Secret Printer ID Codes May Be Illegal In the EU

I Don't Believe in Imaginary Property writes "In response to a query from a member of the EU Parliament, an EU commissioner issued an official statement (.DOC) saying that, while they do not violate any laws, secret printer tracking dot codes may violate the human right to privacy guaranteed by the EU's Convention of Human Rights and Fundamental Freedoms. If you don't remember what these are, Slashdot has discussed the issue before. In short, most color printers print small yellow dots on every sheet in a code that identifies the printer and, potentially, its owner. The EFF is running an awareness campaign, and a couple of years back made a start on deciphering the yellow dot code."

Comments

Simple enough fix

[KublaiKhan]

So to stay private, then, one should print sensitive documents on yellow paper?

Re:Simple enough fix

[corsec67]

My color laser printer (Konica-Minolta 2530DL) only prints the yellow dots in color mode.

But that printer is a bit different in that it rotates the toner cartridges into place for every color that is going to go on each page, so a color page has to wait for all 4(CMYK) cartridges to rotate into place, but in black-only mode doesn't rotate anything to be about 5-6x faster.

The reason I chose that printer? Konica-Minolta supplies open-source printer drivers that compiled on my AMD64-Ubuntu box.

Re:Simple enough fix

[pclminion]

Just because your human eye can't see yellow dots on a yellow background doesn't mean a chemical analysis couldn't spot it. Hell, for all we know, they might glow bright green under blacklight.

Re:Simple enough fix

[SethJohnson]

So I guess the yellow dots get inserted at the hardware level.. Could you do us a favor and check those open source printer drivers to see if the yellow dots are inserted at the software level? If so, you might be able to recruit more Ubuntu users if you could offer yellow-dot-free drivers....

Seth

Re:Simple enough fix

[MrMacman2u]

No, it's definetly a hardware level process, you get them even with internal printer status/info pages (assuming they are color).

On the bright side, most color lasers do not insert the yellow dots on black and white pages, though a few models from various manufactures DO tag every single page.

Re:Simple enough fix

[KublaiKhan]

Could be useful in other ways, if you could incriminate someone else's printer by printing the right code...

Re:Simple enough fix

[sricetx]

Well, couldn't the open source driver be modified to add additional random yellow dots, thereby obfuscating the dot code from the hardware?

Re:Simple enough fix

[Belial6]

The next question would be... Can you put a black or cyan cartridge in the yellow slot to make the dots show up bright and clear for easier identification? If so, it would make it easier to see what these printers do. Perticularly when yellow lines are drawn through the codes.

Human Rights or European Citizen Rights?

[Anonymous Coward]

... secret printer tracking dot codes may violate the human right to privacy guaranteed by the EU's Convention of Human Rights and Fundamental Freedoms. I'm thinking that I would like to see a meeting between the EU's Convention of Human Rights & the EU's European Commission.

First topic on the agenda: biometrics for visitors.

Or was privacy only guaranteed to European Citizens?

Re:Human Rights or European Citizen Rights?

[owlnation]

Sigh...

No-one ever gets this right. Including the summary of this article.

The Convention of Human Rights and Fundamental Freedoms, is a document of The Council of Europe.

It has NOTHING WHATSOEVER to do with the European Union. This is not the same organization, despite having SIMILAR membership, and the word Europe in the title. In fact, not all Council of Europe members are actually European -- Turkey for example.

Re:Human Rights or European Citizen Rights?

[flyingsquid]

Apparently not, what with all of the cameras in the UK (some of which talk back).

Quit your complaining. Didn't the government just raise the chocolate ration by 20 grams?

Prevent your printer from being registered

[wwphx]

1. Do not buy from the manufacturer.
2. Maybe pay cash when buying printer.
3. Do not send in warranty card.
4. Don't let a factory rep or facility service it.

If you can prevent the printer's serial # from being tied to your identity, you should be OK. Of course, some of the very high-end printers can only be bought from the manufacturer or a registered VAR, so don't use those types of printers for nefarious deeds.

I don't know about printers, but apparently with Canon digital cameras they will register the camera serial number with your name if you send it in to Canon for service.

Re:Prevent your printer from being registered

[corsec67]

And you need to make sure you never print anything that can be tied to to if you send it to the government, like a tax return.

Re:Prevent your printer from being registered

[MrMacman2u]

I am a printer technician for Canon, Xerox, HP, Lexmark, etc... I deal with thousands of printers, both color and black and white.

1. Every color laser printer made in the last 10 years from every manufacturer that I have ever encountered uses the "yellow dots" tagging.

