FTC Targets Copy Machine Privacy Concerns 89
itwbennett writes "In a letter to US Representative Ed Markey, FTC Chairman Jon Leibowitz said that the FTC has begun contacting copy machine makers, resellers, and office supply stores to inform them about privacy concerns over the images that can be stored on the machines' hard drives and trying to 'determine whether they are warning their customers about these risks ... and whether manufacturers and resellers are providing options for secure copying.'"
Re: (Score:1, Offtopic)
couldn't you just make ten louder?
Re: (Score:3, Informative)
For $2000, I'll build you one that goes to twelve. That's less than $200 per.
Re: (Score:2)
couldn't you just make ten louder?
That would then just make 11 even louder still...
Re: (Score:2)
woooosh...
Re: (Score:2)
woooosh...
You'd like to think so, but in the context of the meme there is always an 11, so making 10 louder automatically makes 11 better yet and even greater still [wikipedia.org], because that's the point of that whole meme.
Rob Reiner (Marty) was asking the same thing... and missed the same point that to the artists mind 11 is simply BETTER than 10... how could it not be.... It's fucking 11 man!
Re: (Score:3, Insightful)
Re: (Score:2, Informative)
Either you don't work in an office of any considerable size or you have no idea what you're talking about. I'm voting for the latter. And FWIW, they're using the term 'copy machine' to refer to the super copier/printer/scanner/fax/do-everything boxes that offices have these days.
Re: (Score:3, Interesting)
Re: (Score:1)
But just because you can do some thing the hard and geeky way, doesn't mean you should. There are good reasons to store them on a file server, but having that same storage on the copier easies off many people that don't really need external file storage just for saving the copiers queue.
Re: (Score:3, Interesting)
Re:There machines don't need hard drives. (Score:4, Insightful)
I was at a conference three weeks ago where the subject of "self encrypting drives" (the ones with encryption in the drive firmware) came up and one of the other people representing a large business there mentioned that he buys those drives for his printers and that they use them. So there are use cases where it makes sense.
Their machines require hard disk drives (Score:3, Informative)
Most copiers do more than copy. They can accept a job over the network, they can use forms or other co-created information, and they can be used to adjust an image after it has been accepted. All t
Re: (Score:1)
We do the same thing, even though ours has several gigabytes worth of storage, including incoming faxes. Most of the clueless will rave over this feature until the first time the machine is serviced and the tech blindly wipes everything out. Can't kill em, can't fire em, screaming does no good...
- Dan.
Yes they do need hard drives. (Score:5, Insightful)
You put a stack of papers into them, hit the copy 10 times button. It has to print 10 stacks of papers. You want to stand there shoving the paper through 10 times while it does it?
Re: (Score:2)
And 1tb of hard drive space costs only about $100, less than 1% of the total copier's cost.
Yes, if they wanted to spend more to do less, that would certainly be an option!
Re: (Score:2)
1 GB of RAM alone can store a huge number of scanned pages. Given the cost of commercial copiers, having them contain 16 or even 32 GB of RAM wouldn't affect the cost very much.
Copiers also tend to have a longer service life than, say, a gaming PC. How long has 16 GB of RAM been as affordable as you claim?
Re: (Score:2)
Most are leased on a 3-year cycle.
But are they lease-to-own, or does a used off-lease copier go to the next lessee?
Re: (Score:3, Insightful)
1 GB of RAM alone can store a huge number of scanned pages. Given the cost of commercial copiers, having them contain 16 or even 32 GB of RAM wouldn't affect the cost very much.
For black and white documents, definitely true. Supposing 600 DPI, an 8.5x11" page of bitonal data (1 bit per pixel) takes up 4207500 bytes. If you just stopped there, you could store 255 pages per gig, which isn't a terribly impressive capacity... But using a compression method like JBIG2 which can give upwards of 50x reduction fo
Re: (Score:2)
Re: (Score:2)
We've also confirmed with Xerox that they securely wipe all units returned from lease before releasing or selling them so it's not an issue for us.
They securely wipe? So you let a few guys from the local service company load it on a truck and take it away, hoping that it's kept securely until it gets back to Xerox's factory, makes it through their receiving queue, and gets an inter-lease refurb?
Seems like, if you really cared, you'd rather have it wiped before it leaves your sight.
