EFF reverses color laser printer fingerprints

blue led

The EFF has broken the tracking code for the Xerox DocuColor. The DocuColor prints a faint 15×8 grid of yellow dots on every page. To see these dots you need a magnifying glass. You can also use a blue light to make the dots appear black. The EFF page has a built in application for decoding the dots which hide the time, date, and serial number of the printer. The EFF also maintains a list of printers which do or don’t have this “feature”.

Andrew “bunnie” Huang helped out a lot with this research. To speed up analysis of submitted printer samples he modified a scanner to use blue light. The scanner does a white balance calibration before each page scan so the blue lights need to be turned off during that period otherwise the scanner will compensate. bunnie also opened up his HP 2600N to determine where the watermark was implemented. Studying the boards he decided that most color laser printers are probably using Canon engine boards. By coercing one manufacturer the government was able to get watermarking into a majority of the laser printers sold.

[via BoingBoing]

38 thoughts on “EFF reverses color laser printer fingerprints

  1. I was previously unaware of such fingerprinting. Is this included solely for the purpose of being able to track a particular document to a particular printer and moment in time? Have the fingerprints ever been used in a conviction?

    My tinfoil hat is as tightly secured as anybody’s so if I can stay away from printers that will refuse to disavow any knowledge of my actions, I will.

  2. i indeed have a printer with the dots, but my question is, and i will have to find a blue light or a magnifying glass to check, is will it print these dots while printing black and white? There is a mode with the HP’s to print all color as black and white and it significantly speeds up printing (doesnt rotate all the color drums to the paper). Think they put a way to print these dots in for that case?

  3. Wtf is with you people and the need to say FIRST! its ridiculous. You dont even have anything to say, you just want to be at the top of the pile. Reminds me of kids in kindergarten who ran to be first in line.

  4. I think the primary push behind the fingerprinting was to deter against counterfeiting of American currency, since ostensibly these machines are sophisticated enough to print something believeable if you have access to cotton paper. You may also notice that the new $20 bills have an “anti-piracy” patten on the back; Photoshop is supposed to prevent you from editing pictures with that 5-circle pattern.

  5. Poster #5 (brandon) hit the nail on the head. At my work we have this crazy high tech Imagistics document station (printer, scanner, photocopier, etc. on steroids). Before the guy at my work bought it he went to see a demonstration of it, and they explicitly warned everyone to tell their employees not to try to counterfeit money with it, because it would be traced directly back to the individual printer. Guess this is how they do it.

  6. put the tinfoil hats aside for a moment and think. 90% of us buy our printers via the huge electronic superstores a la Best Buy. even under the assumption that printer manufacturers keep track of serial numbers, consider the extreme difficulties in tracking down a person who purchased printer X in cash at one such retailer. outside of the market buying printers for home use, we can primarily assume businesses are playing the role of consumer. even then, these devices are sold routinely through resellers, auctions, asset liquidations, ebay, etc. those truly concerned with privacy need not bypass the tracking system of their printers; they must merely practice some intelligent purchasing. that said, this becomes a nonissue – albeit one that is annoying and foreshadows the further erosion of privacy in the future.

  7. If you were counterfitting money, couldn’t you just get rid of the one bill that would print with the pattern on it?

    If you know it’s there, it’s not a big deal, right?

  8. Steve, If newegg tracks what your serial number is on many of the items they sell, it probably wouldn’t be that hard for best buy to do the same without telling you. At least newegg lets me know they have my SN# on my wrt54g instead of doing it behind my back.

  9. oddsends: while your point is well taken, my intent was to say that it is *possible* to skirt serial # tracking; the purchase itself can be anonymous, thereby breaking the link between the serial and your name. by all means hack your printer hardware. for most, however, that wont be necessary.

  10. Since most of us are presumably not using our printers to commit crimes, yeah…

    I guess the real issue here is what jwstolk mentioned: hacking the drivers to alter the dots. Or would the dot code be burnt into a ROM somewhere inside the printer? Whichever, there’s gotta be a way to alter or remove the fingerprinting. So who will be first to find it? ;)

  11. These are primarily business copiers with service contracts. The service and supplies are tied to the serial number. Also, if you try to copy US currency from the glass, it will lock up the machine and only a technician can fix it.

  12. Steve, your cash purchase would not provide anonymity, on the contrary it would provide them with a decent quality photo of the buyer.
    Okay, for example, Mr. eye spy goes to the store and pays cash. Mr Big brother examines the fake cash, ransom note, anti gov.t flier, or whatever, recovers the serial #, then uses that# to easily find out what city, what exact store. He can the contact the store, which tracks and keeps records of the EXACT times of all purchases, especially high value, serial# items.(check your receipt for the time the next time you buy something) Using that time, all they have to do is review all digitally archived video/still footage for that time frame and wallah! great shots of him and whoever he was with. If the man is really having a good day, he’ll get great pics off the parking lot surveilance cams, getting the make and model of car, and possibly even the license #.

