You may have heard some of the noise that EFF was making a year so ago about the tracking dots hidden in documents by color laser printers. A number of people contacted their printer manufacturers to ask how to turn the "feature" off. At least one person (who has, understandably I think, expressed interest in remaining anonymous) was subsequently visited by the United States Secret Service who asked him questions about why he wanted to turn off the tracking dots in his printer.
I’ve put up a little website with some others in my research group at MIT that tries to organize individuals to call into their printer manufacturers and demand that the feature is turned off. If many people call, the government won’t be able to visit us all.
We’ve made a long list of technical support contacts to help with the process. Please call your printer manufacturer today and spread the word about the site so that more people call in.
The site is called Seeing Yellow — a reference to tiny yellow dots that make up the tracking code — and its online at seeingyellow.com.
I would have thought this steganographic signature could be thwarted using Yellow Ragwort: http://www.sacred-texts.com/neu/celt/tfm/tfm133.htm
My question is: “Do laser printers take pains to prevent any document being printed that contains an arrangement of yellow dots that may be confused with its own signature?
If not, then one simply adopts a printer driver that overlays one or more valid, but inaccurate signatures.
Hang on. The doorbe
People have suggested doing something like this. Unfortunately, we only understand one of the many codes in use and don’t understand it fully. We do not know what methods the printer companies use to block this or even how the dots are created in most cases. It could be that printing yellow over the whole page would make it impossible to get any data out of it.
This, of course, is not a great solution. People that know about the dots can simply print in black and white. Its the people who think they are anonymous but are not that are worse and no workaround is going to help with that. We need to spread awareness and help turn them off by default.
Well, printing yellow over the whole page might actually be a good idea. It could be that the yellow dots are only printed in areas where no ink is otherwise required, so what you’d do is ensure that 0.001% of yellow was always required to be printed, and then no yellow dots might get printed, given no blank areas.
But, sure, technologically naive whistle blowers may need to be protected from a conflict between human rights and national security.
Sounds like a job for Hollywood.
Anyway, don’t forget this can be a double edged sword. The state that sanctions this signature can find themselves unwittingly hoist by their own petard. All you need is a freely available scanner program to let folk collectively associate each signature with a sender, and then you’ll rapidly be able to determine previously unknown senders. And then the cat’s out of the bag and commerce will complain.
Do signatures vary with each printing, or are they static per printer?
I suppose an ordinary scanner may not be able to pick up the yellow, but perhaps a cheap acetate filter might help?
The signatures are different from page to page but there are static parts. Seth Schoen from the EFF decoded Xerox’s code and it contains the serial number, the page number, the date and time, and other information. Most printer manufacturers have their own system and AFAIK no others are decoded.
A normal scanner will work fine but to see them they need to select out the blue channel.
I know of a case from year 2000 where mechanics of a major printer manufacturer were testing a brand new product. I can not disclose all information but…
It was a super high end multi function device, worth a lot and the first of kind in country. It was actually so good that if you gave it proper sort of paper (actually it’s technically not paper) you could scan&print money. I don’t mean like how you could likely, this device made the bills automatically look good enough to pass quick inspection at stores. The mechanics took care to fine-tune the device slightly (change inks, get ahold of proper cloth to print on etc) and printed a lot of money.
Now, these devices usually nowadays decline of scanning&printing most of the used currencies. This model did not have that feature for some reason. Also, their target was euros, which have a huge amount of anti-counterfeit features – much more than most of the others. However some of them are more expensive so they do not exist in smaller bills and/or people don’t really start checking everything of the smaller ones in shops. Generally it is enough to have proper type of inks so that you can make it look correct under UV light.. And feel correct.
They managed to spend the money they printed easily in shops all around. No one noticed a thing wrong. Money goes from shops to banks.. Which have outsourced the actual money counting. It takes days until someone notices anything wrong. At that point no one recalls anymore who visited the shop etc.
The funny thing is.. That damned multifunction device printed these small nearly invisible dots on the paper. Enough to be noticed however by the police. Which asked all of the major vendors whether they recognize it as theirs – and this one country specific operation recognized it. Well, it had a serial number, gee.. So they checked from the databases about the whereabouts of that machine – and were majorly shocked to notice that there was only one such device in country, and it was still unsold and in the premises of that company.
