SHORENET

Online and social media evidence for police: Online evidence the defence can check for itself.

More offences are committed, advertised or evidenced online, and every screenshot exhibit invites the same question from the defence: was this edited, or made with AI? Shorenet gives your officer a better answer: the traffic the website delivered, witnessed by our relay, in a form the defence expert can test on their own equipment.

Talk to us How it works →

Exhibit 03 · sealed

Web page

forum.example/thread/88213

Selling today only. Cash, collection only, no questions.

  • Captured 19 July 2026, 22:03 UTC
  • SHA-256 3a019837…402e9f1d
  • Timestamped by DigiCert (RFC 3161)
  • Witnessed by the Shorenet relay

Verified · independently witnessed

An illustration: the names, dates and values are made up.

Online evidence is under more pressure than ever

Oct 2025

Judicial guidance in England and Wales warned judges that AI is being used to produce fake material, including text, images and video.

Source: Judiciary of England and Wales

Nearly 1 in 5

Posts on X (then Twitter) were no longer publicly visible within months. Evidence that is not captured properly the first time is often gone.

Source: Pew Research Center, 2024

3,443

AI-generated child sexual abuse videos found in 2025, against 13 the year before. Much of the evidence in these cases is what was published, not whether it is real.

Source: IWF, 2025

Many online offences turn on publication, not authenticity

In England and Wales, sharing an intimate image without consent is an offence whether the image is real or synthetic (section 66B of the Sexual Offences Act 2003). Much malicious communications, harassment and stalking casework works the same way: a central part of what has to be proved is that the material was published, where, and what it said. Consent, attribution and the other elements need their own evidence.

Shorenet does not detect deepfakes and does not claim to. It proves what was online, which in these cases is the question the court has to answer. The legal argument in full.

What changes with Shorenet

Evidence from the network, not a picture of the screen

The officer browses as normal. The evidence is the encrypted traffic itself, with a screen recording able to run alongside as a guide, and once it is sealed any later change shows when it is verified. The browser still decides what is requested, such as which account is logged in.

A witness the officer does not control

Our relay witnesses the traffic on its way to the officer without being able to read it. The officer holds the keys but not the relay, so faking what it witnessed would take far more than editing a file.

Checkable by the defence

The exhibit can be verified by the defence expert using public standards, on their own equipment and without us. Each check passes or fails: there is no probabilistic score in the cryptographic checks.

Where it fits

  • Image-based abuse and online harassment. Posts, profiles and messages on public platforms, captured before takedown.
  • Fraud. Scam websites, fake investment platforms and social adverts, which often disappear within hours.
  • Open-source investigation. Research on the open web made to an evidential standard from the start, not reconstructed from screenshots later.
  • Networks, not just pages. On supported platforms, captures become structured records of accounts, posts and messages and how they connect, building up across an investigation. Every record links back to the sealed evidence it came from.
  • Messaging apps. Telegram (web) is supported today, including its second layer of encryption. WhatsApp is in development.
  • Disclosure. A record the defence can examine and test, rather than one it has to take on trust. The report can draft a witness statement under section 9 of the Criminal Justice Act 1967 and, for a qualified expert, a CrimPR Part 19 declaration. Method validation under the Forensic Science Regulator’s Code stays with your force; we provide validation material.
  • Evidence stays in your custody. Captures are kept on your own machine and never uploaded to us, so continuity stays with your force.
  • Websites see the relay’s address, not your force’s. Whether your activity needs authorisation is unchanged.

Preserving social media evidence before it is taken down. Can a forensic examiner prove what a website sent?

What it does not do

  • It does not detect synthetic content. If a site served a fake image, Shorenet proves the site served it, not that the event happened.
  • It does not identify who was at the keyboard. Attribution still comes from subscriber data, device examination and the rest of the investigation.
  • It shows what was served to the investigator. Sites can show different visitors different content, so a capture shows what was served to the investigator at the time it was made.
  • It is independent of the investigator, not of us. We operate the relay, and we say so. It makes fabrication by the collecting party far harder than editing a file, not impossible. The relay routes your traffic but does not record where you browsed.

Every boundary is set out in full on How it works and in Shorenet Research.

Test it against your own casework.

We are looking for a unit willing to host an evaluation: a capture of a service you actually deal with, verified by your own examiners on your own equipment, followed by a session in which you try to break the reasoning.

Talk to us How it works →

Meet us at the NPCC Innovation and Digital Summit, ACC Liverpool, 19-22 October 2026, Stand G9.