Tracing Paper (2020)(logicmag.io) |
Tracing Paper (2020)(logicmag.io) |
Sounds like the tracking tech is implemented in the proprietary drivers. If only the free software movement had filled its original purpose (freeing printer drivers¹) for more models…
¹https://www.fsf.org/blogs/community/201cthe-printer-story201...
Edit: looks like it may be in the firmware on the printer itself, not drivers on computers, as h-node warns of tracking even on printers with full compatibility with blobless, FSF-endorsed distros eg. Trisquel GNU/Linux-libre: https://h-node.org/printers/view/en/2215/HP-DeskJet-2700-ser...
https://lists.inventati.org/message/20200308.154747.1b4d1245... https://github.com/firstlookmedia/pdf-redact-tools https://github.com/firstlookmedia/dangerzone
One thing that has me baffled is why there's so much speculation and black-box approach when it should definitely be possible to reverse engineer those firmwares to directly get definite answers to all possible questions. Why does no one seem to even consider dumping the firmware from a printer and reverse-engineering it?
They also affect me when I use the printer for producing PCBs using the toner transfer method - the dots act as an etch resist and impose an uncorrectable noise of copper dots on to an otherwise excellent result.
https://www.eff.org/pages/list-printers-which-do-or-do-not-d...
The reality is even in corporate environments print servers for sensitive areas will retain audit logs and/or copies of documents sent to the print spool. Even if that completely fails, you can do a forensic recovery on the hard drive inside the printer where all documents are buffered.
The white is, of course, the areas on the paper that you're not printing, assuming you're feeding in white paper.
I know some DTP types that this technique would drive them crazy. They spend so much time adjusting the leading/kerning to get the text appear in the layout they way they want. Having that thrown out the window by the printer would absolutely drive them insane. For science, I want to try this out now. It would be awesome to do it as an April Fools joke.
Illegal information was circulating somewhat freely though, maybe not very sensitive stuff (people were self censoring very political stuff as they were afraid of repercussions from authorities), but lots of things from the west were circulating: magazines, books, videotapes and so on.
Growing up there it was drilled in us that counterfeit money is an extremely grave offense and it is punishable severely, and the same story with drugs. I was surprised to find out that counterfeit money was circulating in the states and when I received such a bill I asked a police officer what am I supposed to do with that. He told me to just keep it:) He said I shouldn't bother to report it as nobody would really care about it.
https://www.nytimes.com/2020/05/31/us/george-floyd-investiga...
Is there some software or a web site that will scan an image and decode the dots?
It's also possible they are using a different technique. As I mentioned towards the end of the article, the dots have been around for a while and some vendors are apparently looking into other methods
I'd be curious to know how the dots actually get printed.
There were images I sent the magazine of the dots from some magazines I scanned, but they didn't run them. If you scan a page and invert it, the patterns are more legible https://i.imgur.com/x1TXa30.png
Buy a cheap printer with cash, from a location several hundred kilometers from you.
Go to a non-local Staples, FedEx, Kinkos with a USB stick, pay with cash for copies/printing. Better yet, pay someone else to do it for you.
Other than that, using a vintage dot-matrix printer with a low enough resolution (e.g. a 9-pin head) that it's unlikely to have either the smarts or the resolution needed to make this work.
Of course, this just means that if you are conspicuously buying a curated collection of vintage printers, you're providing another type of evidence.
They don't say anything about inkjet, though. Unclear if this is because of a fundamental limitation of inkjet printers, lack of interest, or just because inkjet printers kind of suck compared to laser. :P
[1] https://www.eff.org/pages/list-printers-which-do-or-do-not-d...
Without the fuzz over enough time passed we, even NSA experts, seem to forget about those traps.
The moral of the story for us techies: Don't wane people in anonimity if they use X or do Y. There will be a percentage of people who do things, they wouldn't have done without that info, and some of said percentage will be blackmailable (think miners having "inciminating pictures" on their machines because they were stored on the blockchain once).
Worse than a privacy infringing government are blackmailable citizens (One could argue the former causes the latter, I argue the latter steers the former into worse).
The handling at The Intercept was amateur journalism at best, and at worst a cynical ploy (incriminate their source, hence confirmation, generate a media storm and clicks). They ignored fundamental techniques to protect sources: retyping documents without formatting, spell checking them, sharing only small snippets of text, in person instead of allowing retention, confirming via an external expert.
Of course, even without the printout they would have got her, she had terrible OPSEC.
Of course, document control for government and corporations is probably the bigger reason they do it.
And anyways in your example, there are far easier ways for the government to figure out that stuff that doesn't involve chasing down printers.
> Maybe she thought physical paper would be safer from digital surveillance than an email. So she printed the documents at her office [my emphasis] and then mailed them
Concern about counterfeiting just served as a usefully palatable justification for introducing the tracking technologies. After that, it's easy. All you have to do is let some small to medium counterfeiters continue to operate so the justification continues to look reasonable. Heck you can even do your more or less best to try to catch them all, since you can be confident you won't ever completely succeed
The worst damage crime does isn't direct. The real damage is the PR cover it provides for government repression
I also believe that international trade agreements and banking regulations, such as the Japanese measures mentioned in the article, require dots and similar methods even if they have perhaps technically been superseded.
Now, it probably phones home and that's probably how they catch people but there are ways around that.
idk I think I'll just accept that risk, it's a lot more likely that my ex will stab me after all
0315 am, a drone flies over your house and hovers just long enough to upload firmware to your WiFi-enabled printer. Having not memorized your printers serial number, and certainly not checking it every day, you don’t notice the new firmware or orientation of dots.
Your printer, along with an identical model bought later and cloned to yours, are now forensically indistinguishable. Your printer driver phones TonerCo for a refill. It arrives with the fanfare of fast shipping.
11 months later, your address and credit card purchase are enough to convince the right judge to grant a no-knock warrant. Your printer has embroiled you, or someone just as innocent as you, in a very bad time.
On a monochrome printer, I guess you can still to steganography by messing with the dithering, I guess? However, since the stated aim of the fingerprinting is to catch money counterfeiters, I guess they are less interested in monochrome.