The two mechanics got out of jail last year I believe. Lesson of the story: not everyone using the information provided by those dots is evil!
Thanks anonymous for your note. Your anti-counterfeiting example is precisely why the dots exist and I’m sure they serve their purpose. But what portion of people who would prefer to remain anonymous do you think are counterfeiters? How important is the possible of anonymous communication of this type?
The federalist papers were one of the most important set of documents in early US political history and they have fundementally shaped the way the US and its governments grew. They were (originally) published anonymously and there’s reason to believe that they would have said what they did or even been published at all if were immediately traceable to their authors.
Even if 90% of the time the dots were used it was “get the bad guys” — and that might even be true — our ability to community anonymous or, perhaps more importantly, to know when we are being monitored and tracked, is a very important right that is central to our democracy.
You should ask yourself something.
1. Anonymous from whom? You can pick up a printer from shop, print something important.. And practically no one can really track down who owns the printer #18931793. Especially as you can buy them anonymously and destroy the device too if you are likely to get in trouble because of your prints. But come on, how many of us really does that sort of stuff?
2. Does it matter? You’re giving away clues about your identity even without those dots. Both technically (as pointed out by that one web site) and otherwise (fingerprints and whatnot). If someone like NSA wants to track you down, they can. Likewise if an amateur wants to track you down, he won’t be able to use the information of those yellow dots…
So what is the real difference after you remove your tin foil hat? None.
1. I work in a research group that does some work that annoys governments and big companies. We are at MIT where all large equipment purchases are cataloged before we even get them. Should we be able to print anonymously in this context?
2. Many people can read these dots. There was a talk on this subject at the national document examiners conference. The EFF was able to decode the information in Xerox printers with no special expertise. This information on how to do so is public and accessible to a large number of people.
But of course, the most important issue is not that this can or cannot be worked around by smart people. We definitely can work around it — most easily just by printing in black and white.
However, these dots are placed on each page invisibly and in secret. Few people know about them. That’s the most objectionable thing. These are not just tracking dots, they are secret tracking dots. People think they are anonymous when they are not.
I also find it slightly ironic that you are chose to remain anonymous while having this conversation with me. You, for good reason perhaps, didn’t want to tell your story and have it associated with your name. I’ve spent hours fighting with spam on this site to allow precisely this sort of thing to happen and I find it interesting that you, who are happy to take advantage of this, seem so ready to insult and patronize me for suggesting that others might want to do the same on a printed, illustrated page.
1. Annoys, yes.. But they know already who annoys them? Academics love putting their name on research reports, and there are other ‘subtle’ traces…
2. Yes, you can “read” this data. It is not information yet. If you can tell who has the printer #234892384, there’s no central database they can query for what would pinpoint the user. Even at the best case it’d be a ballpark estimate. And.. It comes in any case back into good old fashioned detective work – which would have been possible even without those dots.
So, it really really does not change anything relevant in your case.
I am anonymous not because I would gain anything from it but because I wouldn’t gain anything from being non-anonymous either. On top of that, I can’t understand the obsession of having accounts and identities in the first place. It should be arguments vs arguments, none of that argumentum ad hominem stuff.
The meaning has not been to insult or patronize, but to discuss. I have tried to reason instead of just claiming things. The insults and patronizing are just in your mind and your attitude.
Personally, Sir, I think you’re an idiot.
(that was humor. laugh.)
Seems like anonymous’s got a poor sense of humor.
Opening this website is a great idea. I don’t own a printer myself, but I remember when I saw the information about the little yellow dots (back in november 05 when I discovered the software via the EFF website): I got frightened.
I often read your blog and want to thank you for you job concerning free software (and privacy issues in this case).
:eric:
lqmhcd uxwoset ywobnpi rwmdtuo
There is a new open source software toolkit for dealing with yellow tracking dots, removing them or customising them, along with a paper about how it is done:
https://github.com/dfd-tud/deda
https://dfd.inf.tu-dresden.de/
https://doi.org/10.1145/3206004.3206019