Feeds

Secret tracking codes in laser printers cracked

Big brother does dot-to-dot

Top three mobile application threats

The pages that are printed by your colour laser printer may include tiny dots, almost invisible to the naked eye. The dots form a code that can be read by the US Secret Service, ostensibly to track down counterfeiters. Now, for the first time, the code has been cracked.

The Secret Service has admitted before that the tracking information is part of a deal struck with selected colour laser printer manufacturers – including Xerox, Canon and many others. If a colour laser printer is used to forge a document and agents get sight of the document, the codes can be read. However, the full nature of the private information encoded in each document was not previously known.

"We've found that the dots from at least one line of printers encode the date and time your document was printed, as well as the serial number of the printer," said EFF Staff Technologist Seth David Schoen.

You can see the dots on colour prints from machines made by Xerox, Canon, and other manufacturers. The dots are yellow, less than one millimetre in diameter, and are typically repeated over each page of a document. In order to see the pattern, you need a blue light, a magnifying glass or a microscope. But once you've cracked the pattern, you may be able to trace the owner of a printer that produced a suspicious document.

The major manufacturers tend to say little about the issue on record. When investigating the issue earlier this year for Issue 12 of OUT-LAW Magazine, a typical response was: "Epson is cooperating closely with industry groups and the relevant authorities in each country to prevent counterfeiters use [sic] its products in illegal activities. However, due to the sensitive nature of this issue we are unable to comment about the exact measures that are being taken."

With a serial number, a supplier can identify its customer – although it may not expect to receive such requests. OUT-LAW spoke to dabs.com, the UK's leading online retailer of computing and technology products. Spokesperson Louise Derbyshire said the company was unaware that printers left their fingerprints on each printed page. She acknowledged, however, "dabs.com uses serial numbers to track products as they move through our warehouse and are shipped to customers". So, if required, "we could trace the delivery address."

EFF and its partners began its project to break the printer code with the Xerox DocuColor line. Researchers Schoen, EFF intern Robert Lee, and volunteers Patrick Murphy and Joel Alwen compared dots from test pages sent in by EFF supporters, noting similarities and differences in their arrangement, and then found a simple way to read the pattern.

"So far, we've only broken the code for Xerox DocuColor printers," said Schoen. "But we believe that other models from other manufacturers include the same personally identifiable information in their tracking dots."

Xerox previously admitted that it provided these tracking dots to the US Government, but indicated that only the Secret Service had the ability to read the code. The Secret Service maintains that it only uses the information for criminal counterfeit investigations. However, there are no laws to prevent the Government from abusing this information, according to the EFF.

"Underground democracy movements that produce political or religious pamphlets and flyers, like the Russian samizdat of the 1980s, will always need the anonymity of simple paper documents, but this technology makes it easier for governments to find dissenters," said EFF Senior Staff Attorney Lee Tien. "Even worse, it shows how the government and private industry make backroom deals to weaken our privacy by compromising everyday equipment like printers. The logical next question is: what other deals have been or are being made to ensure that our technology rats on us?"

Copyright © 2005, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

3 Big data security analytics techniques

More from The Register

next story
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Audio fans, prepare yourself for the Second Coming ... of Blu-ray
High Fidelity Pure Audio – is this what your ears have been waiting for?
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
Apple DOMINATES the Valley, rakes in more profit than Google, HP, Intel, Cisco COMBINED
Cook & Co. also pay more taxes than those four worthies PLUS eBay and Oracle
It may be ILLEGAL to run Heartbleed health checks – IT lawyer
Do the right thing, earn up to 10 years in clink
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.