<story><title>Open Letter from Laura Poitras</title><url>https://www.praxisfilms.org/open-letter-from-laura-poitras/</url></story><parent_chain><item><author>walrus01</author><text>It has been some years since I read about the original document leak, but as I recall, she shared documents from her workplace that either had printer steganography ID codes embedded into them (images in a raster scan of a paper document), or some form of digital stego IDs in electronic documents.&lt;p&gt;Basically not very different from how major motion picture studios embed some sort of unique ID code into the compressed video files given out pre-release, to reviewers (and workprints sent to 3rd party CGI studios) so that they can track down a leak.&lt;p&gt;None of which Winner was aware of the existence at the time. Some of those codes made it through to the reporting, and were published to the Internet, making it fairly easy for federal law enforcement to track her down.&lt;p&gt;I have also not seen any information saying that the journalists who received the documents, definitively were, or were not aware of the presence of the ID numbers stegoed into the documents.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.theatlantic.com&amp;#x2F;technology&amp;#x2F;archive&amp;#x2F;2017&amp;#x2F;06&amp;#x2F;the-mysterious-printer-code-that-could-have-led-the-fbi-to-reality-winner&amp;#x2F;529350&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.theatlantic.com&amp;#x2F;technology&amp;#x2F;archive&amp;#x2F;2017&amp;#x2F;06&amp;#x2F;the-m...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.erratasec.com&amp;#x2F;2017&amp;#x2F;06&amp;#x2F;how-intercept-outed-reality-winner.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.erratasec.com&amp;#x2F;2017&amp;#x2F;06&amp;#x2F;how-intercept-outed-reali...&lt;/a&gt;&lt;p&gt;On a more meta level, it&amp;#x27;s a hard problem to solve with handling and publishing leaked documents, because on one side you have the vast resources of the NSA and the US intelligence community coming up with new steganographic and other methods to embed tracking ID numbers into documents. The full size, scale, budget and weight of various federal agencies&amp;#x27; &amp;quot;counterintelligence&amp;quot; efforts.&lt;p&gt;And on the other side you have investigative journalists who do not have PhD level degrees in math&amp;#x2F;cryptography, and do not have the technical resources to definitely search through a huge pile of documents and say with 100% confidence that any possible tracking IDs have been stripped out.&lt;p&gt;I don&amp;#x27;t think I could reasonably expect a person from a journalism&amp;#x2F;liberal arts degree educational and work experience background to identify steganography.</text></item><item><author>jacquesm</author><text>She pretty much outed herself though by using her own computer to mail the document to the intercept. That the intercept then went and tried to verify the veracity of the documents does not give them much credit either, they didn&amp;#x27;t have to forward the actual scans, there would have been other ways of verifying that the documents were real.&lt;p&gt;Finally, this was clearly careless on the part of the Intercept, no proof has ever been given that this was malicious, and I&amp;#x27;m not seeing any here.</text></item></parent_chain><comment><author>Fnoord</author><text>&amp;gt; It has been some years since I read about the original document leak, but as I recall, she shared documents from her workplace that either had printer steganography ID codes embedded into them (images in a raster scan of a paper document), or some form of digital stego IDs in electronic documents.&lt;p&gt;All modern printers have this steganography feature.&lt;p&gt;&amp;quot;In October 2004, consumers first heard of the hidden feature, when it was used by Dutch authorities to track down counterfeiters who had used a Canon color laser printer.&amp;quot; [1]&lt;p&gt;This is written in &amp;quot;PC World&amp;quot; in 2004 by journalist Wilbert de Vries. He now works for Tweakers, back then he worked for Webwereld. 2004 was mid-end heydays of Webwereld. I&amp;#x27;m quite sure I read about this technology on Webwereld back then.&lt;p&gt;Later on, this got covered on CCC as well, not sure which years.&lt;p&gt;My point &amp;#x2F; opinion? The Intercept &lt;i&gt;could&lt;/i&gt; have known (see above), and, given he nature of their content ([2]), &lt;i&gt;should&amp;#x2F;ought to&lt;/i&gt; have known.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Machine_Identification_Code&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Machine_Identification_Code&lt;/a&gt;&lt;p&gt;[2] The fact they had Greenwald&amp;#x2F;Poitras on board says enough (they were key figures in the Snowden leaks). You can look at their content from the era 2017 if in doubt.</text></comment>
