For twenty years, many color laser printers have included a hidden tracking code on each page they print. Made of microscopic yellow dots, the code can reveal to the police the unique identity of your printer.
An example of the yellow-dot tracking pattern
The EFF and others have reverse engineered a few of these codes, shedding light on how the system works technically.
What they have not explained is how it happened. How do twenty governments and an entire industry collaborate to build a secret tracking system, in the total absence of any public discussion?
This is an attempt to piece together the history of the yellow dots. It’s based almost entirely on government documents — some obtained from the US Federal Reserve by the Electronic Frontier Foundation, others made available by the European Union.
The response to technology is surveillance
It begins in the early 1990s. The central banks of Europe are scared. Technological change is making color printing, once limited to large-scale professional enterprises, accessible to small businesses and even homes. When color printing reaches the masses, it won’t be long until the masses begin printing fake banknotes.
The printer manufacturers are also scared. If their products become tools for counterfeiting, their entire industry might be shut down, or regulated into insignificance.
So they look for a compromise. It turns out, you
can
have both fancy printers and secure currency. The only cost is the creation of a subtle system of mass surveillance — but if you don’t tell anybody about that, they won’t complain. The yellow dots are born.
Letter from the SSG-2 group of central banks to Alan Greenspan, chair of the US Federal Reserve, 21 July 1995
To understand the document trail, we’ll need a bit of jargon. On the government side, the Europeans are running the show, through a “Special Study Group” on color copying within the
European Banknote Printers Conference
. Soon reformulated into the “
SSG-2
” to accommodate Japan and North America, this will be the clearing-house for negotiations with manufacturers. The industry, being at this point almost entirely Japanese, works through something called the Japan Business Machine Makers Association (JBMA). Non-Japanese manufacturers are also represented here, with Lexmark
reportedly
joining in 2008. The yellow dot arrangement will be called either
BITMAP
or the
Tracing System
.
A “voluntary arrangement”
The JBMA propose a “
voluntary arrangement
” – though this is clearly the kind of volunteering you do to avoid ever finding out what compulsory looks like. Each manufacturer rigs their copiers and printers to put those microscopic dots onto each page. Every year they send a list of codes to the JBMA, which compiles them for the law enforcement agencies.
This system seems to come into operation in 1993.
Some of the 23 countries who received the printer-dot decoding software
The anti-counterfeiters aren’t expected to look at fake banknotes with a magnifying glass. The manufacturers cook up something they call BITMAP – a software package to match the code to the printer. All you need is a standard PC and a scanner. And a floppy disk drive – this piece of secret spy tech comes on floppies as late as 1998. You fire up BITMAP, scan your counterfeit, and it tells you the manufacturer of the machine it was printed on.
Fingering your customers: a free after-sales service
The BITMAP software appears to only tell you the manufacturer. To find out the specific machine, you need to go to the manufacturer. “
Copier manufacturers
”, according to SSG-2, “
will continue to provide assistance in identifying specific copiers at no additional cost
”.
Working with the manufacturers
So each of the manufacturers is deeply involved in this process through the nineties. Canon, Xerox, Konica — all have a designated contact person, responsible for secretly responding to police requests to identify their customers. BITMAP comes with a list of their names and contact information, one per manufacturer.
Admittedly, not all manufacturers play along with full enthusiasm. By 1997 the SSG-2 was collecting information about which companies were dragging their feet.
Division of responsibilities — and payments – for the tracking system
One set of minutes asks members to “
let the SSG-2 Working Group know if they encountered problems with getting information front any individual copier manufacturers
”. And the US Secret Service were instructed that “
concerns with the response time for providing copier information, should be referred to the JBMA
”.
Grumbles aside, the system worked. By 1998, some 23 countries were receiving their BITMAP floppy disks from Japan.
A European model of surveillance
European countries were among the first to push for printer tracking dots, and they have continued to be enthusiastic users of the system. In 2000, Europol reported early work towards euro-centralisation of printer tracing:
Work progressed on the European Union Counterfeit Currency Situation Report, as well as on the bitmap register for the collation of information on counterfeit currency produced by traceable colour copiers.
By 2003 they had persuaded the Council of the European Union to fund a centralised printer-tracing service within Europol:
setting up a BITMAP intelligence centre at Europol. This common database should contain bitmap related information and it could serve as the Bitmap co-ordination centre in the European Union. The database shall contain the relevant (technical) data on decoded bitmap-information, investigative data including personal data of companies and persons related with the bitmap subject. EU Member States are asked to supply, in accordance with their national legislation, all existing Bitmap data to the Bitmap intelligence centre
It’s not clear how fully the Council were informed about what they were agreeing to fund. The document used the full force of bureaucratic vagueness to describe BITMAP, explaining it as being “
based on an identification of offset processes that are used, inter alia, for counterfeiting banknotes
”.
By 2009, Europol described its work on “centralising and processing” printer-tracking requests:
This service provides requesting countries with swift and relevant
information on equipment being used by counterfeiters. Europol is
also in a position to offer in-house decoding of bitmap as well as
relevant training.
The training took place extensively, with events in Brussels,
Lisbon
and Romania. Germany’s police forces are apparently Europe’s top experts on printer surveillance. The BKA, the federal police service, was intended to provide advanced (“second level”) training to the rest of Europe.
Europol’s BITMAP services have not been limited to EU member-states. According to experts within the Czech police, Ukraine and Turkey have been among the countries most frequently asking for Europol’s help. Even the Russian police received BITMAP training “
supported by instructors from the Europol’s Forgery of Money Unit
”
And by this point, Europol’s BTIMAP activities were not limited to cunterfeiting. Although the system had been developed to identify banknotes, there was no technical reason not to use it to trace back any color-printed document to the source. By 2007, Europol
were handling
more requests relating to documents than to forged Euros. This off-label was never part of the original justification of the tracking-dot system. It’s just a typical example of how surveillance tends to expand within institutions, especially in the absence of any public constraints.
Unintended Consequences
This whole history is an example of what can go wrong when small groups of experts try to solve their own problems, without reference to the wider political context.
A large-scale surveillance system was built as the solution to a technical problem. There was never any public debate, and no evidence of elected officials considering the pros and cons of the system. Senior officials were given vague descriptions of what was being developed, without enough information for them to understand its dangers.
Police and central banks, governments and manufacturers, all worked together across the world and over two decades — but at no point did anybody consider asking the public whether they wanted their printers monitored.
Some of the more important documents on the printer tracking system are:
-
Documents obtained by the EFF under FOIA
(details) -
Establishment of Europols “BITMAP Intelligence Center”
-
Discussion of the tracking system in a Czech law enforcement journal
- I’ve not talked about a parallel system, of dot-patterns that allow software to recognize — and refuse to copy — banknotes.