7 ms·

Most interesting parts (IMO): “Program and program settings: When preparing the letter, WordPad for Windows is most likely used. Default settings for font, lin

Most interesting parts (IMO): “Program and program settings: When preparing the letter, WordPad for Windows is most likely used. Default settings for font, line spacing and paragraph are used. The page layout has been Letter.” That, I think, can be inferred with good confidence from precisely measuring various font measurements, looking at how lines got broken, etc, and comparing that with a database of program defaults for a large set of OSes and programs. “Device, operating system and video card : When designing the threat letter, a Windows PC has been used, with an operating system Windows 10 or 8.” I guess either WordPad or the font got tweaked somewhat in that Windows version. Maybe WordPad started using ligatures more aggressively, its page width got a tiny bit wider, or, in the font, some letter shape or spacing table changed a tiny bit, or a character was added. “The PC has had an integrated video card, Intel HD Graphics 630.” That, for me, is the most intriguing part. Does Windows use the GPU to render fonts even if they get printed, and are there subtle differences between GPUs and their software rendering that, statistically, can be recovered from the somewhat noisy print?

mjbeswick 5y ago
Maybe most of this profile is pure speculation based statical probability?
- Someone 5y ago
  In the end, it’s statistics, yes. Maybe, a Mac running a windows VM could produce similar output, or somebody could run Linux, copy over the specific fonts from Windows 8, tweak font rendering to match Windows (e.g. in when to use type hints), fiddle with line spacing and page width until their LibreOffice or abiword produces the same line breaks and spacing, etc, but that somebody would try to do that is quite unlikely to start with and also may be very hard to accomplish (and that’s something experts could have tried to do. If so, they could testify about the difficulty of pulling it off) ⇒ I don’t think it’s fair to call this speculation, let alone pure speculation.
rmbyrro 5y ago
This is unrealiable and extremely risky to serve as case evidence. Becomes extremely easy for malicious actors (out or inside the police) to fake evidence and frame anyone they'd like.
- vintermann 5y ago
  It's probably meant as a lead, not as evidence. Given that this is a kidnapping, likely murder case, there's probably tons of evidence if you're looking at the right guy. And I'm wondering about that, because we know the criminal must have been a pretty hard-core cryptocurrency nut. There aren't THAT many of them in Norway (they've already concluded they are a fluent Norwegian speaker).
  - alophawen 5y ago
    > because we know the criminal must have been a pretty hard-core cryptocurrency nut Do we? I was still under the impression everybody was blaming her husband for the disappearance.
    - vintermann 5y ago
      I'm thinking of the actual kidnapper/killer. The husband has an alibi for the time of the disappearance. The suspicion against him was that he commissioned the disappearance of his wife, not that he did it himself.
  - dagw 5y ago
    they've already concluded they are a fluent Norwegian speaker The person who wrote the ransom they believe to be fluent in Norwegian, there could easily be other people involved who're foreign.
  - rmbyrro 5y ago
    My main concern is that this seems to be a precise lead. It might be unconsciously considered close to a real fingerprint. Instead of facing it just as a lead, it might influence investigators to, consciously or not, build confidence in framing a (wrong) person and and end up building a compelling case against them.
dagw 5y ago
