Big tech finally agreed on something. It changed nothing.

This presentation examines why a technically mature, broadly endorsed standard for proving digital content is authentic has failed to reach practical deployment, and argues the failure is structural, not technical.

In January 2025, the ASD and ACSC jointly endorsed Content Credentials for strengthening multimedia integrity. Adobe, Google, Microsoft, Meta, OpenAI, and Sony all sit on the steering committee behind C2PA (Coalition for Content Provenance and Authenticity), a standard that attaches cryptographically signed records to media files capturing who created content, what tools were used, and whether AI was involved. Version 2.3 shipped in February 2026 and is being fast-tracked as an ISO standard. Camera manufacturers such as Leica, Sony, and Nikon ship with built-in signing, and popular phone models like the Pixel 10 embed provenance at the chip level. All major AI image generators already sign their output with Content Credentials. The standard is technically mature and broadly deployed at the point of creation.

However, fewer than 1% of images online carry any provenance data. The security community already accepts that proving authenticity at origin is better than detecting forgeries after the fact. That principle drives zero trust, code signing, and certificate-based identity. Content provenance applies the same logic to media, and it is failing for reasons that have nothing to do with the technology.

The provenance chain breaks at every point where content actually reaches people. Social media platforms, messaging apps, and content management systems routinely strip metadata on upload. Adversarial tools exist specifically to remove it. Consumers say content authenticity matters but almost nobody checks credentials. Apple, whose participation would create the largest provenance-enabled device fleet on Earth, has not joined the coalition. And provenance metadata itself creates unresolved privacy and OPSEC risks for journalists, whistleblowers, and anyone whose safety depends on not being linked to their content.

The security community has seen this pattern before. TLS existed for years before HTTPS became universal, and the transition only happened when Chrome began marking HTTP as "Not Secure." Content provenance has no equivalent forcing function. This is a collective action problem: everyone benefits if everyone participates, and no single actor can justify moving first alone. Australia remains in a voluntary guidance phase with no mandatory provenance requirements on the horizon, making practitioner-led momentum critical.

The presentation draws a direct parallel between HTTPS adoption and the current provenance impasse, examines the privacy tensions that make deployment genuinely complex rather than merely delayed, and asks what role the Australian cyber security community should play in demanding provenance preservation as a baseline expectation.

Attendees will leave understanding how C2PA and Content Credentials work at a technical level, where and why the deployment chain breaks, why this mirrors coordination problems the security community has solved before, and what collective action from practitioners looks like in practice.

I feel this talk aligns with Empowered Together by confronting the gap between technical consensus and coordinated deployment, and arguing that closing it requires the kind of cross-sector collective action the theme describes.