There's been much speculation on exactly how NSA leaker Reality Winner was exposed after giving The Intercept documents that showed the extent to which the security agency suspects Russian meddling (previously) in last year's general election. On one hand, the filing against her talks of the "creases" seen in the scans The Intercept posted, tipping them off to it being a workplace printout from an insider--an insinuation of casual sloppiness on the reporters' part. On the other hand, it seemed clear Winner did everything at a work computer anyway and was surely doomed once the story came out and internal investigations began.

The truth is all of the above, but with a cherry on top: the printouts contained invisible dot patterns added by the printer to identify the worker who sent the print job. All surviving photocopying, scanning and PDF compression to be published, plain as day, on the world-wide web. Errata Security explains how, in detail.

The document leaked by the Intercept was from a printer with model number 54, serial number 29535218. The document was printed on May 9, 2017 at 6:20. The NSA almost certainly has a record of who used the printer at that time.

The situation is similar to how Vice outed the location of John McAfee, by publishing JPEG photographs of him with the EXIF GPS coordinates still hidden in the file. Or it's how PDFs are often redacted by adding a black bar on top of image, leaving the underlying contents still in the file for people to read, such as in this NYTime accident with a Snowden document.

Read the rest