OSINFO - Open Sources Information

A Singapore firm has an affordable way of tracing a leaked printout. IRENE THAM reports

IN A bid to stem the pilfering of data through the use of USB drives and camera phones - by banning these devices at work - employers may have forgotten a more basic way of data theft: the humble paper.

A study in February in the United States of 945 people who had lost their jobs in 2008 showed that paper was the most popular format for stolen data, with 61 per cent saying they took hard copies.

The study - conducted by research firm Ponemon Institute and sponsored by Symantec - identified CDs and DVDs as the second most popular conduit for data theft, followed by USB drives and e-mail.

Another study - Information Security Incident Survey Report by the NPO Japan Network Security Association - found that more than 40 per cent of all information leaks in 2007 was in paper form.

There had been no cost-efficient way of auditing the paper trail until ID-Trace came along.

The invention of six-year-old home-grown firm RadianTrust, ID-Trace uses a patent-pending program that inserts a covert but traceable 'electronic fingerprint' in paper documents - much like steganography. When a leaked document is retrieved, organisations can identify the culprit.

'There is no way of preventing data leak as long as you still allow employees to print,' said Tang Weng Sing, general manager of RadianTrust, a subsidiary of CrimsonLogic. ID-Trace, which had been cooking in the firm's labs over the past three years, will be sold worldwide from next month.

RadianTrust's previous invention - an appliance that embeds optical watermarks and microprints on printed documents - has found customers such as the Agri-Food & Veterinary Authority of Singapore and the Government of Maharashtra in India.

ID-Trace made its debut at CommunicAsia2009 last week.

The firm's other program, EzVerifier, works with ID-Trace to 'read' the electronic fingerprint.

The identity of the person who printed the document, the printer and the time and date of the print job can be determined by scanning the document and running it through EzVerifier.

'No special ink, papers or printers are required unlike other forms of steganography today,' said Weng Sing. Other solutions include the use of UV ink, visible only under special UV light, and special printing paper with RFID tag embedded. These methods are expensive and can be circumvented by faxing or photocopying.

EzVerifier, on the other hand, can read the electronic fingerprint on a document even if the document is a replica of the original.

Also, burning, tearing or shredding the printout will not destroy the electronic fingerprint. As long as a part of the destroyed paper is restored, RadianTrust's technology is able to do its magic.

The Singapore Government has expressed interest in ID-Trace, which has a five-figure price tag, he said, and so have financial institutions overseas.

'No amount of USB drive ban, electronic auditing and data encryption is going to help as long as organisations still use hard copies.'

itham@sph.com.sg