Reality Winner was 25 years old, a contractor at an NSA facility in Augusta, Georgia, when she folded a five-page classified report about Russian interference in the 2016 election, slipped it into an envelope, and mailed it to The Intercept in May 2017. She was arrested on June 3, less than a week after the outlet contacted the government to verify the document. The thing that gave her away was not a fingerprint or a forwarded email or a leaked source. It was a constellation of pale yellow dots, almost invisible against the white paper, that her office printer had stamped onto every page she pressed print on.
The dots told the FBI the exact model and serial number of the printer. They also encoded the date and time of printing, down to the minute. Cross-referenced against access logs, that was enough to narrow the suspect pool to six people, then to one.
Nearly every colour laser printer sold in the past four decades does this. The dots are on the page right now if you go check.
A pattern hiding in plain sight
The dots are yellow because yellow is hard for the human eye to see against white paper. Hold a printed page under a blue LED, or scan it at high resolution and boost the contrast, and a grid of tiny dots appears, arranged in a repeating rectangular pattern tiled across the whole sheet. Each dot is tiny, often less than a millimetre across.
The pattern is a code. Different manufacturers use slightly different schemes, but the Xerox DocuColor version, which the Electronic Frontier Foundation reverse-engineered first, prints a 15 by 8 grid of yellow dot positions, repeated across the page so that even a torn corner can carry enough data to identify the source. The grid encodes the printer’s serial number, the date, and the time of printing as a binary pattern.
According to reporting on the technology, the dots have been on essentially every colour laser printer sold in the United States since the mid-1980s, and the practice spread industry-wide without any public disclosure, user setting, or opt-out. They are, in effect, a kind of physical metadata, written onto the paper itself.
Why the dots exist
The origin story is straightforward and a little dull, which is part of why it stayed buried for so long. In the mid-1980s, as colour laser printing became good enough to produce convincing counterfeit currency, the United States Secret Service approached the major printer manufacturers with a request: build in a forensic identifier so that any counterfeit bill produced on a colour laser could be traced back to the machine that printed it.
The manufacturers agreed. There was no law requiring them to do it, and no law requiring them to tell customers about it. According to reporting on the agreement, the Secret Service got an anti-counterfeiting tool, the manufacturers got a quiet relationship with federal law enforcement, and the dots went into the firmware of every colour laser model that rolled off the line.
The arrangement was an open secret in the printing industry by the 1990s. It was not a secret to anyone in the broader public until much later.
The 2005 reveal
Public attention to the dots really began in November 2004, when PC World magazine published a piece noting that some colour laser printers stamped tracking codes onto every page they produced. A Xerox spokesperson, asked to confirm, said yes — the dots existed, the company could not discuss the specifics, and the arrangement was with the government.
That admission was the thread the Electronic Frontier Foundation pulled in 2005. Staff technologist Seth Schoen, EFF intern Robert Lee, and volunteers Patrick Murphy and Joel Alwen asked supporters around the world to print a standard test page on their colour laser printers, scan it at high resolution, and email the scan back along with the printer’s make, model, serial number, and the exact moment they had pressed print. With a few hundred samples in hand, the pattern became readable.
Different rows of the grid encoded different information: the printer’s serial number, a parity check, and the minute, hour, day, month, and year the document had been printed. The EFF published the DocuColor decoding guide and a free decoding program in October 2005, and it became one of the first concrete demonstrations that consumer-grade office equipment was carrying forensic identifiers no one had asked for and no one had been told about. Nature News covered the work that week; the Washington Post followed.
How Reality Winner got caught
The Reality Winner case in 2017 turned the dots from an academic curiosity into a news story. When The Intercept contacted the NSA to verify the leaked document, the journalists handed over a scan of the printed pages. Investigators noticed two things: the document had a faint crease, suggesting it had been folded and removed from a secured facility, and the scan carried the yellow dots.
Decoded, they identified a specific Xerox printer at the Augusta facility and the precise time the document had been printed. From there, the agency pulled access logs for that printer at that minute. Six employees had printed the document. Only one had also been in contact with The Intercept from her work computer. Winner was confronted by FBI agents at her home in Augusta on June 3, 2017, when she returned from grocery shopping, and was later sentenced to 63 months in federal prison, the longest sentence ever imposed at that point for an unauthorised release of government information to the media.
