Suspect in NSA Leak Identified Thanks to Hidden Watermarks

Via Wikimedia Commons.

Packaging Perspective: With increasing interest in track and trace capabilities, specifically in pharmaceutical packaging, it's interesting to see the technology being used in other markets. In case you were wondering about the merits of hidden watermarks and traceability, last week's revelation as to the suspect in the leak of classified documents was possible due to watermarking on the Xerox DocuColor.

Reality Leigh Winner is in hot water thanks to a Xerox DocuColor printer, according to ars Technica, part of the Wired Digital Group, Vice News and other news sites. In May, Winner — an independent NSA contractor with high-security clearance — allegedly anonymously sent classified documents to The Intercept about the Russian hacks during the 2016 U.S. presidential election. The alleged documents were printed on a Xerox DocuColor and sent to The Intercept. What the sender may not have known is that many printers use encoded watermarks — called steganography according to Lifehacker — that work as a way to track printed documents back to a specific device.

Vice News reports that after the documents were received, The Intercept approached the NSA to verify the documents' authenticity, and 48 hours later the FBI issued a warrant for the young woman's arrest. The news site goes on to report that the NSA knew the documents had been printed because they “appeared to be folded and/or creased, suggesting they had been printed and hand-carried out of a secured space.”

How Did the NSA and FBI Connect the Dots?

The Washington Times reports that the government conducted an internal audit that was able to narrow the investigation down to six people who had accessed the report after it was released in May. Winner was among those six individuals and apparently admitted to printing the classified documents when interviewed by the FBI.

Steganography works by printing small yellow dots in a pattern that can be decoded to reveal exactly what day and at what time a document was printed, as well as the serial number of the printer that was used. The Electronic Frontier Foundation even created a tool to decode the dots printed by the DocuColor. However, as Vice News reports, if the documents had been printed in black-and- white and not color, the watermark would not have been revealed, although Winner still would have been one of the six suspects.

The Post also cites a blog posted on June 5 by Errata Security Founder Robert Graham who reviewed the file. He wrote:

The document leaked by The Intercept was from a printer with model number 54, serial number 29535218. The document was printed on May 9, 2017 at 6:20. The NSA almost certainly has a record of who used the printer at that time.

If convicted, Winner could face up to 10 years in prison for her indiscretion. According to NPR, winner plead not guilty at her June 8 hearing in Augusta, Georgia. Winner was denied bail because prosecutors suggested that she could have other classified documents in her possession, NPR reports. NPR continues:

A federal grand jury had indicted her on one count of 'willful retention and transmission of national defense information.' In legal documents, an FBI agent stated that Winner had admitted to printing the classified information and mailing it to an online news outlet.