Social media masking for police investigation
Project description
Forensic tool for undercover police investigation involving social media
Context
Hermes is a forensic desktop tool for undercover police investigations involving social media. Built for and deployed at Politie Rotterdam, it lets officers send pre-selected media through Snapchat, WhatsApp, and Discord — appearing as if captured live on a mobile phone rather than pushed from a PC.
Domain
Law enforcement tooling and desktop software development. We built a Windows application in Python that controls an Android phone over USB, intercepts how social media apps access the camera, and replaces it with pre-selected media from the PC. The end users are police officers — not developers — so usability was just as important as the technical side.
Results
Product: Hermes — delivered and in active use
The main outcome is a working tool. Hermes is deployed at Politie Rotterdam and actively used by our stakeholder Ronald Beljaars. It does what it was built to do — officers can push pre-selected media through Snapchat, WhatsApp, and Discord from a PC, with the receiving end seeing it as a live mobile camera shot.
That's not a demo. It runs on real hardware, in a real operational environment, used by the people it was built for. That puts it at TRL 7 — prototype demonstrated and validated in an operational environment.
Product: A tool that actually got used, not shelved
A lot of student projects get handed over and forgotten. Ronald actively gave feedback throughout the sprint, pushed for changes, and kept using it. That's the clearest signal that the tool has genuine value — stakeholders don't invest time in things that don't work.
Insight: Config-driven platform architecture
The biggest technical insight is that platform behaviour shouldn't be hardcoded. Early in the project every platform needed its own code path. We moved everything into a JSON config — dimensions, delivery method, rotation, gallery path. Adding a new platform now takes minutes, not a sprint. Ronald can adjust visual settings himself through the wizard without touching the code.
Insight: Virtual camera injection has limits on modern Android
WhatsApp's Play Integrity checks mean VCAM injection doesn't reliably work for every platform. The insight here is architectural — we built a fallback delivery method (gallery push) that doesn't touch the camera API at all. That decision keeps the tool functional even when Google tightens Play Integrity further. It's a real finding with real operational consequences.
Validation
Validation came from two directions. Ronald confirmed the tool looks right and works in his environment — that's operational validation from the end user. Our test suite (209 tests, GitHub Actions CI) covers the logic side — platform detection, config contract, session management, input sanitisation. Both together give confidence that it works and keeps working.