▲ 192 points
back
126 comments
Norwegian - google translate to English https://www-nrk-no.translate.goog/norge/nye-opplysninger-om-...
Most interesting parts (IMO):
“Program and program settings: When preparing the letter, WordPad for Windows is most likely used. Default settings for font, line spacing and paragraph are used. The page layout has been Letter.”
That, I think, can be inferred with good confidence from precisely measuring various font measurements, looking at how lines got broken, etc, and comparing that with a database of program defaults for a large set of OSes and programs.
“Device, operating system and video card : When designing the threat letter, a Windows PC has been used, with an operating system Windows 10 or 8.”
I guess either WordPad or the font got tweaked somewhat in that Windows version. Maybe WordPad started using ligatures more aggressively, its page width got a tiny bit wider, or, in the font, some letter shape or spacing table changed a tiny bit, or a character was added.
“The PC has had an integrated video card, Intel HD Graphics 630.”
That, for me, is the most intriguing part. Does Windows use the GPU to render fonts even if they get printed, and are there subtle differences between GPUs and their software rendering that, statistically, can be recovered from the somewhat noisy print?
Does Windows use the GPU to render fonts even if they get printed
Most cheaper printers (esp. on Windows) use the GDI protocol for printing. These printers only know how to print rasterised images, so the document is rasterised by the OS/Print driver and only this final rasterised image is sent to the printer. This is different from higher end PCL/PS printers where the document is translated into a page description language and the printer is (partially) responsible for rasterising the final document for print.
Since Windows uses the GPU to render fonts I wouldn't be surprised if the same code is used to rasterise the fonts for GDI printing.
That being said I'm very surprised they can identify the GPU just from that, unless there is some specific bug in the driver for the card which produces an obvious font rendering artefact.
Brilliant comment. Coming at this as a typographer/graphic artist and erstwhile coder, I'd bet it comes down to reverse engineering anti-aliasing algorithms. I'm not sure how it's done in Windows, but on Macs there are various levels of crispness you can set in default type as it's rasterized and if you zoom in a bit they have very clearly recognizable differences. Take the four bottom-left pixels of a capital A at 300 ppi, and compare their ink value ratios with different anti-aliasing techniques, and I bet you could get a signature of what card did the rasterization.
Gaussian blur is your friend if you wanna send a death note, I guess.
> unless there is some specific bug
Could also be by design, similar to printer identification dots. Have the artifacting vary every so slightly from one GPU to another. Then again, I feel (emotional statement, not of fact) that this would be known by now if it was a thing.
I was reading these comments while simultaneously trying to get some work done. I was taking a screenshot of some settings to show to a coworker for verification and immediately noticed something was off about the screenshot. It looked nothing like the screen! Apparently screenshots on Win10 with HDR is kind of funny. It looks like everything is neon. Like the standard HN orange banner looks like a yellow highlighter. Funny thing is, if I take the screenshot from my non-HDR monitor, it looks as expected.
So...evidently from a sample of me, I can tell from which monitor a screenshot was taken...
This could all be deflection. All name-brand printers (in the US at least and probably everywhere) watermark printed pages with yellow dots that identify the printer serial number. If the printer is purchased with a credit card and the SN is scanned, there is a perfect trail from your printed page to the person who bought it. I suspect if that method was used they still may want to claim these other fingerprinting methods to avoid spreading the word about printers.
One other way this trail can be made is simply by installing the drivers. For example I noticed that when you complete the driver installation for a Brother color laser printer, the installer opens the default browser and navigates to brother.com/something/SERIAL_NO_OF_PRINTER. I am assuming that on the other end they're capturing the IP, fingerprinting the browser, and logging it all forever.
Got a source for this claim?
Edit: Specifically, what about printers that only print black and white?
Color printers must do this; black-and-white printers do not (and cannot, there's no yellow ink).
> are there subtle differences between GPUs and their software rendering that, statistically, can be recovered from the somewhat noisy print?
I'm not sure these days when most GPUs are IEEE-754-compliant. But back in the mid to late 2000's I worked on a GPU renderer for video editing and we had a few filters that gave noticeably different results on different GPUs. One filter did a hard black and white threshold, then blurred the result, did another hard threshold, etc., in a loop. Because of differences in precision of the floating point values (24-bit on AMD at the time, if I recall correctly), the thresholds could produce minor differences that got magnified by the blurring, and then created new thresholds with minor differences, etc.
Even if all the GPUs are using IEEE-754 floats, there are driver differences that can cause the results to be slightly different, too. Like a simple GLSL mix() function could be implemented as result = x * a + y * (1 - a) (where x and y are 2 input pixels and a is the alpha of x). Or it could be implemented more efficiently as result = a * (x - y) + y. Doing the same math in a slightly different way can sometimes lead to slight differences in intermediate results which compound in the final result. So yeah, it may be possible to tease out some of these things by examining something like font rendering.