<story><title>Open Letter from Laura Poitras</title><url>https://www.praxisfilms.org/open-letter-from-laura-poitras/</url></story><parent_chain><item><author>walrus01</author><text>It has been some years since I read about the original document leak, but as I recall, she shared documents from her workplace that either had printer steganography ID codes embedded into them (images in a raster scan of a paper document), or some form of digital stego IDs in electronic documents.&lt;p&gt;Basically not very different from how major motion picture studios embed some sort of unique ID code into the compressed video files given out pre-release, to reviewers (and workprints sent to 3rd party CGI studios) so that they can track down a leak.&lt;p&gt;None of which Winner was aware of the existence at the time. Some of those codes made it through to the reporting, and were published to the Internet, making it fairly easy for federal law enforcement to track her down.&lt;p&gt;I have also not seen any information saying that the journalists who received the documents, definitively were, or were not aware of the presence of the ID numbers stegoed into the documents.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.theatlantic.com&amp;#x2F;technology&amp;#x2F;archive&amp;#x2F;2017&amp;#x2F;06&amp;#x2F;the-mysterious-printer-code-that-could-have-led-the-fbi-to-reality-winner&amp;#x2F;529350&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.theatlantic.com&amp;#x2F;technology&amp;#x2F;archive&amp;#x2F;2017&amp;#x2F;06&amp;#x2F;the-m...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.erratasec.com&amp;#x2F;2017&amp;#x2F;06&amp;#x2F;how-intercept-outed-reality-winner.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.erratasec.com&amp;#x2F;2017&amp;#x2F;06&amp;#x2F;how-intercept-outed-reali...&lt;/a&gt;&lt;p&gt;On a more meta level, it&amp;#x27;s a hard problem to solve with handling and publishing leaked documents, because on one side you have the vast resources of the NSA and the US intelligence community coming up with new steganographic and other methods to embed tracking ID numbers into documents. The full size, scale, budget and weight of various federal agencies&amp;#x27; &amp;quot;counterintelligence&amp;quot; efforts.&lt;p&gt;And on the other side you have investigative journalists who do not have PhD level degrees in math&amp;#x2F;cryptography, and do not have the technical resources to definitely search through a huge pile of documents and say with 100% confidence that any possible tracking IDs have been stripped out.&lt;p&gt;I don&amp;#x27;t think I could reasonably expect a person from a journalism&amp;#x2F;liberal arts degree educational and work experience background to identify steganography.</text></item><item><author>jacquesm</author><text>She pretty much outed herself though by using her own computer to mail the document to the intercept. That the intercept then went and tried to verify the veracity of the documents does not give them much credit either, they didn&amp;#x27;t have to forward the actual scans, there would have been other ways of verifying that the documents were real.&lt;p&gt;Finally, this was clearly careless on the part of the Intercept, no proof has ever been given that this was malicious, and I&amp;#x27;m not seeing any here.</text></item></parent_chain><comment><author>quesera</author><text>Journalists and office staff in First Look&amp;#x27;s line of business should definitely be aware of these risks.&lt;p&gt;But it&amp;#x27;s certainly possible that they simply failed here. That possibility warrants an internal investigation, to determine the nature of the failure, and to signal internally and publically that they take their responsibility to sources seriously.&lt;p&gt;No organization likes to be criticized from within. But some organizations are strengthened by their reaction to criticism (whatever the source), and others are diminished.&lt;p&gt;Laura Poitras is a credible party. I&amp;#x27;m inclined to believe her side of the story here.&lt;p&gt;Related (though not directly): Bellingcat is doing impressive work. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.bellingcat.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.bellingcat.com&amp;#x2F;&lt;/a&gt;</text></comment>