2. You have 300-12k hanging around in cash? Go for it.

3. You're not going to take advantage of the "get out of jail free" card the absolves you from a 300-1000 dollar repair for one year. Other than that, this may prevent your identiy from being tied to your shiney new printer.

4. Goooooood luck. When it breaks, you need someone to fix it or you will be dumping a ton of cash out fairly often for new machines.

I'd like to know why this is such a big deal to individual people first off. This system has been in place for more than a decade in most machines and no one has ever said anything before, nor, I believe, has it ever been used to screw someone over OR catch a criminal...

Am I saying I agree with the practice of tagging every page? Heck NO! I've never liked the idea since they introduced it originally, I believe, to prevent people from using high end laser printers to counterfiet money and if they did, to trace it back to the one(s) responsible.

To my knowledge, it's never been used as such. I implore someone to prove me wrong if I am.

The only ones that should be even overly concerned (aside from wasted toner and unneeded wear and tear on printing components) is large companies or government institutions.

This whole issue is not a major one. It's more of an annoyance that would be nice if it was removed.

P.S. - If you can get some, print a color page on black paper (preferably semi-gloss), the dots stand out really well... failing that if you have a large high volume printer available with a transfer belt easily veiwable, start a 4 page print job and pop the cover halfway through to force it to jam, the dots are sometimes (depends on the model and stage of the imaging process) very visible on the belt.

Re:Prevent your printer from being registered

[ntk]

You're not likely to hear how who was affected by this, for the same reason that it's been almost unknown to the consumers buying your printers for the last decade: it's been convenient to keep this "feature" of their purchases secret. Or do you think that if the US government and manufacturers had publicly announced their agreement, there would have been a calm acceptance by Americans of the importance of paying for a system to invisibly watermark their own printouts?

I'm glad that your primary concern is large companies and government institutions. As I wrote in the EFF Deeplink, our concern includes dissidents working in authoritarian regimes who remain ignorant about this feature of the technology they use to spread their work, and the authoritarian governments intent on tracing and suppressing their citizen's literature and information sources -- who are not so ignorant.

Do you think the printer companies would proudly mention if their tracking technology was used to catch these undesirables?

find the dots

[gEvil (beta)]

If any of you have a blue LED (like those found on keychain or pen lights), you can fairly easily see the pattern of dots on a color laser printout (like anything printed in color from Kinkos).

"human right to privacy"

[TheGratefulNet]

I love the sound of that.

however, in today's terror-terrorized (is that a new expression?) world, there IS no more 'right to privacy'.

I wish there was! but even in europe, there really is not a right to privacy.

even in the US constitution, is there ANY real clauses that talk about right to privacy? other than illegal search and seizure (which has been bastardized into 'we can invade your house and do a sneek-and-peek anytime we SAY so') - there is no right to privacy.

it should be added as a fundamental right, but I don't expect it anytime soon. too much power is gotton by violating your privacy. power is addicting and so the gov won't ever give THAT one back. horse has long left the barn..

Re:"human right to privacy"

[sconeu]

even in the US constitution, is there ANY real clauses that talk about right to privacy?

Please see Amendment 4, Amendment 5, Amendment 9 and Amendment 10.

Tag badsummary.

[CSMatt]

In short, most color printers print small yellow dots on every sheet in a code that identifies the printer and, potentially, its owner. Every instance I've heard of this involves color laser printers. AFAIK color inkjet printers don't do this.

Re:Tag badsummary.

[ddrichardson]

The idea is to prevent someone from printing $100 bills/IDs/etc on their printer.

Yes but that doesn't mean that it could not be used by, say an agency that wishes to monitor who is distributing political leaflets for example. Looking at the US from the outside, freedom of speech and the press are wonderful - it seems that your government is accessing more and more ways to check how you are using those freedoms.

regardless...

[owlnation]

while they do not violate any laws, secret printer tracking dot codes may violate the human right to privacy guaranteed by the EU's Convention of Human Rights and Fundamental Freedoms.

Nevertheless, in the UK it's probable that such codes will become not only permissible, but compulsory. After all, how might terrorist propaganda be traced to its source otherwise?

I'd like to think the above paragraph is a joke. But it's not. Night is falling on the UK.

EFF Code Cracking Guide

[milsoRgen]

The EFF has some handy dandy info on this very subject, http://w2.eff.org/Privacy/printers/docucolor/

Re:Confusing the code

[corsec67]

Even worse, what if you took a printer that doesn't print the codes, and got someone else's printer code, and printed that on the page?
Good way to frame someone?

"This must have come from your printer, the serial number is embedded in the page"

Nobody noticed...

