Skip

The CIA is tracking all your porn printouts
October 19, 2005 7:27 PM   Subscribe

"Sleuths Crack Tracking Code Discovered in Color Printers". Does this creep anyone else out? Some more pictures of the code. It gets scarier: "But Seth Schoen, the EFF technologist who led the organization's research, said he had seen the coding on documents produced by printers that were at least 10 years old." So who knows how long this has actually been going on?
posted by vodkadin (49 comments total)

 
This was discussed previously. Still, interesting.
posted by weapons-grade pandemonium at 7:31 PM on October 19, 2005


Agh damn it. I searched for printer tracking codes, EFF, and checked the links. Sorry about that.
posted by vodkadin at 7:34 PM on October 19, 2005


Quite some time.

Just buy a printer with cash.
posted by delmoi at 7:39 PM on October 19, 2005


Or even buy a printer with cash from a store in some other state, if you're planning on doing anything scandalous. Of course, now that the code is known, I would imagine it would be better to simply wash your bills, er, 'documents' with a chemical that would turn the entire thing yellow under the right light.
posted by delmoi at 7:41 PM on October 19, 2005


i thought this done for primary purpose of tracking forged paper cash to it's point of origin (newfangled color inkjets and lasers). in which case not that great a deal to get all creeped up about.

and by most accounts wasn't ever really much of a 'secret' either.

why now all the hysterics?
posted by rodney stewart at 7:44 PM on October 19, 2005


But don't buy a printer with money you printed on your last one.
posted by delmoi at 7:47 PM on October 19, 2005


Who prints out porn?
posted by yhbc at 7:51 PM on October 19, 2005


rodney, you call this "hysterics"? Newbie, huh?
posted by MrMoonPie at 7:51 PM on October 19, 2005


bad link.

n00b
posted by rodney stewart at 7:58 PM on October 19, 2005


Don't sweat the double posts. At least you aren't The Jessie Helms.
posted by Ironmouth at 8:01 PM on October 19, 2005


Just buy a printer with cash.

Doesn't matter. As long as a connection can be established between you and any output from that printer, everything else it's put that fingerprint can also be linked back to you. Even if you paid cash.

One of the concerns EFF has raised is how governments can use this to identify anonymous critics/dissidents through their printer's or copier's hidden signature.
posted by nakedcodemonkey at 8:12 PM on October 19, 2005


The old post was about copiers, this is about xerox printers. Not a double, is it?
posted by mathowie at 8:40 PM on October 19, 2005


Copiers are just printers with scanners glued on the top of them. Same technology, same purpose for being there.
posted by dg at 8:43 PM on October 19, 2005


Yeah, but the angle on the story is new. Every *printer* has now been shown to track its documents. Before it was just big copiers.
posted by mathowie at 8:48 PM on October 19, 2005


That previous post was almost a year ago. Bringing it up again doesn't hurt my feelings. In fact, I'm thinking of posting this again next week!
posted by dingobully at 8:56 PM on October 19, 2005


nakedcodemonkey writes "Doesn't matter. As long as a connection can be established between you and any output from that printer, everything else it's put that fingerprint can also be linked back to you. Even if you paid cash."

er, yes it matters. Paying cash eliminates the paper trail linking you personally to a certain printer.
posted by clevershark at 8:57 PM on October 19, 2005


er, yes it matters. Paying cash eliminates the paper trail linking you personally to a certain printer.

Yeah, but if you print anything else with your name on it, it still has the same code and is linked to you. Get it?
posted by dingobully at 9:01 PM on October 19, 2005


Every *printer* has now been shown to track its documents.

I don't think anyone is suggesting entry-level inkjets carry this "protection." That would be a bit of overkill. The exact printer in question, a Xerox Docucolor 12, is fairly massive (even without the finisher module, as pictured) and quite expensive. Even most companies rent, rather than buy, these machines. I'd be surprised if any of the other printers the EFF was looking at were less than office-grade.
posted by deadfather at 9:07 PM on October 19, 2005


Another set of interesting writeups can be found at bunnie's blog, the same guy who did some of the earlier development work for xbox modchips. He's been working on disassembling and learning about one of his laser printers to better understand the tracking code.

Apparently, though several printers have different onboard software and hardware, most share a component from HP that drives the lasers, and it is in this component that the tracking code is expected to reside. Thus, it's a single point of failure; place tracking code software in this unit to infect the most printers with the least amount of work.

