How a few yellow dots burned the Intercept’s NSA leaker

[EC]

Ars Technica
248

When reporters at The Intercept approached the National Security Agency on June 1 to confirm a document that had been anonymously leaked to the publication in May, they handed over a copy of the document to the NSA to verify its authenticity. When they did so, the Intercept team inadvertently exposed its source because the copy showed fold marks that indicated it had been printed—and it included encoded watermarking that revealed exactly when it had been printed and on what printer.

The watermarks, shown in the image above—an enhancement of the scanned document The Intercept published yesterday—were from a Xerox Docucolor printer. Many printers use this or similar schemes, printing faint yellow dots in a grid pattern on printed documents as a form of steganography, encoding metadata about the document into its hard-copy output. Researchers working with the Electronic Frontier Foundation have reverse-engineered the grid pattern employed by this class of printer; using the tool, Ars (and others, including security researcher Robert Graham) determined that the document passed to The Intercept was printed on May 9, 2017 at 6:20am from a printer with the serial number 535218 or 29535218.

The results from inputting the dot pattern from the NSA leak into EFF's tool show when and where the page was printed.
Enlarge / The results from inputting the dot pattern from the NSA leak into EFF's tool show when and where the page was printed.
Armed with this evidence, the NSA was able to quickly determine who had printed the document by checking audit logs. NSA investigators quickly narrowed it down to Reality Leigh Winner, a 25-year-old contractor for Pluribus International Corporation, a company that provides analytical, translation, and cyberwarfare development services to the intelligence community. Winner was working at the NSA's Fort Gordon, Georgia facility. Her identification was apparently aided, according to the Justice Department's arrest warrant affidavit, by her contacting The Intercept from her work e-mail:

More: https://arstechnica.com/security/2017/06/how-a-few-yellow-dots-burned-the-intercepts-nsa-leaker/

[Oceander]

What a moron. She's working on top secret stuff and she doesn't even bother to wonder if things like printouts are traced?

[INVAR]

We can bet the farm that she is not the ONLY Obama-era 'hate Americanista' employed in the government or it's agencies that is willing to hand over intel to enemies like Iran.

[DB]

Whomever hired her and was her boss should be fired too. She had no business entering the building even as a janitor.

[mountaineer]

We can bet the farm that she is not the ONLY Obama-era 'hate Americanista' employed in the government or it's agencies that is willing to hand over intel to enemies like Iran.

My husband's nephew - a high school dropout - worked for some sort of government contractor a few years ago, and he was a big Palestine supporter. His uncle (on the other side of the family) was a big wheel at Jimmy Carter's pro-Hamas organization, and the kid had traveled to the Middle East, including Syria. Apparently, no one noticed. I only hope he didn't have a top level security clearance. Thankfully, he doesn't work there now. We think he's moved on to dealing drugs in Missouri. 

[DCPatriot]

My husband's nephew - a high school dropout - worked for some sort of government contractor a few years ago, and he was a big Palestine supporter. His uncle (on the other side of the family) was a big wheel at Jimmy Carter's pro-Hamas organization, and the kid had traveled to the Middle East, including Syria. Apparently, no one noticed. I only hope he didn't have a top level security clearance. Thankfully, he doesn't work there now. We think he's moved on to dealing drugs in Missouri. 

...made me spit out my coffee!   

[EC]

My husband's nephew - a high school dropout - worked for some sort of government contractor a few years ago, and he was a big Palestine supporter. His uncle (on the other side of the family) was a big wheel at Jimmy Carter's pro-Hamas organization, and the kid had traveled to the Middle East, including Syria. Apparently, no one noticed. I only hope he didn't have a top level security clearance. Thankfully, he doesn't work there now. We think he's moved on to dealing drugs in Missouri. 

Now, now. Don't begrudge the man his promotion.

[mountaineer]

He tells his mother he's in the graduate accounting program at UMKC, even though they have no record of anyone with his last name ever attending there. She still believes him.