[Poodleboy]

Doesn't anyone notice that the EU's "official statement" was released as a .DOC file? So, if I'm a citizen of the EU, I have to pay money to Microsoft to participate in my government?

What's worse is that we're so inured to this sort of thing, nobody even noticed!

Fenestrae delendae sunt.

What about digital cameras?

[MoxFulder]

Are there any digital cameras that watermark photos with identifying information? So that if you take a photo and post it on the internet, the manufacturer/government could track it, even if you strip out the EXIF data?

I'm curious...

Re:What about digital cameras?

[Bandman]

I don't remember which models were supposed to start it, but Canon has a couple that are going to scan your eye and "encode" that information into the photo. They claim it's so you can protect yourself from IP infringement.

Re:What about digital cameras?

[ColdWetDog]

You're looking in the wrong place. Said data wouldn't be in the image portion of the file for the abovementioned reasons. You would store it in the metadata section (see, for example the EXIF section of wikipedia. In fact, camera makers typically place serial number and actual shutter actuations in the EXIF section which could make it trivial to figure out if a particular camera took a particular shot.

Of course, EXIF is a pretty open standard and there exist numerous utilities to strip the data out when desired. You very well might not want everyone on Flikr to know the serial number of your camera. There is also a "Maker's section" where the camera manufacturers can place non standard, obfuscated and / or encrypted data.

Both Canon and Nikon use these features to create a system to prove that a given camera actually took a given picture. So it can go both ways depending on how you have your tin foil situated.

Re:What about digital cameras?

[Applekid]

There has been some research done in this area. It's not really intentional, but the nature of the CCD sensors. When they're made, they have a target count on how many megapixels it has and not all of them (at least short of research labs) are functional.

Sometimes you can see specifications like "12 Megapixels, 11.1 effective".

These defects are scattered among the surface of the CCD and are statistically unique from one camera to another, even among the same model. While the photos often aren't saved in raw formats, I'd wager if they find a picture of something illegal and wanted to prove your camera took the picture, it'd be trivial to take some pictures with it and match the output files' flaws even with the JPEG encoding by using a control camera of the same shot.

Like how they do ballistic analysis by finding a suspect's gun and fire off a few rounds and compare with rounds found at the scene of a crime.

Re:What about digital cameras?

[joostje]

aptitude install exif
exif pict7801.jpg

There you have the non-binary exif information.

No big deal

[PPH]

All of the documents produced in our office have a large brown ring stamped on them that can be traced back to the coffee mug of the engineer that produced them.

Re:Privacy is over-rated.

[BlueParrot]

There are a couple of differences between license plates and this.

a)The license plates are clearly visible, while the printer code is intended to be unnoticeable by the user. I.e, most users don't even know they are being tracked.

b)When you drive your car you are using public infrastructure, such as the roads. In many countries there is no obligation to have license plates on a car you only use in a private space.

c) The license plate identifies one particular car, not [necessarily] the factory that made it. The printer code identifies the printer, not the paper it is on.

I'm sure there is more, but clearly the parent post is just another example that car analogies suck.

TRAITOR

[DrSkwid]

If you've known about this since 1997 why didn't you tell anybody ? The EFF only started working on it in 2005

> I'd like to know why this is such a big deal to individual people first off.

Because some of us actually organise against the machinations of the state, perhaps you've heard of extraordinary rendition the US govt. has been doing or the 30,000 Argentines who were disappeared between 1976 and 1978 for opposing their govt.

It is extraordinarily naive of you to think that having previously secret (thanks in part to YOU) invisible identifying marks on every document printed from your printer isn't a cause for concern.

Re:Similar technology in scanners/copiers...

[Muad'Dave]

And another fascinating one: http://www.cl.cam.ac.uk/users/sjm217/projects/currency/

virtual MOD points.

[JonTurner]

Best suggestion yet.
Yes, in theory adding random dots would introduce noise into the signal and potentially degrade it to the points it's no longer useful, but only if you can interfere with the pattern. Put another way, unless you know the location of the dot codes, to reach the level of noise necessary to obscure you'd have to cover the page; there would be so many random yellow dots so as to be perceptible.

Blue Light Special

[AJWM]

P.S. - If you can get some, print a color page on black paper (preferably semi-gloss), the dots stand out really well

They stand out just fine on white paper under blue light, as one of the EFF pages illustrates.

1. Every color laser printer made in the last 10 years from every manufacturer that I have ever encountered uses the "yellow dots" tagging.

Then I guess you haven't encountered HP 4500 or HP 8500 series printers (maybe they don't need to be repaired as much?). One of the other EFF pages lists a number of other printer models that don't use yellow dots (which isn't to say that they don't use some other kind of tagging).