Re: (Score:2)
Even discounting large inexpensive RAM, this feature still wouldn't require you to manually feed paper, like Colin_Smith suggested. The copy machine at my elementary school back in the early nineties had the ability to put a stack of papers on it, and it could make as many copies as you wanted purely mechanically. The only copier features that I have seen that needed a hard drive, are ones that no one uses because the interface is far too complicated for what should be a simple to use device.
Re: (Score:2)
I'm pretty sure RAM does that job just fine. You don't need permanent memory.
Re: (Score:3, Informative)
Short answer, yes they do need nonvolatile, writable storage.
Re: (Score:2)
It seems to me that the bulk of these "they don't need storage" posts are coming from people who have NO IDEA how these things really work, and they have these wild ideas of how things "should be" based on their limited, and often faulty, knowledge.
Slightly OT here but it's my experience that this applies to the overwhelming majority of "X doesn't need Y because ..." arguments.
--
Nilt
Re: (Score:2)
Re: (Score:2)
Some also permanently store other sets of information such as the contents of every file copied, etc. ;p
Re: (Score:2)
RAM isn't cheap. Take the cheapest hard drive you can find. See how much memory you can get for the same price. Is that amount of memory enough to store, say, a few hunderd 1200 dpi full color A4/letter sized scans? I bet it isn't, so you'll need to spend more if you want to use RAM, for no observable benefit (except privacy of course).
HD is cheaper, plenty fast enough (sequential access), and even the cheapest $40 HD has so much capacity it's not worth even calculating how many pages it can store... But if
I was wondering about that (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
You obviously haven't used many modern copiers. Of the three on my floor, all of them are more computers with heavy duty printers attached than dumb scanner/printer combos. All have hard drives which store frequently printed documents, the 'OS' (which in some cases is a customized version of Windows), and the temp files necessary to do their 'job'.
The problem is that your average paper pusher still thinks of a copier as a low tech mimeograph rather than realize exactly how complicated and 'multi-featured' t
Re: (Score:2)
Yes a shitty-ass computer with a horrible interface. I want to treat them like dumb input/output devices because that is what they are good at.
Re: (Score:2)
Maybe I want a copy of what I'm copying to remain on the hard drive for easy retrieval and reuse later?
Re:There machines don't need hard drives. (Score:4, Interesting)
Maybe I want a copy of what I'm copying to remain on the hard drive for easy retrieval and reuse later?
Missing the point. The copier's hard drive is basically a black box in most cases.
A) The copier probably already has a save to network, and send via e-mail function. Why wouldn't you choose that?
B) In most cases the copier's hard drive is by default completely inaccessible to the end user. There's no browse feature.
C) To access the data, you need to purchase a support package and use a proprietary tool.
D) To delete the data, you need to purchase a support package and use a proprietary tool.
This is a cash grab for the copier manufacturers. A safety net that most people don't know existed unless they place a frantic support call.
The reporting expose proved that there is no promise that the manufacturer will wipe drives after their lease is up, and if you do not know it exists, how can you plan to wipe it yourself if you re-sell it?
Re: (Score:2)
Companies like Xerox and Ikon also provide copier leasing services. We have about 10 of them on site here; all of them leased. When our contract is done, they take the copiers. Who knows what they do with the hard drives from there...
There are benefits tho. Not our property, not on our list of assets, which is a huge tax savings. The lease agreement includes no-charge service calls and all t
...And in unrelated news.... (Score:3, Funny)
FTC discovers that there are, on average, 42 scans of people's bottoms per Copy Machine.
Now back to you, Jim!
About time... (Score:5, Interesting)
At the time these were options that one needed to pay extra for, but for anybody concerned with privacy issues, it was available.
One can, of course, ask why the above options are not standard. After all, it is just a question of enabling some software options.
Re:About time... (Score:4, Interesting)
Why leave money on the table? If you can charge more for those features, do so. If they really are just a configuration change, then you can offer those modules "free" or at a "substantial discount" if you need to make the sale else never take less than what the customer is willing to give you.
Re:About time... (Score:4, Insightful)
And this kind of rent seeking behavior for things that should be getting done anyway, is the exact type of thing that leads to the regulations that will shortly be forthcoming here (hopefully, in this and many other scenarios).
