Today, The Intercept released documents on election tampering from an NSA leaker. Later, the arrest warrant request for an NSA contractor named “Reality Winner” was published, showing how they tracked her down because she had printed out the documents and sent them to The Intercept. The document posted by the Intercept isn’t the original PDF file, but a PDF containing the pictures of the printed version that was then later scanned in.
The problem is that all new printers print nearly invisibly yellow dots that track down exactly when and where documents, any document, is printed. Because the NSA logs all printing jobs on its printers, it can use this to match up precisely who printed the document.
In this post, I show how.
You can download the document from the original article here. You can then open it in a PDF viewer, such as the normal “Preview” app on macOS. Zoom into some whitespace on the document, and take a screenshot of this. On macOS, hit [Command-Shift-3] to take a screenshot of a window. There are yellow dots in this image, but you can barely see them, especially if your screen is dirty.
EFF page and manually click on the pattern so that their tool can decode the meaning:
The situation is similar to how Vice outed the location of John McAfee, by publishing JPEG photographs of him with the EXIF GPS coordinates still hidden in the file.
Printers have two features put in there by the government to be evil to you. The first is that they recognize a barely visible pattern on currency, so that they can’t be used to counterfeit money, as shown on this $20 below:
The second is that when they print things out, they includes these invisible dots, so documents can be tracked.
While I was writing up this post, these tweets appeared first:
oh wow, @knowtheory just pointed out the microdots on the first and late page of the intercept’s docs. printer dots kill puppies, folks. pic.twitter.com/w8qxJ9zvhf— Quinn’s internet (@quinnnorton) June 6, 2017
The date in the microdots is 6:20 2017/05/09 from a printer with serial number #5429535218, according to https://t.co/PVVm7AAjlL pic.twitter.com/6BY7Y3MFhL— Tim Bennett (@flashman) June 6, 2017