Does Windows use the GPU to render fonts even if they get printed Most cheaper printers (esp. on Windows) use the GDI protocol for printing. These printers only know how to print rasterised images, so the document is rasterised by the OS/Print driver and only this final rasterised image is sent to the printer. This is different from higher end PCL/PS printers where the document is translated into a page description language and the printer is (partially) responsible for rasterising the final document for print. Since Windows uses the GPU to render fonts I wouldn't be surprised if the same code is used to rasterise the fonts for GDI printing. That being said I'm very surprised they can identify the GPU just from that, unless there is some specific bug in the driver for the card which produces an obvious font rendering artefact.
- noduerme 5y ago
  Brilliant comment. Coming at this as a typographer/graphic artist and erstwhile coder, I'd bet it comes down to reverse engineering anti-aliasing algorithms. I'm not sure how it's done in Windows, but on Macs there are various levels of crispness you can set in default type as it's rasterized and if you zoom in a bit they have very clearly recognizable differences. Take the four bottom-left pixels of a capital A at 300 ppi, and compare their ink value ratios with different anti-aliasing techniques, and I bet you could get a signature of what card did the rasterization. Gaussian blur is your friend if you wanna send a death note, I guess.
  - Someone 5y ago
    I don’t think printer drivers do anti-aliasing on text. The hardware of a printer does anti-aliasing for free. Also, I doubt you can get conclusive evidence from a single letter. Luckily, your average random note has lot of them, even duplicated ones. I would carefully align and average out as many capital A’s as I had, and work with that.
    - noduerme 5y ago
      IDK. In the olden days, desktop printers sometimes had embedded font faces or PS1 fonts would be sent to the printer, but any vector file for large/high-res print quality had to be "ripped" or rasterized first, usually with a dedicated card. These cards definitely had signature looks and feels to them, but so did the fonts. There were differences between the way an Adobe Times New Roman would rip versus the one that came stock on your Apple IIsi. Pinpointing a version of Windows, if it was printed from a stock OS font, could be as simple as comparing tiny differences in the vector files and knowing if one pixel would rasterize at 60% black versus 50%. To the extent that the rip goes through a graphics card, it would be knowing whether that card rendered the 60% as 58% or 62%. I'm pretty sure if you scale it down, the printer driver will do an extra layer of downsampling and add its own anti-aliasing; but the printer hardware doesn't do that, it just sprays the dots it's told to spray, and in general the drivers replicate the pixels that are sent from Photoshop or in this case, MS Word, which uses something like QuickDraw used to be on a Mac, an embedded system process, to rasterize the fonts.
oneoff786 5y ago
I had to chuckle at the first part. Ah yes, I see they’re using the default formatting options. That narrows down our search to 99.9999% of the population.
- dagw 5y ago
  Letter paper size isn't the default paper size for most Windows computers in Norway, so that could be something.
  - iampivot 5y ago
    It's however the default size for most printer drivers, so it's often selected as default when trying to print for the first time.
    - bombcar 5y ago
      Huh you'd think Windows EU edition or whatever would be smart enough to default to A4.
    - moistly 5y ago
      Europe doesn’t use letter-sized paper, they use A4. I rather doubt that printer drivers installed on a Norwegian computer default to an unusable paper size.
      - vegardlarsen 5y ago
        We use the same printers and printer drivers as everyone else in the world. So it does actually default to Letter, and you usually have to change it upon first install. I guess it all comes down to who wrote the printer driver.
      - cure 5y ago
        I have news for you - the "PC LOAD LETTER" meme works all around the world. Printers and drivers a generally quite dumb about this, and default to Letter format (and this does not make any sense, obviously).
bryanrasmussen 5y ago
