75

I was thinking of the following question for a long time and did not find a lot of material* in the web and nothing at all on Security.SE.

I think its a very interesting question as it covers different anonymization measures (or counter measures to possible deanonymization measures of soft- & hardware) and within the modern times seems to be more important than ever to protect the human right of freedom of speech.

How can I publish (scanned) documents anonymously?

To narrow down the question a little bit, lets define some parameters:

  • I have some documents in paper form I want to publish without identifying me as the publisher.
  • These documents have no "fingerprint" or any unique printed information on them to identify me as the owner. (Or I have covered it)
  • I will publish the digital files via a secure network (e.g. Tor) with an open source file hosting website that is guaranteed to not store or even publish any information about the uploader.

Things I thought of that might be a problem:

  • Do scanners add any visual unique fingerprint (or even worse: information about the connected device etc.) to every scanned page?
  • Do scanners add any digital (e.g. binary) fingerprint (or even worse: information about the connected device etc.) to every scanned file?
  • Do scanners have a unique 'technical unavoidable' fingerprint, so every scanner scans differently? And is this fingerprint computable or even stored somewhere?
    Or does the 'institution' that wants to deanonymize me have to have access to my scanner to make an comparison?
  • Do PDFs 'store' any information related to the host computer in them?

And if the answer to one of the question was yes, how can I remove or avoid this information?


*Two notable Sources I have found:

  • 5
    PDF can have metadata but it's removable prepressure.com/pdf/basics/metadata – Neil Smithline Apr 26 '15 at 19:13
  • 10
    Without wishing to point out the obvious, is there a reason you don't want to use OCR software to totally obliterate any sort of digital fingerprint? You could scan the doc, extract the text and upload as plain text to anywhere you want. – Richard Apr 27 '15 at 0:22
  • 3
    If the information can be represented suitably as 1bpp/lineart, save it as such in a format with absolutely no headers beyond the image dimensions, like raw pbm. – R.. Apr 27 '15 at 2:22
  • 8
    @Richard : the problem with OCR and publishing it as plain text is that it would be perceived of having less authenticity (maybe he just made it all up and just typed whatever he wanted). Publishing the officially-looking document itself as an image makes it more credible. – vsz Apr 27 '15 at 16:58
  • 4
    While I understand that this question is about identifying information added by scanners and PCs, you also need to consider the possibility of a "canary trap": businessinsider.com/nba-canary-trap-media-2014-12 – Free Radical Apr 28 '15 at 2:16
61

Publishing scans without being identified is a tough proposition. There are multiple risks of information leak, and mitigation is technically complex. However, anyone determined to do so can learn the appropriate techniques, and there is free software to accomplish the task.

Disclaimer: Although I consider myself technically knowledgeable about the mentioned issues and I've included references where they exist, some parts of this answer are speculative.


Risks:

Do scanners add any visual unique fingerprint (or even worse: information about the connected device etc.) to every scanned page?

This seems likely, considering that some printers do so. There isn't much information available on scanners, though.

Do scanners add any digital (e.g. binary) fingerprint (or even worse: information about the connected device etc.) to every scanned file?

If you're doing a scan from an attached PC (as your question implies), the answer is no, the scanner can't. Scanners attached to a PC transfer raster image data, not files, so it can't possibly add data to a file it doesn't have access to.

However, you should consider that a digital fingerprint could be added on the scanning software of the PC.

Also, if the scanner is standalone (it saves files to a USB drive, or sends them by email), this is a definite possibility.

Do scanners have a unique 'technical unavoidable' fingerprint, so every scanner scans differently? And is this fingerprint computable or even stored somewhere? Or does the 'institution' that wants to deanonymize me have to have access to my scanner to make an comparison?

Yes. Most modern scanners use CCD sensors, which are uniquely identifiable by their noise pattern, using specialized software.

Other plausible visual fingerprinting targets:

Using these kind of fingerprinting techniques, it seems likely that the scanner model and paper type can be identified from the scans, but identifying the specific scanner and paper page used would be hard (perhaps impossible) without access to them for comparison purposes.

Do PDFs 'store' any information related to the host computer in them?

