Is Your Photocopier Ratting You Out?

Berglund Authority Level 3

by Pat McGregor <pat@nithaus.org>

There's something about spring and fall -- when people are working on their taxes, or when they're starting to look at year-end close -- that brings out the paranoia in a lot of folks. There was a lot of public discussion on the Net in April about the fact that public photocopiers have hard-drives, and everything they copied, including your tax returns, was available to the staff at the copy shop, or anyone in a repair uniform. Oh my! How scary! What shall we do?

In general, unless you're copying something that will really incriminate you, and you know you're under surveillance by some law enforcement agency or private detectives, you probably shouldn't worry about it.

Although studies show that 26% or more of us are "privacy concerned" (and that number has gone up from the 10% or less who were actively concerned in 2003 or 2004), I want to encourage you to consider the likelihood that someone will be looking for your specific tax return or other documents. Your average copy shop sees hundreds of people a week in April making copies of their tax return. It would take some effort -- not unimaginable, but substantial -- to dig out specific documents.

The other thing you need to think about is that nearly everything you do keeps a copy of your documents today. Your home computer has several copies of every document, to make it easy for you to have that list of "Recent Documents." Your home printer probably has one too, especially if you can have several documents waiting at once. Have you tried that nifty multi-function device (scanner, fax, copier, printer) that your company just installed on the network? Its hard drive keeps everything that comes to it so that it can make sure your report doesn't get mixed up with Harry's barbecue invitations or someone's spreadsheets. Only your copier team knows how often the cache (storage) on the drive is wiped or written over. And speaking of fax machines, does your fax machine have the capability to hold a document in memory and re-send it if the destination was ringing busy? Or to print it out after someone refills the tray with paper? Hard drive. Memory. Your document.

Your email client retains a copy of your sent mail, as does the mail server for the company. If you have a "history" list on your browser, the pages you've visited are still there. And so on and so forth.

Feeling creepy and spied upon?

Ready to go back to doing your taxes by hand and adding machine? Maybe typing it on the form? Maybe using carbons? Think again -- even those methods leave traceable copies: The adding machine tape; the back of the carbon paper, or even an extra carbon copy slipped in by the typist. If you have one of those electric typewriters, with the shiny ribbon, every character you've typed on the machine is on that ribbon.

(If you have no idea what I mean when I talk about carbon copies or carbon paper, find someone who does quilting or embroidery and traces the patterns on the fabric with "quilting carbon." Or, even, the next time you are signing a credit card receipt or other form and you see "Press hard, you are making copies." By signing the top copy you make an impression on copies below it. That's the idea.)

I imagine that even back in the days of clerks making "fair copies" of legal documents written by hand, or even monks making calligraphed documents it wasn't too hard to slip an extra copy of something out. Certainly those scenarios make great plot devices in historical novels.

Every time this topic comes up, professional computer security people sigh, and try to reassure people that this is not a high risk for a general individual. Possibly if you are a high-level executive in your company, a movie star, a military strategist, or some other target, your risk is higher.

Technical Paranoia Has Been Around for a Long Time

Did your parents or grandparents ever talk about being on a party line when they got their first telephone? Where all one had to do to listen to everyone else's conversations was pick up the receiver at your house? All the calls went down the same line, and you knew which call was for you by the ring pattern. Or, perhaps, more recently: about 20 years ago, when people got nervous about the "carbons" for our credit-card receipts, and clerks would either tear them up for you or give them to you? Those were some of our first experiences with a widespread concern about fraud or eavesdropping connected to specific technologies. But concerns about technological affects on society are not new.

When the telephone was invented, there was worry among social scientists that it would cause a breakdown of society, degenerate behavior among teens, and other cultural problems, including the ability to interrupt people at dinner! These concerns have come up again for every new communication technology, including radio, television, computers, and now cell phones and text messaging. For some people, the problems caused by the freedom to transmit information without restrictions are very serious. We all know families where there is no television, or television or computer time is strictly limited. And safety on the Web is something we all pay attention to.

Glee and I talk a lot about making choices based on healthy skepticism. We suggest you balance the amount of risk and the likelihood something bad will happen to you against the trouble it will cause to protect yourself.

If you're really worried about going to the local "Coffee and Copy" shop and making duplicates of your tax return or anything else, print as many copies as you need off your own printer. It will cost more in ink or toner than the copies would cost, but you may feel more protected. If the documentation for your multi-purpose printer at home says that you can clear the memory by unplugging the machine for 30 seconds or more, and you'd like to make sure all those documents are gone, do it every night. (Do not do this at work. I promise you the trouble will be much greater than your concern about extra copies of your documents.)

A security-advice mailing list I'm on recently received a question about wiping your hard drive before giving it to a charity. The questioner asked if "formatting" the drive would erase all the documents so they couldn't be recovered. As we all know now from television and movies, the answer is no. Anybody with publicly available tools can reconstruct much of the data on your hard drive. If you're really worried about it, take the hard drives out of the machine and run over them with your car once or twice. Crushing the drive really gets rid of the data, and it's cheaper to buy a new drive and donate it along with the computer than lose too much sleep about what someone might find.

In fairness, I should mention that I have friends who think I'm not worried enough. I confess that various actions taken by the current US government to hunt for potential terrorists concern me, because I think they endanger our civil rights. But I think it's unlikely that writing this sentence, or saying something in my personal blog, is going to get me on a list of those working against the government.

A Final, Mixed Thought

While I've been getting this article together, I traveled for work. On one of my trips, I realized that I had lost or had stolen my corporate credit card. Of course, I realized this after I had reached my destination, picked up my rental car, and checked into the hotel. I contacted our emergency number, and they agreed to ship a new card to me via fast courier, so I could pay the bills at the end of my trip on the corporate card and not on my personal card. The card arrived by courier as promised, and all seemed fine. But at the end of my trip, when I went to check out, the card company put a hold on it. Seems someone had been trying to buy SCUBA lessons in Cancun at the same time I was checking out of my hotel.

It was a horrifying moment. We hear about identity theft all the time, and it's a real, valid concern. As soon as I got home I checked with my bank and my checked my credit reports to see if anything else was going on. Luckily, nothing else has shown up. But I am thrilled to find out that my card company's anti-fraud division is watching so carefully. You might check with your card company and see what kind of precautions they are taking on your behalf.