I would guess there must be forensic tools to detect this stuff, that the Norwegian police don't just have the best experts in Windows and printers in the world who then went through all the various systems, but that there should be a database of these variations somewhere and tools you can use to analyze a printed output to figure out where and what it was produced by, so what are these tools is my question.
sokoloff 5y ago
HD630 is the integrated GPU on Intel’s Kaby Lake line of processors. That narrows it down to coming from 10s of millions of computer perhaps?
- ridgered4 5y ago
  I'm actually surprised they could narrow it down even that much. The skylake and coffeelake iGPUs always seemed basically identical to the kabylake one.
- chipsa 5y ago
  I'd be surprised if there was any noticeable difference between the HD630, and any of the other Gen9 architecture iGPUs.
phkahler 5y ago
This could all be deflection. All name-brand printers (in the US at least and probably everywhere) watermark printed pages with yellow dots that identify the printer serial number. If the printer is purchased with a credit card and the SN is scanned, there is a perfect trail from your printed page to the person who bought it. I suspect if that method was used they still may want to claim these other fingerprinting methods to avoid spreading the word about printers.
- abakker 5y ago
  Got a source for this claim? Edit: Specifically, what about printers that only print black and white?
  - shirleyquirk 5y ago
    https://en.m.wikipedia.org/wiki/Machine_Identification_Code https://en.m.wikipedia.org/wiki/Machine_Identification_Code but idk about how many printers do this or whether similar techniques are used for black+white printers (i.e. gray-scale modulation)
  - k1t 5y ago
    https://en.m.wikipedia.org/wiki/Machine_Identification_Code https://en.m.wikipedia.org/wiki/Machine_Identification_Code https://www.eff.org/press/archives/2005/10/16 https://www.eff.org/press/archives/2005/10/16 The implication is that only color printers are affected. "The U.S. Secret Service admitted that the tracking information is part of a deal struck with selected color laser printer manufacturers, ostensibly to identify counterfeiters."
    - macksd 5y ago
      People are really using consumer printers in counterfeiting?
      - bragr 5y ago
        No because most will refuse to print anything with the EURion constellation. https://en.m.wikipedia.org/wiki/EURion_constellation https://en.m.wikipedia.org/wiki/EURion_constellation
thewebcount 5y ago
> are there subtle differences between GPUs and their software rendering that, statistically, can be recovered from the somewhat noisy print? I'm not sure these days when most GPUs are IEEE-754-compliant. But back in the mid to late 2000's I worked on a GPU renderer for video editing and we had a few filters that gave noticeably different results on different GPUs. One filter did a hard black and white threshold, then blurred the result, did another hard threshold, etc., in a loop. Because of differences in precision of the floating point values (24-bit on AMD at the time, if I recall correctly), the thresholds could produce minor differences that got magnified by the blurring, and then created new thresholds with minor differences, etc. Even if all the GPUs are using IEEE-754 floats, there are driver differences that can cause the results to be slightly different, too. Like a simple GLSL mix() function could be implemented as result = x * a + y * (1 - a) (where x and y are 2 input pixels and a is the alpha of x). Or it could be implemented more efficiently as result = a * (x - y) + y. Doing the same math in a slightly different way can sometimes lead to slight differences in intermediate results which compound in the final result. So yeah, it may be possible to tease out some of these things by examining something like font rendering.
mmcgaha 5y ago
This is why I always write my threats and ransom requests in pure TeX. Seriously though, I thought printers have been using microdots as identifiers for years. Is this just an old wives tale?
- joering2 5y ago
  So it looks like both printer's fingerprinting and windows "fingerprinting" can both be fooled by simply making a B/W photocopy at local FedEx. Perhaps do copy of a copy of a copy 5 times and you should be good to go! Just make sure you pay with cash.

