Printer Dots, Pervasive Tracking and the Transparent Society

October 18, 2011 at 11:35 am 5 comments

So far in the fingerprinting series, we’ve seen how a variety of objects and physical devices [1234], often even supposedly identical ones, can be uniquely fingerprinted. This article is non-technical; it is an opinion on some philosophical questions about tracking and surveillance.

Here’s a fascinating example of tracking that’s all around you but that you’re probably unaware of:

Color laser printers and photocopiers print small yellow dots on every page for tracking purposes.

My source for this is the EFF’s Seth Schoen, who has made his presentation on the subject available.

The dots are not normally visible, but can be seen by a variety of methods such as shining a blue LED flashlight, magnification under a microscope or scanning the document with a commodity scanner. The pattern of dots typically encodes the device serial number and a timestamp; some parts of the code are yet unidentified. There are interesting differences between the codes used by different manufacturers. [1] Some examples are shown in the pictures. There’s a lot more information in the presentation.

Pattern of dots from three different printers: Epson, HP LaserJet and Canon.

Schoen says the dots could have been the result of the Secret Service pressuring printer manufacturers to cooperate, going back as far as the 1980s. The EFF’s Freedom of Information Act request on the matter from 2005 has been “mired in bureaucracy.”

The EFF as well as the Seeing Yellow project would like to see these dots gone. The EFF has consistently argued against pervasive tracking. In this article on biometric surveillance, they say:

EFF believes that perfect tracking is inimical to a free society. A society in which everyone’s actions are tracked is not, in principle, free. It may be a livable society, but would not be our society.

Eloquently stated. You don’t have to be a privacy advocate to see that there are problems with mass surveillance, especially by the State. But I’d like to ask the question: can we really hope to stave off a surveillance society forever, or are efforts like the Seeing Yellow project just buying time?

My opinion is that it impossible to put the genie back into the bottle — the cost of tracking every person, object and activity will continue to drop exponentially. I hope the present series of articles has convinced you that even if privacy advocates are successful in preventing the deployment of explicit tracking mechanisms, just about everything around you is inherently trackable. [2]

And even if we can prevent the State from setting up a surveillance infrastructure, there are undeniable commercial benefits in tracking everything that’s trackable, which means that private actors will deploy this infrastructure, as they’ve done with online tracking. If history is any indication, most people will happily allow themselves to be tracked in exchange for free or discounted services. From there it’s a simple step for the government to obtain the records of any person of interest.

If we accept that we cannot stop the invention and use of tracking technologies, what are our choices? Our best hope, I believe, is a world in which the ability to conduct tracking and surveillance is symmetrically distributed, a society in which ordinary citizens can and do turn the spotlight on those in power, keeping that power in check. On the other hand, a world in which only the government, large corporations and the rich are able to utilize these technologies, but themselves hide under a veil of secrecy, would be a true dystopia.

Another important principle is for those who do conduct tracking to be required to be transparent about it, to have social and legal processes in place to determine what uses are acceptable, and to allow opting out in contexts where that makes sense. Because ultimately what matters in terms of societal freedom is not surveillance itself, but how surveillance affects the balance of power. To be sure, the society I describe — pervasive but transparent tracking, accessible to everyone, and with limited opt-outs — would be different from ours, and would take some adjusting to, but that doesn’t make it worse than ours.

I am hardly the first to make this argument. A similar position was first prominently articulated by David Brin his 1999 book Transparent Society. What the last decade has shown is just how inevitable pervasive tracking is. For example, Brin focused too much on cameras and assumed that tracking people indoors would always be infeasible. That view seems almost quaint today.

Let me be clear: I have absolutely no beef with efforts to oppose pervasive tracking. Even if being watched all of the time is our eventual destiny, society won’t be ready for it any time soon — these changes take decades if not generations. The pace at which the industry wants us to make us switch to “living in public” is far faster than we’re capable of. Buying time is therefore extremely valuable.

That said, embracing the Transparent Society view has important consequences for civil libertarians. It suggests working toward an achievable if sub-optimal goal instead of an ideal but impossible one. It also suggests that the “democratization of surveillance” should be encouraged rather than feared.