One other thing: Isn't this "to prevent counterfeiting" a red herring? Who uses color laser printers to actually print money? I've personally never tried, but just on a practical level, it would seem that you'd get more realistic results from inkjets.
posted by odinsdream at 9:11 PM on October 19, 2005


...or good old fashioned offset printing.
posted by odinsdream at 9:12 PM on October 19, 2005


deadfeather; take a look at the link I posted; the laser control component is in many printers; plenty of which are consumer-grade.
posted by odinsdream at 9:13 PM on October 19, 2005


There was a $300 Dell mentioned.
posted by weapons-grade pandemonium at 9:14 PM on October 19, 2005


deadfeather; take a look at the link I posted; the laser control component is in many printers; plenty of which are consumer-grade.

I guess I'm living in the past; I didn't think any color laser printers were consumer-grade. But still, my statement about inkjets still stands, at least for the time being.
posted by deadfather at 9:24 PM on October 19, 2005


dingobully writes "Yeah, but if you print anything else with your name on it, it still has the same code and is linked to you. Get it?"

I see what you're saying, but I just don't think it's a good point. If you're going to print stuff that identifies you personally anyway why would you give a damn about a secret code that may identify you covertly?
posted by clevershark at 9:24 PM on October 19, 2005


I see what you're saying, but I just don't think it's a good point. If you're going to print stuff that identifies you personally anyway why would you give a damn about a secret code that may identify you covertly?

No, they're matching other documents to it. Nevermind. Let nakedcodemonkey explain it to you.
posted by dingobully at 9:28 PM on October 19, 2005


What he's saying is that you get home from work, and you print off that document for your boss, and you mail it in. Next, you make a cup of tea and finish your article in the anarchist communist terrorist newspaper you run out of your basement, print off a draft, and mail it to your editor.

When your editor gets arrested, they find this draft copy, and notice the tracking codes. They find it was purchased with cash, but after investigating the guy's friends (including you) and visiting their places of work, they come across the report you printed for your boss, and that ties you to the draft.
posted by odinsdream at 9:29 PM on October 19, 2005


It would be funny if this could be used to figure out who made those "Bush AWOL" memos Dan Rather got.
posted by bobo123 at 9:29 PM on October 19, 2005


Paying cash eliminates the paper trail linking you personally to a certain printer.

Umm, how does that help when they raid your place and take your printer?
posted by wah at 10:15 PM on October 19, 2005


Here's a list of printers known to have (and not have) the tracking codes.
posted by falconred at 11:46 PM on October 19, 2005


But still, my statement about inkjets still stands, at least for the time being.

That's rather naive. The drivers can easily enough contain code that spits out little yellow dots onto the page as it prints. And it's not a stretch to imagine a teeny chip that monitors the line feeds and head movements, and spits out little pulses to a yellow nozzle. It'd cost a penny to implement it.
posted by five fresh fish at 11:54 PM on October 19, 2005


And let's think about the upside of this: high-level executives and politicians are equally damned by this development. These days, that's a good thing.
posted by five fresh fish at 11:55 PM on October 19, 2005


fff, much as I would love to see white collar criminals caught by this, I won't hold my breath. If it has been around for 10 years, why have we not seen it used (abused?) by the criminal justice system?
posted by Wilder at 2:44 AM on October 20, 2005


Isn't it the Secret Service that is responsible for forgery?
posted by srboisvert at 4:42 AM on October 20, 2005


Isn't it the Secret Service that is responsible for forgery?

Pedantically, no -- forgery is just a crime. The Secret Service is responsible for those forging US Currency and other such monetary papers, the term they use for this is counterfeiting.
posted by eriko at 5:22 AM on October 20, 2005


C'mon,people. The problem here is not that these printers spit out secret identification codes (although that's plenty bad).

The problem is the secret collusion between government and business to essentially spy on customers without their knowledge or consent.

Secret dots on printers, hardware DRM on computer chips, black boxes on automobiles. What's next? Will your new refrigerator bust you out to the insurance company for eating too much fat? Will your TV watch you while you watch it? Big Brother is moving in, and all I hear is "baa".
posted by Benny Andajetz at 5:36 AM on October 20, 2005


Wasn't there something weird about how the BTK killer was discovered--something to do with his printer being tracked? I never saw a good explanation but recall there was some vague reference to how the document was tracked back to his church.
posted by etaoin at 5:52 AM on October 20, 2005


Benny Andajetz writes "The problem is the secret collusion between government and business to essentially spy on customers without their knowledge or consent."

That's absolutely right, and the real reason that this is creepy as hell.
posted by OmieWise at 6:19 AM on October 20, 2005


But don't buy a printer with money you printed on your last one.

