The
Secret Service has admitted before that the tracking information is
part of a deal struck with selected colour laser printer
manufacturers – including Xerox, Canon and many others. If a colour
laser printer is used to forge a document and agents get sight of
the document, the codes can be read. However, the full nature of
the private information encoded in each document was not previously
known.
"We've found that the dots from at least one line of printers
encode the date and time your document was printed, as well as the
serial number of the printer," said EFF Staff Technologist Seth
David Schoen.
You can see the dots on colour prints from machines made by
Xerox, Canon, and other manufacturers. The dots are yellow, less
than one millimetre in diameter, and are typically repeated over
each page of a document. In order to see the pattern, you need a
blue light, a magnifying glass or a microscope. But once you've
cracked the pattern, you may be able to trace the owner of a
printer that produced a suspicious document.
The major manufacturers tend to say little about the issue on
record. When investigating the issue earlier this year for Issue 12
of OUT-LAW Magazine, a typical response
was: "Epson is cooperating closely with industry groups and the
relevant authorities in each country to prevent counterfeiters use
[sic] its products in illegal activities. However, due to the
sensitive nature of this issue we are unable to comment about the
exact measures that are being taken."
With a serial number, a supplier can identify its customer –
although it may not expect to receive such requests. OUT-LAW
spoke to dabs.com, the UK's leading online retailer of computing
and technology products. Spokesperson Louise Derbyshire said the
company was unaware that printers left their fingerprints on each
printed page. She acknowledged, however, "dabs.com uses serial
numbers to track products as they move through our warehouse and
are shipped to customers". So, if required, "we could trace the
delivery address."
EFF and its partners began its project to break the printer code
with the Xerox DocuColor line. Researchers Schoen, EFF intern
Robert Lee, and volunteers Patrick Murphy and Joel Alwen compared
dots from test pages sent in by EFF supporters, noting similarities
and differences in their arrangement, and then found a simple way
to read the pattern.
"So far, we've only broken the code for Xerox DocuColor
printers," said Schoen. "But we believe that other models from
other manufacturers include the same personally identifiable
information in their tracking dots."
Xerox previously admitted that it provided these tracking dots
to the US Government, but indicated that only the Secret Service
had the ability to read the code. The Secret Service maintains that
it only uses the information for criminal counterfeit
investigations. However, there are no laws to prevent the
Government from abusing this information, according to the EFF.
"Underground democracy movements that produce political or
religious pamphlets and flyers, like the Russian samizdat of the
1980s, will always need the anonymity of simple paper documents,
but this technology makes it easier for governments to find
dissenters," said EFF Senior Staff Attorney Lee Tien. "Even worse,
it shows how the government and private industry make backroom
deals to weaken our privacy by compromising everyday equipment like
printers. The logical next question is: what other deals have been
or are being made to ensure that our technology rats on us?"