Yes, there's even a NSA article about it. While dealing with scanned documents, you'll need to be aware of image file metadata, which can also be present on PNG and JPG files, for example.

Another risk that you didn't mention is that the scanner itself may store a copy of your scan. Big printers do

Of course, this isn't a exhaustive list of risks - merely what has come to my mind in the couple of minutes it has taken me to write this answer. I'm pretty sure researchers, intelligence agencies and police paid to do so can come up with better ideas!


Mitigation

The easiest, safest and obvious mitigations are don't use a scanner that can be tied to your identity, and destroy the scanner after the fact. Of course, this is not always attainable, so what else can you do to protect yourself?

Don't use a stand-alone scanner - especially a networked one. If you really must, convert its output to a pure image without metadata.

For (at least partially) mitigating fingerprints added by software, you'll want to use open source software, both for the OS and the scanning program.. Avoid using your personal PC for scanning, or at least, use a secure live OS

For detecting deliberate visual fingerprinting, the best option would be to scan a blank page and look for obvious anomalies. These might be very small, so you may want to use a image editor to crank up the contrast.

For sensor, paper and visual fingerprinting in general, you want to destroy subtle scanning artifacts. Use a image editor to:

  • Add noise
  • Use a noise reduction filter (with aggressive reduction)
  • Rotate
  • Distort the image (by applying multiple camera "lens correction", for example)
  • Convert the image to grayscale
  • increase the contrast (or, preferably, completely convert to black-and-white)
  • Reduce resolution (preferably by a near-to-irrational factor)
  • Compress the image (high JPEG compression, for example)

In general, do everything you can to obfuscate and reduce the amount of information contained in the image while keeping the document reasonably readable.

Finally, after all the other steps, remove the medatadata from your files. You can use specialized software to do this.

  • 3
    This is an excellent answer, but I'd like to point out a simple fact: doing all these steps in order to obfuscate the result, can be a lot more expensive than buying a cheap scanner and destroying it afterwards. – o0'. Apr 27 '15 at 10:06
  • 3
    Would it be possible to use the scan of the blank page to "remove" any pattern that was added to both pages after scanning? – Alexander Apr 27 '15 at 10:13
  • 2
    "Reduce resolution (preferably by a irrational factor)" That's impossible. Any image has integer dimensions so the scaling factor from one image to another can only be rational. – David Richerby Apr 27 '15 at 12:39
  • 2
    @Lohoris Indeed, but as I mentioned, that's impossible in some circumstances, such has when you can't move all the paper outside a specific area. It's also not a lot more expensive if you automate the process. – goncalopp Apr 27 '15 at 13:09
  • 2
    @DavidRicherby You're strictly correct, of course. What I meant is a "rational factor whose reduced fraction has very large integers" - it seemed a bit too technical for this answer, though. Do you have a better idea on what to call it? – goncalopp Apr 27 '15 at 13:23
11

Buy the scanner in cash, and buy a PC from some PC junker shop in cash. Make sure you never input any information about your name etc into the computer. If everything is bought in cash, and you have a virgin OS with only alias information about yourself, then there should be no correct metadata to encode.

There are certain programs which do encode metadata, Microsoft Word, and other Microsoft products. I think even text files have operating system metadata associated with them. I can't see any software ever encoding an IP address or something of that nature as metadata, that would be a little more invasive than normal.

Programmatically it is possible to scrub metadata from files etc, it just requires a little bit of effort. Images almost always have some form of metadata, such as GPS if it is taken from a mobile device, but I can't see scanners having GPS chips. It would be a little bit of a waste wouldn't it?

PDF's will probably have a lot of meta data associated with them, they would have to get the user's information from somewhere though.

Another thing that would aid in preventing metadata from being transferred would be a lack of connection to the internet. If the programs can't phone home then they can't initialize certain metadata like location etc. I realize this talks a little bit less about the actual metadata than you would like, sorry about. I am an entry level programmer, but I have had some classes in computer forensics as well as computer programming. I hope this helps.