It's amazing to me how many corporations fail to act with a fundamental level of decency and do the absolute minimum possible in terms of customer service and quality (or sell reasonable levels of those as a "premium service"), then howl and scream when people find that unacceptable and put regulations in place that require them to do what they should've been doing anyway. It amazes me more that anyone would defend that type of behavior.
If companies really want to stop hostility and regulation toward them, they should open a dialogue (a real one) with their customers, in terms of what they want, what they will pay to get it, what is negotiable, and what is not. Especially as choices become fewer and fewer, a lot of larger companies seem to think they can get away with anything and shrug off the loss of a few customers. At that point, the only option left is regulation. One way or another, the customer's going to be king, and you better treat him accordingly. Squeezing every nickel out you can is anything but.
Re:About time... (Score:4, Insightful)
A conversation about what they want?
The vendor wants what everyone *wants* -- a new Mercedes every 2 years, not flying coach, a boob job for his wife AND mistress, and you to pay for it.
How hard is that to understand?
Re: (Score:2)
You really thought I meant what the "vendor" wants? I don't care. I mean what the -customer- wants.
And please don't presume to think your personal desires apply to everything. I really don't give two shits about what you put forth, and I don't think I'm at all the only one. Give me something interesting to work at and something new to learn over those anyday. I don't even like driving anymore that well. Give me a new Mercedes every two years, and I'll still generally ride my bike. Mercedes get caught in tra
Re: (Score:2)
Customer wants a pony, a unicorn, and about a dozen flying monkeys. Oh, and for nothing. If you ask them. Already we're about 10% cheaper than our competitor. Sometimes even more when we're going in and installing on existing hardware. But we also offer merchant accounts (Credit Card Processing) and will discount our "on-premise implementation consulting" fees if needed to land a deal. However, those costs are on par with our competition and if a client doesn't object, we don't discount. Again, why
Re: (Score:2, Interesting)
Re: (Score:1)
Re: (Score:3, Informative)
I DO work for a printer company that makes multi-function printers that can, in fact, make copies AND write data to an internal hard drive. Except, the conditions for it to do so, at least on the printers we make, require you to be doing a job that you are specifically saving to disk to be printed at a later time (that is, you or the admin set it up that way, as that is not the default that we ship) or you have temporarily locked the machine from making ANY printouts until an unlock code is entered. In bo
deleted as in fat delete? or fake deleted? (Score:3, Interesting)
deleted as in fat delete? or fake deleted?
fat delete can be some times be undeleted.
But some boxes / tivos do a fake delete that just removes that data from the list but it's still there likely in some temp file.
as for leased copiers how much is locked out / not (Score:2)
as for leased copiers how much is locked out / not allowed to be done by on site stuff?
and I think may off lease copyeea just get sold and how many leasing companies do a full reset? they may just do a factory reset that does not do a full data nuke.
Re: (Score:2)
Why don't you suggest that your company just go ahead and secure-wipe all files all the time?
I mean, it's a frickin copier. It's not like it's pinning the CPU.
You don't even have to 'secure' wipe. That's for suckers. No one has ever demonstrated the ability to reconstruct data on a modern hard drive that's been overwritten just once. (All those studies about multi-pass were a) hypothetical, and b) based on old MFM encoding and much wasteful hard drives.)
Hell, there's probably a shared library you can lin
That's nothing. (Score:5, Interesting)
That's nothing.
Lots of places still use old brother fax / copy / print machines which utilize "ribbons" instead of ink or toner. This is what they look like
PC-301 [images-amazon.com]
It's basically a big carbon transfer sheet. You find these old machines in doctors offices. law offices. etc. Where the owner is too lazy to upgrade their hardware.
They throw out the used ribbon. Guess what? Its literally hundreds of feet of perfect, inverted copies of faxed information. Forms with medical information. SSN numbers. Private legal information. ETC.
All it requires is someone to be lazy enough to throw it away, and someone else bored enough to go dumpster dive.
That was a fun $250k audit (Score:4, Informative)
It had really cool features like the ability to scan tons of documents all at once, then you go back to your computer and download them from a network share!! such a productivity booster!
So this nice $250k device, which they bought, with no security... which of course did not pass standard security audit...
Scanning confidential documents happens every day... and at the bank for which I work, we take it pretty seriously.
Even disabling the network interface wasn't enough, because users could *accidentally* scan/copy a document and set it to store, which could be accessed by non-permitted individuals. In the end they ended up taking a bath on the whole device.
