Maybe they were hoping that the scanner would try to recursively scan the returned image, and trigger some sort of buffer overflow or denial-of-service. This s

Maybe they were hoping that the scanner would try to recursively scan the returned image, and trigger some sort of buffer overflow or denial-of-service. This still seems like an unnecessarily painful way to carry out such an attack though. The attack would make a little more sense if it was a response to the increasing prevalence of biometric-scanning public surveillance, but in which case the mark shouldn't be on his upper arm and instead be on his right hand or forehead. Anyway, if the domain ever does expire, I'm sure someone could write some software which does a brute force search for alternative QA codes that are unchanged when (visually?) XORed with the existing design, but which point to a domain that hasn't been registered yet. He should perhaps work out what the minimum such change needed is and register the corresponding domain now, just in case.