Police claims to have fingerprinted computer based on printed document

Norwegian - google translate to English <a href="https:&#x2F;&#x2F;www-nrk-no.translate.goog&#x2F;norge&#x2F;nye-opplysninger-om-trusselbrevet-i-forsvinningssaken_-_-vet-vi-sa-a-si-alt-om-dette-dokumentet-1.15965322?_x_tr_sl=no&amp;_x_tr_tl=en&amp;_x_tr_hl=en&amp;_x_tr_pto=wapp" rel="nofollow">https:&#x2F;&#x2F;www-nrk-no.translate.goog&#x2F;norge&#x2F;nye-opplysninger-om-...</a>

Most interesting parts (IMO):<p><i>“Program and program settings: When preparing the letter, WordPad for Windows is most likely used. Default settings for font, line spacing and paragraph are used. The page layout has been Letter.”</i><p>That, I think, can be inferred with good confidence from precisely measuring various font measurements, looking at how lines got broken, etc, and comparing that with a database of program defaults for a large set of OSes and programs.<p><i>“Device, operating system and video card : When designing the threat letter, a Windows PC has been used, with an operating system Windows 10 or 8.”</i><p>I guess either WordPad or the font got tweaked somewhat in that Windows version. Maybe WordPad started using ligatures more aggressively, its page width got a tiny bit wider, or, in the font, some letter shape or spacing table changed a tiny bit, or a character was added.<p><i>“The PC has had an integrated video card, Intel HD Graphics 630.”</i><p>That, for me, is the most intriguing part. Does Windows use the GPU to render fonts even if they get printed, and are there subtle differences between GPUs and their software rendering that, statistically, can be recovered from the somewhat noisy print?

I assume a lot of that information comes from the Machine Identification Code [0], the &quot;yellow dots&quot; emitted by almost all printers.<p>There&#x27;s a number of encoding schemes [1], though most of those only identify the printer - they don&#x27;t go far enough to identify the graphics card or OS where it originated. That&#x27;s a new capability - if it&#x27;s being accurately relayed here.<p>[0] <a href="https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Machine_Identification_Code" rel="nofollow">https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Machine_Identification_Code</a><p>[1] <a href="https:&#x2F;&#x2F;dl.acm.org&#x2F;doi&#x2F;10.1145&#x2F;3206004.3206019" rel="nofollow">https:&#x2F;&#x2F;dl.acm.org&#x2F;doi&#x2F;10.1145&#x2F;3206004.3206019</a>

This reads so much like Lee Child&#x27;s Without Fail &#x2F; Jack Reacher (2008) - which I&#x27;m currently re-reading. Analysing a printed threat:<p><i>‘It’s a Hewlett-Packard laser. They can tell by the toner chemistry. Can’t tell which model, because all their black-and-white lasers use the same basic toner powder. The typeface is Times New Roman, from Microsoft Works 4.5 for Windows 95, fourteen point, printed bold.’<p>’Typefaces tend to change very subtly between different word processors. The software writers fiddle with the kerning, which is the spacing between individual letters, as opposed to the spacing between words. If you look long enough, you can kind of sense it. Then you can measure it and identify the program. ...’</i><p>(Edit: Limited the amount of quoted text a bit; I believe a few lines is fine&#x2F;fair use. Loving the series re-read after the TV show, and that I bought them on Kindle originally!).

Police have been doing this since the days of typewriters. If you&#x27;re a whistleblower with sensitive information, assume your printing device has a unique identifier. This is how Reality Winner was caught, when she leaked info about Russian interference in US elections.<p>If you&#x27;re in a highly secure environment, it&#x27;s even possible the content itself may be a unique identifier. I could imagine a sensitive document having grammatical alterations unique to each recipient.<p>Journalists should consider this before publishing unredacted copies of leaked documents.

My assumption - unfounded? paranoid? - is that:<p>1) Printers leave a unique &quot;invisible&quot; watermark; similar to the way you can hide an image within an image. The naked eye can see it, but it&#x27;s there.<p>2) Aside from that the printer itself has a unique fingerprint, similar to how keyboards do (i.e., AI can pick the difference in the sound of each key and with that audio can translate your typing into letters &#x2F; words).<p>3) Networked printers phone home; with snippets. Again, similar to the way some smart TVs send screenshots.<p>Perhaps not every printer does all of the above, and some not at all, but enough do or might.<p>Finally, law enforcement explanations like the article&#x27;s to me are suspect. For example, how often do we hear that a random-y car stop led to a sizable drug bust? So of all the thousands of car going up Rt 95 the police randomly picked one with loads of drugs? What are the odds?<p>Moral of the story, if (federal) law enforcement has &quot;insider information&quot; they&#x27;re not going to share that with the public.

All the other details are fairly straightforward (toner, envelope, paper, etc) that can be nailed down with enough legwork, but I am wondering how they possibly had figured out the GPU of machine.<p>- Are there certain rendering artifacts that can be seen on printed glyphs that give clues to the GPU?<p>- Or, are they going by heuristics here? (I.e. it was XYZ GPU, because it was a common machine that at the time that would be running Win 8 or 10)

Most of these forensic findings use publicly known techniques.<p>What <i>does</i> intrigue me is how they managed to determine the graphics card.<p>Anyone?

It is fascinating to see what information can be deduced from such an artifact. Not exactly the same, but it reminded me of a story from the early days of the internet, where a serial killer was caught because a map he sent police, showing the location of a body, was generated online before being printed.<p><a href="https:&#x2F;&#x2F;murderpedia.org&#x2F;male.T&#x2F;t&#x2F;travis-maury.htm" rel="nofollow">https:&#x2F;&#x2F;murderpedia.org&#x2F;male.T&#x2F;t&#x2F;travis-maury.htm</a>

I somewhat wonder if this is a non-story and they concluded that the note was printed inside the house. Or they have a suspect in mind and they want someone close to them to call in that their computing is suspicious.

This is not quite fingerprinting, since there&#x27;s nothing unique about the alleged setup.<p>There&#x27;s quite a lot required for them to credibly show that the letter could only have been produced on a pc with &quot;Intel HD Graphics 630&quot;. I suspect the argument is on the level of &quot;we tried to duplicate it with some random PCs and the one with Intel HD graphics looked most similar&quot;.<p>But even if it is true, integrated intel GPUs are in (maybe?) a third of all windows PCs.

Reminds me of the Dan Rather memo, though that was a simpler &quot;show it couldn&#x27;t be that old&quot; style investigation.

How likely could it be a <i>Gone Girl</i> scenario?