Here are some currently hot privacy and civil-liberties issues that I think will have a significant impact on the distribution of power in a ubiquitous-surveillance society: the right to videotape on-duty police officers and other public officials, transparent government initiatives including FOIA requests, and closer to my own interests, the Do Not Track opt-out mechanism, and tools like FourthParty which have helped illuminate the dark world of online tracking.

Let me close by calling out one battle in particular. Throughout this series, we’ve seen that fingerprinting techniques have security-enhancing applications (such as forensics), as well as privacy-infringing ones, but that most research papers on fingerprinting consider only the former question. I believe the primary reason is that funding is for the most part available only for the former type of research and not for the latter. However, we need a culture of research into privacy-infringing technologies, whether funded by federal grants or otherwise, in order to achieve the goals of symmetry and transparency in tracking.

[1] Note that this is just an encoding and not encryption. The current system allows anyone to read the dots; public-key encryption would allow at least nominally restricting the decoding ability to only law-enforcement personnel, but there is no evidence that this is being done.

[2] This is analogous to the cookies-vs-fingerprinting issue in online tracking, and why cookie-blocking alone is not sufficient to escape tracking.

To stay on top of future posts, subscribe to the RSS feed or follow me on Twitter or Google+.

Entry filed under: Uncategorized. Tags: , , , , .

Everything Has a Fingerprint — Don’t Forget Scanners and Printers An Update on Career Plans and Some Observations on the Nature of Research

5 Comments Add your own

  • 1. Shashank Pathak  |  October 19, 2011 at 3:09 am

    This is extremely interesting read, thanks to insightful author. In the core of this issue, lies (IMHO) the dilemma of having a distributed power and distributed responsibility. Practically and often so, both the sense of power and the sense of responsibility dilutes with increasing number of participants. Like in AI enabled robotics (which is my field of research), our basic assumption is our hope on justice of a distributed system as a whole.

    Reply
  • 2. David Brin  |  October 21, 2011 at 5:04 pm

    Remarkably intelligent and balanced commentary.

    I am vociferously against allowing elites this kind of tracking power without extorting in return fresh supervisory authority and power for the people. The two must go hand in hand, systematically.

    With cordial regards,

    David Brin
    The Transparent Society: Will Technology Make Us Choose Between Privacy and Freedom?
    http://www.davidbrin.com
    blog: http://davidbrin.blogspot.com/
    twitter: http://twitter.com/DavidBrin1

    Reply
  • 3. Michael Rogers  |  December 3, 2011 at 4:27 am

    Hi Arvind,

    I entirely agree that we should push for greater transparency from those who conduct surveillance, but I don’t agree that it’s in any way inevitable that the falling cost of surveillance will ensure that it becomes ubiquitous.

    Cost isn’t determined by technology alone. To make a rather melodramatic analogy, bullets are cheap, but the social cost of shooting someone is extremely high, because we as a society have chosen norms and laws that make it so. If we choose to pass strong laws controlling surveillance by governments, corporations and individuals, and to spend money enforcing those laws, surveillance can remain expensive.

    Limiting surveillance isn’t incompatible with requiring transparent surveillance – in fact the legal powers required would be similar. European data protection laws offer one possible model for such powers.

    Cheers,
    Michael

    Reply
    • 4. Arvind Narayanan  |  December 3, 2011 at 7:08 pm

      Michael,

      That’s a great point. There is certainly room for different views on whether we’ll manage to stop ubiquitous tracking. Time will tell.

      But let me note that my argument for inevitability is based not merely on cost, but on the commercial benefits of tracking as well. That is where the bullet analogy falls apart.

      Reply
  • 5. peter kovas  |  May 23, 2012 at 3:54 pm

    now we know which printers.

    http://miami.typepad.com/springyleaks/2012/05/foia-release-names-spy-printers.html

    Reply

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Trackback this post  |  Subscribe to the comments via RSS Feed


About 33bits.org

I'm an assistant professor of computer science at Princeton. I research (and teach) information privacy and security, and moonlight in technology policy.

This is a blog about my research on breaking data anonymization, and more broadly about information privacy, law and policy.

For an explanation of the blog title and more info, see the About page.

Subscribe

Be notified when there's a new post — subscribe to the feed, follow me on Google+ or twitter or use the email subscription box below.

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 202 other followers


Follow

Get every new post delivered to your Inbox.

Join 202 other followers