When the leaked Intercept document scan first appeared online, security researchers ran it through the EFF’s old decoder within hours; the foundation noted at the time that the tool that had identified the printer was the same one it had published back in 2005. Winner had not known the dots were there. Almost no one outside security research circles did.
What the dots encode (and what they don’t)
The exact encoding varies by manufacturer, but the Xerox scheme that the EFF decoded works like this. A 15 by 8 grid of yellow dot positions is repeated across the page. Different rows represent different pieces of information. One row is a parity check. Other rows encode the minute, hour, and date. Additional rows encode the printer’s serial number as a binary string. A dot present in a given position is a 1. A dot absent is a 0.
Read across the grid, the result is a complete fingerprint: this printer, on this day, at this minute. Print a page on a Xerox colour laser at 2:47 PM on a Tuesday, and the page carries that timestamp forever, readable by anyone who knows where to look.
Canon, HP, and Brother printers use related but distinct schemes. Some encode the serial number in a different bit order. Some include additional metadata. The EFF’s list of manufacturers and models known to include tracking dots is essentially every major colour laser brand sold in North America and Europe.
What the dots do not contain is a username. They do not know who pressed print. They do not record the content of the document, the IP address of the computer that sent the print job, or the network the printer was connected to. They identify a machine and a moment, not a person.
The person comes from cross-referencing. A printer’s serial number ties to a purchase record, which ties to a buyer, which ties to a location. The timestamp ties to access logs, security cameras, badge swipes, and email metadata. The dots are one piece of forensic evidence that becomes powerful only when combined with everything else investigators can pull together. For counterfeiting cases — the original use case — that combination is usually enough.
The privacy question that never quite got asked
Monochrome laser printers do not embed yellow dots, because they cannot print yellow. Whether they embed other forensic markers — micro-perturbations in the spacing of black pixels, subtle modifications to character shapes — is less well understood. Monochrome printers may carry identifiers of their own, encoded in ways that are harder to see and harder to decode, but no public reverse-engineering project has produced a clean decoder the way the EFF did for the Xerox colour scheme. Inkjet printers are also a gap; most consumer inkjets do not appear to use the yellow-dot system, though some higher-end photo inkjets do.
The strange thing about the yellow dots is how quietly they entered the world. There was no congressional hearing. There was no class-action lawsuit. There was no warning label on the box of a new printer explaining that every page would carry a forensic identifier traceable to the buyer. The arrangement between the Secret Service and the manufacturers was voluntary, informal, and apparently effective enough that it has continued for forty years across multiple presidential administrations and a near-total transformation of the printing industry.
That kind of background surveillance has since become common. Smart TVs report viewing habits. Cars log driving data. Phones broadcast location to a dozen services at once. Office printers may now be the smallest example on the list; they were arguably the first. And while owners can do little about the dots themselves, they can at least make sure the device isn’t also broadcasting access to outside attackers through unpatched firmware.
Anyone trying to leak a document anonymously today, knowing what is known now, would photocopy the original on an older monochrome machine, or scan it and print on a black-and-white laser, or photograph it. The dots are a known problem with a known shape, and the security research community has been writing about how to defeat them since 2005.
Pick up any document printed on a colour laser in the last forty years. A tax return. A real estate contract. A school flyer. A wedding invitation. A printout of a recipe. Hold it under a bright blue LED, or scan it at 600 dots per inch and zoom into the white margins. The dots are there. The serial number of the printer that made the page is encoded in them. So is the minute it was printed.
Most of those pages will never be analysed by anyone. They will be filed, recycled, forgotten. The dots will sit on them indefinitely, a small forensic signature embedded in the paper itself, waiting for an investigator who will never come.
For Reality Winner, the investigator came within days. She is out of prison now, released in 2021. The printer is still in the office in Augusta, presumably, still stamping yellow dots on every page it touches, still keeping a record that no one in the room can see.