Better yet, just draw your own.
posted by grateful at 6:50 AM on October 20, 2005


As an aside, for the past couple of days the news here in Baltimore has been filled with the fact that someone around here is passing a bunch of fake bills that they print on an inkjet printer after bleaching the original ink off of the bills.
posted by OmieWise at 7:43 AM on October 20, 2005


I'll show them...I just took out the yellow ink cartridge out of my printer. HAH!
posted by Blue Buddha at 7:46 AM on October 20, 2005


Wow, that's a really simple code. Would it really have killed the government to announce that this was in place at the time they began it? If counterfeit deterrence is the point, why hide it? Erik Larson said it best in his book The Naked Consumer: history has shown again and again that once technology like this is active, it's only a matter of time before it's put to uses other than intended. Hard to imagine that possibility wasn't on the minds of the folks who tried to keep this relatively quiet.

Will your TV watch you while you watch it?

I'm pretty sure my cable company knows exactly what I'm using the DVR to watch. That kind of data across a variety of communities is marketing gold, given that they already have the attached demographic info, and far too valuable not to sell. Side point, but just suspectin'...
posted by mediareport at 7:49 AM on October 20, 2005


I don't think there's any reason for concern unless you're into printing your own money, ID's, ransom notes, etc.

So much to be scared of, so little time. In my opinion, the fact that your internet tracks live forever is far more troubling.
posted by _sirmissalot_ at 9:24 AM on October 20, 2005


Paying cash eliminates the paper trail linking you personally to a certain printer.

There isn't any paper trail linking a purchaser to a particular printer in any case. It may be possible to use credit card records to find store records that reveal what model of printer a person bought. But the serial number of the actual unit in question isn't generally recorded when you buy something smaller than an automobile.

This type of tracking is intended to confirm suspicions developed through other means. For example, if Joe Blow has been spending lots of dodgy looking $2 bills lately, and he's been overheard at the bar bragging about how he's printing them at home, then the tracking code is a way to positively match the $2 bills he's been spending with the printer the Secret Service finds in his basement. Joe Blow and his lawyer won't be able to credibly claim that his possession of a printer capable of printing the bills is just a coincidence.

Restricted to this sort of use, the tracking codes probably aren't too bad. But these things do tend to grow in scope. It's not hard to imagine the printer drivers being changed to require online registration, for example, or "phoning home" automatically behind the user's back. Then you've got a paper trail.
posted by Western Infidels at 9:34 AM on October 20, 2005


According to a report on NPR a few days ago, the tecnology is shifting from dot-patterns (which are easier to detect and interpret) to more subtle methods of encoding serial number, date, etc. in variations in the output.

Someone quoted in that piece also said that similar tech has been in digital cameras for years, to uniquely identify the camera in the pics. I guess they flip a pixel here and there, per some secret algorithm. It might be possible to lose it with manipulations in image software, but presumably this would also reduce photo quality.
posted by jam_pony at 9:50 AM on October 20, 2005


_sirmissalot_ wrote:
I don't think there's any reason for concern unless you're into printing your own money, ID's, ransom notes, etc.

With all due respect, this is the tired and shortsighted "if you're not doing anything wrong, you don't have anything to worry about".

Right today could easily be wrong tomorrow, especially if the larger public is complacent. Besides, from a civil rights viewpoint, most things are just not the government's fucking business. You know, "The right of the people to be secure in their persons, houses, papers, and effects...", and all those other pesky rights.

And,BTW, business should never be allowed access to any un-volunteered information.

Sorry for the rant, but while there are many theoretical "slippery slopes", this increasing collaboration of business and government is a slope that is steepening in front of our eyes.
posted by Benny Andajetz at 9:59 AM on October 20, 2005


This is why I do everything in crayon. Sure, its harder to get a job with a resume written out in purple crayon but this way the government can't spy on me so easily.

Why yes, that is the new thicker Reynolds foil over my windows, thanks for noticing!

It bothers me that the government is finding ever more invasive ways to spy on us. Less than it bothers me that US soldiers are burning dead bodies and taunting Iraqi's and insurgents with them. But it still bothers me.
posted by fenriq at 10:00 AM on October 20, 2005


I don't think there's any reason for concern unless you're into printing your own money, ID's, ransom notes, etc.

Oh, I dunno. I would have thought that it would come in useful for seeing which government official has blown the whistle on skullduggery by printing off documents to leak them to the press, or to their political representatives.
posted by reynir at 10:59 AM on October 20, 2005


I assume the 9th column would be filled with the decade number, hence the reason it is blank when representing 2005?
posted by wabashbdw at 1:34 PM on October 20, 2005


bobo123 gets it.
posted by warbaby at 9:23 AM on October 21, 2005


« Older You're doing a heck of a job, Zombie   |   He's a family guy! Newer »


This thread has been archived and is closed to new comments



Post