mjbeswick 5y ago

Maybe most of this profile is pure speculation based statical probability?

Someone 5y ago
In the end, it’s statistics, yes. Maybe, a Mac running a windows VM could produce similar output, or somebody could run Linux, copy over the specific fonts from Windows 8, tweak font rendering to match Windows (e.g. in when to use type hints), fiddle with line spacing and page width until their LibreOffice or abiword produces the same line breaks and spacing, etc, but that somebody would try to do that is quite unlikely to start with and also may be very hard to accomplish (and that’s something experts could have tried to do. If so, they could testify about the difficulty of pulling it off) ⇒ I don’t think it’s fair to call this speculation, let alone pure speculation.

rmbyrro 5y ago

This is unrealiable and extremely risky to serve as case evidence. Becomes extremely easy for malicious actors (out or inside the police) to fake evidence and frame anyone they'd like.

vintermann 5y ago
It's probably meant as a lead, not as evidence. Given that this is a kidnapping, likely murder case, there's probably tons of evidence if you're looking at the right guy. And I'm wondering about that, because we know the criminal must have been a pretty hard-core cryptocurrency nut. There aren't THAT many of them in Norway (they've already concluded they are a fluent Norwegian speaker).
- alophawen 5y ago
  > because we know the criminal must have been a pretty hard-core cryptocurrency nut Do we? I was still under the impression everybody was blaming her husband for the disappearance.
  - vintermann 5y ago
    I'm thinking of the actual kidnapper/killer. The husband has an alibi for the time of the disappearance. The suspicion against him was that he commissioned the disappearance of his wife, not that he did it himself.
- dagw 5y ago
  they've already concluded they are a fluent Norwegian speaker The person who wrote the ransom they believe to be fluent in Norwegian, there could easily be other people involved who're foreign.
- rmbyrro 5y ago
  My main concern is that this seems to be a precise lead. It might be unconsciously considered close to a real fingerprint. Instead of facing it just as a lead, it might influence investigators to, consciously or not, build confidence in framing a (wrong) person and and end up building a compelling case against them.

dagw 5y ago

Does Windows use the GPU to render fonts even if they get printed Most cheaper printers (esp. on Windows) use the GDI protocol for printing. These printers only know how to print rasterised images, so the document is rasterised by the OS/Print driver and only this final rasterised image is sent to the printer. This is different from higher end PCL/PS printers where the document is translated into a page description language and the printer is (partially) responsible for rasterising the final document for print. Since Windows uses the GPU to render fonts I wouldn't be surprised if the same code is used to rasterise the fonts for GDI printing. That being said I'm very surprised they can identify the GPU just from that, unless there is some specific bug in the driver for the card which produces an obvious font rendering artefact.

noduerme 5y ago
Brilliant comment. Coming at this as a typographer/graphic artist and erstwhile coder, I'd bet it comes down to reverse engineering anti-aliasing algorithms. I'm not sure how it's done in Windows, but on Macs there are various levels of crispness you can set in default type as it's rasterized and if you zoom in a bit they have very clearly recognizable differences. Take the four bottom-left pixels of a capital A at 300 ppi, and compare their ink value ratios with different anti-aliasing techniques, and I bet you could get a signature of what card did the rasterization. Gaussian blur is your friend if you wanna send a death note, I guess.
- Someone 5y ago
  I don’t think printer drivers do anti-aliasing on text. The hardware of a printer does anti-aliasing for free. Also, I doubt you can get conclusive evidence from a single letter. Luckily, your average random note has lot of them, even duplicated ones. I would carefully align and average out as many capital A’s as I had, and work with that.
  - noduerme 5y ago
    IDK. In the olden days, desktop printers sometimes had embedded font faces or PS1 fonts would be sent to the printer, but any vector file for large/high-res print quality had to be "ripped" or rasterized first, usually with a dedicated card. These cards definitely had signature looks and feels to them, but so did the fonts. There were differences between the way an Adobe Times New Roman would rip versus the one that came stock on your Apple IIsi. Pinpointing a version of Windows, if it was printed from a stock OS font, could be as simple as comparing tiny differences in the vector files and knowing if one pixel would rasterize at 60% black versus 50%. To the extent that the rip goes through a graphics card, it would be knowing whether that card rendered the 60% as 58% or 62%. I'm pretty sure if you scale it down, the printer driver will do an extra layer of downsampling and add its own anti-aliasing; but the printer hardware doesn't do that, it just sprays the dots it's told to spray, and in general the drivers replicate the pixels that are sent from Photoshop or in this case, MS Word, which uses something like QuickDraw used to be on a Mac, an embedded system process, to rasterize the fonts.

oneoff786 5y ago

I had to chuckle at the first part. Ah yes, I see they’re using the default formatting options. That narrows down our search to 99.9999% of the population.

dagw 5y ago
Letter paper size isn't the default paper size for most Windows computers in Norway, so that could be something.
- iampivot 5y ago
  It's however the default size for most printer drivers, so it's often selected as default when trying to print for the first time.
  - bombcar 5y ago
    Huh you'd think Windows EU edition or whatever would be smart enough to default to A4.
  - moistly 5y ago
    Europe doesn’t use letter-sized paper, they use A4. I rather doubt that printer drivers installed on a Norwegian computer default to an unusable paper size.
    - vegardlarsen 5y ago
      We use the same printers and printer drivers as everyone else in the world. So it does actually default to Letter, and you usually have to change it upon first install. I guess it all comes down to who wrote the printer driver.
    - cure 5y ago
      I have news for you - the "PC LOAD LETTER" meme works all around the world. Printers and drivers a generally quite dumb about this, and default to Letter format (and this does not make any sense, obviously).