  • 2
    +1 for the "no metadata when there is no data to collect" idea, when this is a requirement buying a dedicated PC may be a good investment. I would recommend Linux as OS on it which will allow less tracking, you can find specialized distribution lists on the Internet but ensure that it is not too minimalistic and provides the software to work with the scanner. Be sure to check if the scanner is supported natively, free software being less prone to hidden metadata. – WhiteWinterWolf Apr 26 '15 at 22:15
  • 10
    There is a lot of guessing in this answer but no actual sourced knowledge to answer the questions which were asked. – Philipp Apr 26 '15 at 22:31
  • 2
    It seems like buying a lot of Raspberry Pi's would be useful for this. $25-35 USD (plus shipping) is fairly inexpensive. Plus if you were doing this in some sort of covert setting, the small form factor is a bonus. – Wayne Werner Apr 27 '15 at 12:21
  • 3
    Why not buy a throwaway phone instead of throwaway computer+scanner? Camera phones are more efficient for scanning documents than most cheap consumer-grade scanners anyway, as long as you setup proper lighting and 'tripod' to do it. – R.. Apr 27 '15 at 16:59
  • 4
    @R.. Camera phones usually have GPS chips as part of their cellular modems, which allow you to be geolocated. Sure, you can scrub the metadata, but having metadata in the first place is exactly what the answer aims to avoid. – March Ho Apr 28 '15 at 6:44
2

Don't do it.

Forget about it.

If the documents that you are trying to surreptitiously reveal are sensitive enough to demand that level of anonymity and "security", you will be found out.

Snowden revealed secret documents, but he did not hide his identity, neither did Manning.

ALL of the "security methods" mentioned above will fail, and badly. Why?

They operate on the premise that there is this huge pool of potential leakers, of which you will be an anonymous entrant with nothing to point you out.

However: Most secure documents have a limited distribution/access list, and many are time sensitive, which fix their release to a certain point in time.

Suspicion will fall on you immediately, and there will be many indicators of your involvement right away, least of which is your post, on this site!

You will have to prove you did not, not the other way around, and if you are physically seized, you will confess.

For secure documents and most theft cases, the suspect is picked first and then their circumstantial evidentiary trail is used to lock in their guilt!

You used Tor? Not many do. Do you use Tor all the time? Oh no? You only used it just to upload these docs? Guilty.

How about going to a public wifi spot? Is it near where you live? Did you take your cellphone with you? (cell tower access logs)

Seriously, you are not a spy, and even if you are, you will be caught.

Your only hope is if someone else stole them and you got these documents outside of their knowledge, but the arrow is already pointing to you.

  • sorry about the capitals-only sentences, peterH! I didnt know how to format the text with italics and such as you have done (thanks) and used caps to emphasis certain areas I felt deserved emphasis. The unfortunate thing (for this guy) is that all the other advice given here will definitely not protect him one bit. While some approach it as a purely academic exercise, I saw a young man about to ruin his life..oh well, thanks for all the fish – Stephen Wilkinson May 7 '15 at 23:56
  • @StephenWilkinson you are making some large assumptions about the nature of the documents the OP wishes to disclose. The OP is also constraining the conversation to technological traces. While your points cover the wider discussion, you cannot say that the other answers will "not protect him one bit". There may be gaps, but they are also not wrong. – schroeder May 8 '15 at 0:01
  • Hi Stephen, thanks for your answer and also your attempt to protect me! First of all: I do NOT want to disclose anything. I have no secret material and with that I have no intention in publishing anything anonymously. And I also don't intent to encourage anyone to do that. The whole question is written in the "If someone wanted to $that [..with this restrictions...], how could he or she do It". And of course your points are somehow valid so I won't downvote your answer, but as @schroeder already said the whole idea of this question was to talk about the technical restrictions. – Robert May 8 '15 at 6:04
  • To address the point of sensitive documents having a limited distribution, one method to combat this is to plant any incriminating evidence on someone else. "no officer it wasn't me, but I did see Jeremy going in there one day on his way out of work, I always have been suspicious of him maybe you should check him out" But @StephenWilkinson is right posting on this site is the biggest clue in a the trail, this is one way they built a case on Ross Ulbritch the silk road admin, by comparing his questions with code snippets against the silk road codebase. – user6858980 Mar 10 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.