    Being on this site, I would assume that you know buying things anonymously on the web(ebay for example) is not as easy as people think.
    The ORIGINAL purchaser will be tracked down, then grilled till he gives up the identity of the buyer, then other owners in the chain of custody will be grilled for who they sold it to, if the final purchase was on ebay, they have ALL your (sorry, his) ID info. Unless you went to the huge trouble of using a fake name, then applying for a credit card & checking acct# for this name. Which would be kinda difficult as the alias probably wouldnt have a valid SS# or credit rating. Im not trying to be argumenative here, just trying to show that there are ALOT of ways to track and find people.

  13. Steve,
    Even if they can’t track the serial to you via payments. Homeland security can search anyone’s home for practically no reason at all nowadays. So if they did have any reason so suspect that a person did something if they search there home and find the printer with that serial there cought.

  14. I wonder how well this would hold up as evidence in a court of law. Real fingerprints are useful only because they can be more or less conclusively attributed to an individual, but it would be difficult to prosecute someone using printer tracking codes as evidence if you can provide a reasonable argument that they can be faked.

  15. #20: indeed… There is even cases where DNA is not being proved viable since they mixed it up with other samples, or where DNA is not exclusively from exact the same person. More cases where the laboratory screwed the samples are provided. So the chance that a laboratory screws up is to huge to rely on DNA.

    So, if people can tinker with ‘fingerprints’ and the like, one cannot use it as proof. But if the judge has his/her day, you can’t go anywhere because they don’t want to look in to it for so much detail of technology etc. The theory exists to commit the perfect crime, but judges don’t want to take it that far. They rather use common sense than a tin foil hat.

    – Unomi –

  16. It wouldnt have to hold up in no court of law as evidence. Its main purpose would be a tool to track you down and identify you. Once your caught, your caught. If your really guilty,(and sometimes if your not) There will be enough evidence found to finish you off. if anything, the savvy agent who sniffed you out would keep the dot matrix encoding procedure strictly confidential and would not disclose how he caught you in order to ensure future useability of the dots to catch others!

  17. #22, you’re assuming this is handled in the driver. In my mind, it makes no sense what-so-ever to put the encoding in the driver. It assumes that the port has bi-directional capability, which is NOT a given for parallel ports.

    I would assume that it’s done in ROM (or more likely FLASH), so that regardless of the image printed and regardless of what colors were where and in what channel, that the image could be printed.

    Further more, I’d make it smart enough that if yellow dots of the same color were printed where the serialization dots are, that a guard circle would be placed around them by changing the colors in the guard circle slightly. There’s a bunch of ways to make sure the serialization is printed and is readable.

    I would sooner put a piece of tape or Post-It Note(tm) over the known area where it would print the pattern. Or better yet, don’t buy a printer with a Canon engine.

  18. steve,

    the tracking isn’t necessarily “who bought the printer”. frequently the tracking is historical. when the secret service is investigating counterfeit money, they’re going to tally up all the data on the crime: the bill denomination, serial number of the forged bill, serial number of the printer, date, time it was printed, location it was spent, person turning it in, person passing the bill, everything. Then they correlate the data: how many bills were produced by the same printer, geographic center of where those bills were spent, all kinds of things to try to discover a pattern.

    something to keep in mind is you might have a counterfeit bill in your pocket right now — possibly received in change from a poorly lit restaurant or bar. (another place local counterfeiters have been known to spend them is yard sales!) if you spend that money, you will have unwittingly committed a crime.

    (side note: a buddy got stopped at a burger king by the cashier for trying to pass a $20 bill. he had received it in change the night before at a really dimly lit bar. the funny thing is it was printed on a dot-matrix printer! the cashier didn’t call the police but gave the note back to him. he went back to the bar to complain, and they gave him his real money back.)

    if you are caught spending that money, you are likely to be investigated by the police. first, they’ll check for dots on the phony bill. if it traces to a printer they can located, (for example a leased printer at a business that has registered the serial number) then it’s easy: they will check to see if you have access to it. if you own a printer, they’ll ask to run a test page from it.

    spending (or trying to spend) one phony bill that you probably didn’t produce isn’t likely to land you in prison. passing a dozen phony bills, or a single phony bill produced on your own printer will earn you something like five years room and board at a zero-star federal resort.

    the moral of the story is: the secret service takes counterfeiting very, very seriously. it’s not something you want to be a part of, ever.