This is unrealiable and extremely risky to serve as case evidence.
Becomes extremely easy for malicious actors (out or inside the police) to fake evidence and frame anyone they'd like.
That seems to be the norm with a lot of, um, creative criminal forensics.
Bite mark identification was used forever until blown up by particularly shameless grifting, and has never been shown to work as practiced. [1]
Tennessee still uses dowsing rods. [2]
Fingerprinting as practiced is a bundle of folk practice, guesses, and some science. Quality varies wildly. [3]
Fiber analysis, lie detectors, spatter analysis and many more techniques are all crap. When one bogus method is finally found legally unreliable, cops and prosecutors find a new one.
[1] https://innocenceproject.olemiss.edu/radley-balko-reports-on...
[2] https://www.themarshallproject.org/2022/03/17/witching-dowsi...
[3] https://www.aaas.org/resources/latent-fingerprint-examinatio...
It's probably meant as a lead, not as evidence. Given that this is a kidnapping, likely murder case, there's probably tons of evidence if you're looking at the right guy.
And I'm wondering about that, because we know the criminal must have been a pretty hard-core cryptocurrency nut. There aren't THAT many of them in Norway (they've already concluded they are a fluent Norwegian speaker).
Presumably it is to aid in finding the equipment used. Once they find the equipment and can positively identify it, they can use other evidence to establish to probable user of that equipment.
As for malicious actors, wouldn't that be a risk for most forms of evidence? Likewise, wouldn't many of the techniques used to establish the validity of other forms of physical evidence be applicable when these techniques are used?
If there’s only one PC in a sea of Macs then it’s a good way to narrow it down. Even better if you can use the application characteristics to determine that someone was using a particular app at a particular time, then initiated a print. It’s not irrefutable evidence, but it’s someone that tells police that a specific event occurred, for which the suspect would be compelled to provide a reasonable response.
I had to chuckle at the first part.
Ah yes, I see they’re using the default formatting options. That narrows down our search to 99.9999% of the population.
HD630 is the integrated GPU on Intel’s Kaby Lake line of processors.
That narrows it down to coming from 10s of millions of computer perhaps?
I would guess there must be forensic tools to detect this stuff, that the Norwegian police don't just have the best experts in Windows and printers in the world who then went through all the various systems, but that there should be a database of these variations somewhere and tools you can use to analyze a printed output to figure out where and what it was produced by, so what are these tools is my question.
Maybe most of this profile is pure speculation based statical probability?
This is why I always write my threats and ransom requests in pure TeX.
Seriously though, I thought printers have been using microdots as identifiers for years. Is this just an old wives tale?
I assume a lot of that information comes from the Machine Identification Code [0], the "yellow dots" emitted by almost all printers.
There's a number of encoding schemes [1], though most of those only identify the printer - they don't go far enough to identify the graphics card or OS where it originated. That's a new capability - if it's being accurately relayed here.
[0] https://en.m.wikipedia.org/wiki/Machine_Identification_Code
> emitted by almost all printers
I believe it's only by some copiers and laser printers, not inkjets for example.
Surely only color printers print yellow dots?
Identifying the graphics card/OS doesn't sound impossible.
They figured out it was Wordpad (presumably based on line breaking or similar) which narrows it down to Windows, and the graphics drivers probably subtly affect the font rendering in the same way that can be used for canvas fingerprinting.
That said, Windows 8 or 10 using Wordpad and Intel integrated graphics doesn't exactly narrow it down.
IIRC the yellow dots just identify the printer, not the computer.
This reads so much like Lee Child's Without Fail / Jack Reacher (2008) - which I'm currently re-reading. Analysing a printed threat:
‘It’s a Hewlett-Packard laser. They can tell by the toner chemistry. Can’t tell which model, because all their black-and-white lasers use the same basic toner powder. The typeface is Times New Roman, from Microsoft Works 4.5 for Windows 95, fourteen point, printed bold.’
’Typefaces tend to change very subtly between different word processors. The software writers fiddle with the kerning, which is the spacing between individual letters, as opposed to the spacing between words. If you look long enough, you can kind of sense it. Then you can measure it and identify the program. ...’
(Edit: Limited the amount of quoted text a bit; I believe a few lines is fine/fair use. Loving the series re-read after the TV show, and that I bought them on Kindle originally!).
I wonder how many writers write about word processors when they get writer's block. A bit like devs making dev tools.
Police have been doing this since the days of typewriters. If you're a whistleblower with sensitive information, assume your printing device has a unique identifier. This is how Reality Winner was caught, when she leaked info about Russian interference in US elections.
