Best For
Multiple cloud services	Redundant, accessible	Requires ongoing payment; services may shut down	Active documentation
Physical hard drives (multiple)	No ongoing cost; no internet needed	Can fail; fire/flood risk	Backup copies
Archival organizations	Professional preservation; legal expertise	May have access restrictions	Critical evidence
Trusted individuals	Geographic distribution	Depends on relationships	Personal backup
Encrypted USB drives	Portable; offline	Easy to lose; limited capacity	Transport

The 3-2-1-1-0 Backup Strategy for Critical Evidence

Upgrade from 3-2-1:

• 3 copies of data
• 2 different media types
• 1 offsite copy
• 1 copy air-gapped (offline, disconnected)
• 0 errors (verify backups regularly)

Organizational Archives

Consider providing copies to organizations that maintain long-term archives:

Organization	Focus	Contact
Internet Archive	General digital preservation	archive.org
Documenting Hate (ProPublica)	Hate incidents and civil rights	projects.propublica.org/hate
Human Rights Data Analysis Group	Human rights documentation	hrdag.org
WITNESS Media Archive	Human rights video	witness.org
University libraries	Academic preservation	Contact local university special collections

Creating a Documentation Dossier

For each significant incident, create a complete dossier:

1. Raw Evidence

• Original video/photo files (unedited)
• Hash values of each file
• Original metadata preserved

2. Written Documentation

• Date, time, location (exact address)
• Your name and contact information
• Detailed narrative written immediately after
• Weather conditions, lighting
• How you came to witness the incident

3. Corroborating Information

• Witness contact information (with consent)
• Any news coverage
• Social media posts (archived, not just screenshots)
• Public records obtained later

4. Chain of Custody Log

• When file was created
• Every copy made and where stored
• Every person who received a copy
• Any transfers between devices

5. Context Documentation

• Map showing your position relative to the incident
• Photos of the location taken later
• Research on the location (public records, satellite imagery)

Preventing Evidence Decay

Digital evidence can become unusable over time:

Risk	Prevention
Format obsolescence	Store in common formats (MP4, JPEG); periodically migrate
Storage media failure	Multiple copies; different media types; regular verification
Cloud service shutdown	Multiple services; local backups
Password loss	Secure password manager; recovery procedures documented
Organizational knowledge loss	Written procedures; multiple people know the system

Secure Long-Term Cloud Options

Service	Features	Cost	Notes
Backblaze B2	Object Lock (WORM); immutable storage	Low cost	Prevents deletion during retention period
Proton Drive	E2E encrypted; Swiss jurisdiction	Free tier available	Strong privacy protections
Tarsnap	Encrypted; pay-per-use	Pay per GB	Designed for archival

Evidence That Compounds Over Time

Single incidents are important, but pattern evidence is powerful. Consistently documenting over time can reveal:

• Geographic patterns — Where enforcement concentrates
• Tactical patterns — Methods, vehicles, timing
• Civil rights violations — Systematic issues vs. isolated incidents
• Policy violations — Whether stated policies are followed
• Chain of command — Who is responsible

This requires:

• Consistent documentation methods across time
• Standardized reporting (use SALUTE format)
• Database or organized storage
• Cross-referencing with other documenters

Preparing Evidence for Future Legal Proceedings

If your evidence may be used in court years later:

Do:

• Preserve originals untouched
• Document your contemporaneous observations in writing
• Keep records of your location and actions that day
• Maintain contact information (yours and witnesses)
• Be prepared to explain how you captured and stored the evidence

Don’t:

• Edit original files (make copies to edit)
• Rely on memory alone
• Throw away “unimportant” footage (context matters)
• Share originals that can’t be recovered
• Assume someone else is documenting

Testimony Preparation

Even with perfect evidence, you may need to testify. Prepare by:

1. Keeping contemporaneous notes — Written records from the day of the incident
2. Reviewing your documentation — Not to rehearse, but to refresh memory
3. Understanding chain of custody — Be able to explain how evidence was preserved
4. Documenting your own background — Why were you there? What’s your experience?
5. Consulting with attorneys — Before any legal proceeding

---

Related Guides

• Recording Rights — Legal framework for recording
• What to Report — Reporting guidelines
• SALUTE Reporting — Standardized reporting format
• Mobile Hardening — Secure your devices
• Research Security — OPSEC for researchers