  19. guys you r all in big mistake! i dont know do u know some facts about micro$oft but, they can actualy print stuff on any printer on the world that is connected to a computer which uses windows and internet… so guess what! try doing something iligal and next thing u know is counting the width of a small romm (prison cell)…

  20. jaded, (#27 and others), i must emphasize that i was not in any way attempting to condone counterfeiting. At best its an idiotic idea and a “vocation” that any honest person should completely avoid. With that being said, and in response to other comments above:

    I do agree that personally paying in cash for a printer could result in your likeness being captured by camera at your neighborhood electronics superstore. However, my main point was (in my original post) that there is/are weakness(es) inherent in the system regarding the association of an individual with the serial number of a printer. First, printers can be purchased in cash. Cash is, in large part, ompletely anonymous. If you’re paranoid enough to be worried, then by all means wear a disguise, buy it by proxy, put latex over your fingertips, or just go right ahead and hack the capability out of your printer. If you can find an electronics store that archives its video footage indefinitely AND cross references it to individual purchases, do tell me about it, because thats rather disturbing. I think though, you will be hard pressed to find such a place. Likewise, I will congratulate the law enforcement if they are thorough enough to collect examples of paper from an individual’s printer. The fact that a detective even KNEW about such printer fingerprinting would be impressive. If you’re dumb enough to commit a crime using a traceable device, then by all means you deserve your due punishment.

    But I digress.

    Other channels of relatively anonymous purchase do exist (enumerating them I leave a challenge for any readers), and those determined to disassociate their actions from their identity have found and will find ways to do so.

    The central issue of this whole mess is simply the fact that such fingerprinting exists – included in devices upon government request. Government by definition is intended to be supportive, not subversive. Ponder the transgressions of that for a while.

  21. They dont have to cross reference footage to indiv purchases. All they have to do is refrence the time of the purchase and check footage for the moron with the large box w/printer in it. he wont be hard to spot. The reason serial#s are coded into the receipt is so people cant make fraudulent returns with similiar store items. Also the big box stores these days have alot higher dig. data storage capacity than they used to. Especially with systems set to lower # of frames per min. Similiar to atm cams but alot better res. and larger view field. Also, law enf would not have to collect “samples of paper”, or anything else for that matter from an indiv.s printer. Once they procure the mystery document in question, its analysed for serial info and the trace begins. If it came down to it, they could probably get a sheet from the guilty printer, but likely they wouldnt need it until later. While ‘detectives’, as you say would likely not know about this id method, were not exactly talking about your regular donut eating run of the mill gumshoes here. Its inconcievable to think that the govt could come up with such an elaborate i.d. scheme and the proper domestic intelligence and elite investigative agencys just not know about it.

    Now enough of that. In my opinion this devious encodement scheme would most likely not have
    been approved as easily without all this new pariot act bullshit enacted. As this pretty much gives them license to do pretty much anything they want, its almost guaranteed to go on alot more models of printers in the future. You all Are so focused on just counterfeiting, but forget that because any letter, document, or illustrations etc. will be encoded, many other applications will arise for covert surveillence of the public and the tracing of documents, letters, drawings etc. with any type of red-flagged material.

    For example, subject b is arrested and the obligatory house search/ransack is performed. Agents a and b find a particularly juicy receipe,picture, or whatever and desire to know its origin. Its analyzed and serial # traces to subject b’s best buddy, subject a.
    (also possibly by warantee registration), who Share private info with each other but certainly dont trust any type of email for privacy, so they print cool stuff for each other and share it whenever they hang out. Not only is mr. a screwed, but he will most likely strongly suspect that his buddy snitched on him. as 99.99% of the computer literate population likely has no idea about this.
    My guess is stories about this will stay out of the mainstream media for a while.

  22. If you have image editing software and a scanner, there is no need to do all the blue light/magnification trickery. Just scan the page (or a small portion of if), convert the RGB scan to CMYK, darken the image and increase the contrast, then view only the yellow channel. you’ll see that the dot pattern is easily recognizable.

  23. For the people posing the “camera big brother” scenario, I’ve got one word for you…. Hat. Most all of the cameras in major retailers (best buy included) are “sky cams”. Something as simple as wearing a ballcap will mask your face quite well, assuming your not dumb and look up at the cameras. As steve put it, there are TONS of ways you can get around having your identity known at the time of purchase… Even waiting a while before using the printer would work, as NO place has infinate storage for survailence. It’s not cost effective to them. They would rather take your few bucks, and send you on your way. What does best buy have to gain from the cops/fbi coming in, raiding their data, etc.. They make no money off of it, so why would they spend money keeping these records for so long? Especially if it’s going to put them in the spotlight media wise. (In a negative light)

    Dean, your scenario…..If someone was serious about counterfitting, why would they ever use that printer to print out a recipe and give to a friend, knowing this mark exists? Honestly, the people who get caught at this stuff are the people who are stupid enough to make mistakes like that… It’s not the mark that got them caught, it’s their stupidity. Not saying I’m going to go out and counterfit some bills, just posing some flaws in the theories posted here.

  24. Dude you dont know shit.
    Recently, when the Marion county Sherrifs and the temple police were trying to build a case against Deborah Lafave for having sex with that boy, it came to light that they were at a best buy together buying an ipod years ago. When the investigators found this out they got footage from the archives of that store showing them together, and used the film as official evidence in court. Ive seen some of those pics theyre pretty good. Shes wearing a sexy dress and hes further up talking to his friends. Theyre not some fucking ‘sky cam’ bullshit, theyre set low enough that no hat would hide your face. If you dont believe me do an internet search on the case evidence. its not hard to find.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.