If you're in a highly secure environment, it's even possible the content itself may be a unique identifier. I could imagine a sensitive document having grammatical alterations unique to each recipient.
Journalists should consider this before publishing unredacted copies of leaked documents.
Zoom does something like this. They'll embed unique information into the meeting and meeting audio. I've also heard that the arrangement of the participants can also be a watermark but I don't have a source for that.
"Police have been doing this since the days of typewriters."
Well, that the typewriters and today the printers are unique, sure.
But here they seem to claim(I do not speak the articles language) that they could identify the computer that send the document. Which is a very bold and new claim, I think.
My assumption - unfounded? paranoid? - is that:
1) Printers leave a unique "invisible" watermark; similar to the way you can hide an image within an image. The naked eye can see it, but it's there.
2) Aside from that the printer itself has a unique fingerprint, similar to how keyboards do (i.e., AI can pick the difference in the sound of each key and with that audio can translate your typing into letters / words).
3) Networked printers phone home; with snippets. Again, similar to the way some smart TVs send screenshots.
Perhaps not every printer does all of the above, and some not at all, but enough do or might.
Finally, law enforcement explanations like the article's to me are suspect. For example, how often do we hear that a random-y car stop led to a sizable drug bust? So of all the thousands of car going up Rt 95 the police randomly picked one with loads of drugs? What are the odds?
Moral of the story, if (federal) law enforcement has "insider information" they're not going to share that with the public.
>Moral of the story, if (federal) law enforcement has "insider information" they're not going to share that with the public.
I agree: all I've learned is to make a doc on my oldest laptop, multi-paged and-fonted, have it printed at different public (paid or library) sources and then cobble them together and post them from a random place (not taking my phone there, either).
From what I've anec-heard, those 'rando' car stop/ mega busts are politely arranged so the cops get their bust, but the real mega-shipments sail on by, untouched. Everybody gets a payday, even the Prison system!
*the captured mules get to live rent free for a whilem so there's that, for them.
>similar to the way some smart TVs send screenshots
Wtf! Just when I thought I'd heard it all.
All the other details are fairly straightforward (toner, envelope, paper, etc) that can be nailed down with enough legwork, but I am wondering how they possibly had figured out the GPU of machine.
- Are there certain rendering artifacts that can be seen on printed glyphs that give clues to the GPU?
- Or, are they going by heuristics here? (I.e. it was XYZ GPU, because it was a common machine that at the time that would be running Win 8 or 10)
This is an ongoing investigation, the police don't have to be truthful in their releases. It might be a guess, it might be because they're already fairly sure who did it or is an accomplice and want to create pressure. They might know it for entirely different reasons than analyzing a piece of paper.
> Are there certain rendering artifacts that can be seen on printed glyphs that give clues to the GPU?
Most printers will do their own rendering, it's not often that a text document gets pre-rendered by the OS.
If it was printed straight from WordPad without being converted to an image, there's no artefact from the host OS, there.
Most of these forensic findings use publicly known techniques.
What does intrigue me is how they managed to determine the graphics card.
Anyone?
It could theoretically effect font rendering, but I really doubt it.
It's more likely the printer driver have encoded information about the gpu into the yellow microdots [1] that many color printers use to trace pages.
But if they have microdots, then they really should have more information.
[1] https://en.wikipedia.org/wiki/Machine_Identification_Code
> What does intrigue me is how they managed to determine the graphics card.
Cheap GDI printers use the PC for rendering. I find it a bit surprising that would give enough to identify a specific card from a printed sample, but it certainly seems plausible.
It's odd. If it was from microdots they should know a lot more than about the printer than "most likely an HP inkjet".
There's quite a few papers on browser fingerprinting via canvas / webgl, I assume it's similar. Here's one talking about (among other things) fonts and GPU detection:
PCL6 and WYSIWYG is my guess.
It is fascinating to see what information can be deduced from such an artifact. Not exactly the same, but it reminded me of a story from the early days of the internet, where a serial killer was caught because a map he sent police, showing the location of a body, was generated online before being printed.
I somewhat wonder if this is a non-story and they concluded that the note was printed inside the house. Or they have a suspect in mind and they want someone close to them to call in that their computing is suspicious.
They might just be trying to convince the public they are trying hard or maybe a cop bragged too much to a journo which is more likely.
This is not quite fingerprinting, since there's nothing unique about the alleged setup.
There's quite a lot required for them to credibly show that the letter could only have been produced on a pc with "Intel HD Graphics 630". I suspect the argument is on the level of "we tried to duplicate it with some random PCs and the one with Intel HD graphics looked most similar".
But even if it is true, integrated intel GPUs are in (maybe?) a third of all windows PCs.
Reminds me of the Dan Rather memo, though that was a simpler "show it couldn't be that old" style investigation.
How likely could it be a Gone Girl scenario?