bryanrasmussen 5y ago

I would guess there must be forensic tools to detect this stuff, that the Norwegian police don't just have the best experts in Windows and printers in the world who then went through all the various systems, but that there should be a database of these variations somewhere and tools you can use to analyze a printed output to figure out where and what it was produced by, so what are these tools is my question.

sokoloff 5y ago

HD630 is the integrated GPU on Intel’s Kaby Lake line of processors. That narrows it down to coming from 10s of millions of computer perhaps?

ridgered4 5y ago
I'm actually surprised they could narrow it down even that much. The skylake and coffeelake iGPUs always seemed basically identical to the kabylake one.
chipsa 5y ago
I'd be surprised if there was any noticeable difference between the HD630, and any of the other Gen9 architecture iGPUs.

phkahler 5y ago

This could all be deflection. All name-brand printers (in the US at least and probably everywhere) watermark printed pages with yellow dots that identify the printer serial number. If the printer is purchased with a credit card and the SN is scanned, there is a perfect trail from your printed page to the person who bought it. I suspect if that method was used they still may want to claim these other fingerprinting methods to avoid spreading the word about printers.

abakker 5y ago
Got a source for this claim? Edit: Specifically, what about printers that only print black and white?
- shirleyquirk 5y ago
  https://en.m.wikipedia.org/wiki/Machine_Identification_Code https://en.m.wikipedia.org/wiki/Machine_Identification_Code but idk about how many printers do this or whether similar techniques are used for black+white printers (i.e. gray-scale modulation)
- k1t 5y ago
  https://en.m.wikipedia.org/wiki/Machine_Identification_Code https://en.m.wikipedia.org/wiki/Machine_Identification_Code https://www.eff.org/press/archives/2005/10/16 https://www.eff.org/press/archives/2005/10/16 The implication is that only color printers are affected. "The U.S. Secret Service admitted that the tracking information is part of a deal struck with selected color laser printer manufacturers, ostensibly to identify counterfeiters."
  - macksd 5y ago
    People are really using consumer printers in counterfeiting?
    - bragr 5y ago
      No because most will refuse to print anything with the EURion constellation. https://en.m.wikipedia.org/wiki/EURion_constellation https://en.m.wikipedia.org/wiki/EURion_constellation

thewebcount 5y ago

> are there subtle differences between GPUs and their software rendering that, statistically, can be recovered from the somewhat noisy print? I'm not sure these days when most GPUs are IEEE-754-compliant. But back in the mid to late 2000's I worked on a GPU renderer for video editing and we had a few filters that gave noticeably different results on different GPUs. One filter did a hard black and white threshold, then blurred the result, did another hard threshold, etc., in a loop. Because of differences in precision of the floating point values (24-bit on AMD at the time, if I recall correctly), the thresholds could produce minor differences that got magnified by the blurring, and then created new thresholds with minor differences, etc. Even if all the GPUs are using IEEE-754 floats, there are driver differences that can cause the results to be slightly different, too. Like a simple GLSL mix() function could be implemented as result = x * a + y * (1 - a) (where x and y are 2 input pixels and a is the alpha of x). Or it could be implemented more efficiently as result = a * (x - y) + y. Doing the same math in a slightly different way can sometimes lead to slight differences in intermediate results which compound in the final result. So yeah, it may be possible to tease out some of these things by examining something like font rendering.

mmcgaha 5y ago

This is why I always write my threats and ransom requests in pure TeX. Seriously though, I thought printers have been using microdots as identifiers for years. Is this just an old wives tale?

joering2 5y ago
So it looks like both printer's fingerprinting and windows "fingerprinting" can both be fooled by simply making a B/W photocopy at local FedEx. Perhaps do copy of a copy of a copy 5 times and you should be good to go! Just make sure you pay with cash.