And there’s no trace
Across different sources, the technology used to mark paper with printers has many names. Some call it tracking dots, others yellow dots, or a machine identification code. In forensic work the system is often described as tracking points. That term is common among OSINT specialists, including Andrei Masalovich, a former KGB lieutenant colonel and founder of the Avalanche Internet monitoring platform.
Tracking points function as a form of steganography. They hide information inside ordinary print data so that a reader sees nothing obvious and may not even suspect the presence of a hidden code. Masalovich describes it as a covert channel that blends into the page and remains invisible without special tools or lighting.
Most agree the technology was created by Xerox in the 1980s at the request of the U.S. government to crack down on counterfeit invoices. Tiny yellow dots are printed on paper, dots that are invisible to the naked eye under normal conditions.
The dots are arranged to form a code that can reveal the printer’s serial number, the print date and time, and in some cases even identify the person who ran the print job.
Officially the tracking points were introduced by Xerox at the government’s request to catch counterfeiters. Since then other office equipment makers have adopted similar marks. The Dutch police publicly disclosed their use in 2004 as part of evidence in investigations.
Over time Xerox and later other manufacturers limited transfers of the decryption keys to law enforcement agencies for criminal cases. Canon said it added the technology to its devices to minimize misuse. Masalovich notes that today the option is present in devices from many manufacturers, though implementations vary by model.
In 2018 scientists from the Technical University of Dresden analyzed more than a hundred printer models from eighteen manufacturers. They found several models that clearly displayed the dots, while others left faint traces. The conclusion was that most devices reveal some form of the marks, though quality varies.
Successful borrowing
Masalovich notes that in Russia the technique was adopted in the 1990s at the request of state institutions. The stated purpose matched the West: to investigate and prevent fraudulent securities and counterfeit paperwork.
There are many nonbank securities that are printed on ordinary color printers, such as MMM tickets, coupons, shares, and bonds. The dots began to be used to distinguish genuine documents from fakes right away, Masalovich explains.
Today the technology is widely used when forensic examiners assess documents. Fedor Muzalevsky, head of the technical department at RTM Group, told a news outlet that investigators often face the question of which printer produced a document and when it was printed. The microlabel technology helps law enforcement, detectives, and information security professionals investigate crimes.
Cybersecurity expert Dmitry Boroshchuk, head of BeholderIsHere Consulting, adds that colleagues occasionally rely on monitoring points to analyze information leaks. The marks can help determine which employee printed the leaked document and on what device, a practice that arises in cases of corporate espionage and trade secrets misappropriation.
Secretly all over the world
Hidden markings become visible when a page is illuminated with blue light. The dots are extremely small, with a radius of about 0.1 millimeter, roughly the thickness of a human hair. Even if every mark is detected, deciphering the code requires careful preparation and prior knowledge.
Dmitry Boroshchuk notes that as soon as tracking points were discovered, enthusiasts began building software to detect and decode them automatically. One example is a tool known as DEDA, described in public technical discussions and repositories. It can scan pages and, in some configurations, configure printers to print user information as hidden dots.
Some caution is warranted. There is a theoretical risk that such tools could be used to transmit covert messages or to contaminate pages in a way that compromises the integrity of the factory marks. Researchers warn that if misused, it could be used to cause harm or mislead investigators.
Fyodor Muzalevsky adds that the technology could potentially be used to wrongly tarnish a person’s reputation in cases of unfair competition. The possibility exists because the marks can be used to frame a document produced by a specific printer owner.
Despite debates about its impact, experts generally believe that the technique remains a niche concern. Its complexity and the careful controls around encryption and key access limit its reach, so it does not pose a widespread threat to the average user.