You're kidding? (Score:2, Insightful)
Re: (Score:2)
I recall the early laser printers in use internally at Xerox - the ones I saw were a standard copier modified/altered to be a printer. From a distance, the biggest hint that it was a printer and not a copier was an extra box stuck on the end and, behold, an Alto nearby.
Of course, IIRC, they wouldn't function as a copier anymore, so maybe it doesn't count.
Now get off my lawn.
Windows (Score:4, Informative)
It's apparently pretty common for these machines to run an embedded copy of Windows these days. I know someone who was a sysadmin at UC Berkeley a few years back, and she had to clean up the mess when their photocopier picked up a Windows virus and became a spam zombie. This seems similar to the kind of situation we're seeing with people's home routers and cable modems getting owned. The basic problem seems to be that the end user buys something that is a general-purpose computer, but the manufacturer doesn't present it to them as a general-purpose computer that needs maintenance, security patches, etc., and the manufacturer may also choose an initial configuration that is designed for ease of use rather than security (e.g., having passwords that the user doesn't set).
If the only problem was getting your images read out by someone else when the machine is resold, that would seem pretty minor to me. Can't they just design the machine so that the memory used for temporary storage of images is volatile? Then as soon as you unplug the machine that you're going to resell, the memory is wiped.
But if your copier is getting owned by hackers while you're still using it, then the presence of the left-over images seems like it becomes a bigger issue, and harder to secure yourself against.
Re: (Score:2)
Can't they just design the machine so that the memory used for temporary storage of images is volatile?
RAM is not free, especially RAM to store scans of a 40-page document. So they store the scans on a hard drive. I guess one workaround for the cost of RAM would be to encrypt the scans on disk and keep the keys in RAM.
Re: (Score:2)
Re: (Score:2)
Then they lose the opportunity to charge you $1500 for a 20 gig hard disk.
Re:Windows (Score:4, Insightful)
Easier option: the copier deletes the files from the hard drive after the copy run's completed and the images aren't needed anymore. Ditto when documents are scanned and delivered elsewhere (eg. e-mailed to the user). Only store them permanently when the user scans them in and deliberately stores them in the copier. It's not that hard to make it behave that way.
Undeletion (Score:2)
the copier deletes the files from the hard drive after the copy run's completed and the images aren't needed anymore.
Files that aren't encrypted can be undeleted [wikipedia.org].
Re: (Score:2)
From a UI/human interaction perspective, it is kind of a walking disaster. Humans are lazy, clueless, and easily distracted(even the smart ones, if you catch them at a bad moment, which everybody has).
Unless you make copiers for Spook HQ(and possibly even then), you'll get far more flack for "the copier lost my document" than you will praise for "the copier
Re: (Score:1)
Can you prove any of your claims other than you knew a Systems Administrator at Berkley (that has lots of them) telling you that their copiers used Windows?
Our Canon imageRunner's 5000 and 5070 don't use Windows nor do our Dell's or our HP's for that matter.
Or our color copier "a few years back" that used a Silicon Graphics Toaster.
I've been doing this for 18.5 year
Is there a law? (Score:1, Troll)
Is there a constitutional law that was properly added to "the books" that requires copiers have "secure option," that sellers notify buyers of privacy concerns, and so on? Or, is Obama's administration just legislating by decree again?
Re: (Score:2)
Funny. The typical Slashdotter foams at the mouth about how the government is supposed to protect privacy - his privacy. But when it's not his privacy directly at stake, the government is held to be the villain.
Re:Is there a law? (Score:4, Insightful)
unless you would like to suggest that copy machines are in fact manufactured and sold all within a single state.
Re: (Score:2)
Naughty bits (Score:1)
What about the dots? (Score:5, Insightful)
Of course they don't give a damn about the serial numbers that each copier embeds in every page they print. [eff.org]
This is nothing new or secret (Score:2, Interesting)
I work for a copier manufacturer and can shed a little info for those that are interested.
Small office multifunction devices (MFD's) typically don't have hard drives and run embedded real-time operating systems. Some of the newest models DO have SATA hard drives, but the ability to enable "Immediate Image Overwrite" is well documented in the manual and is free.
Mid-sized copier-only configuration machines use Electronic Page Collation RAM to store scanned images and there is no hard drive.
Mid-sized multifunc
Re: (Score:2)
I suspect that this is more of an "issue" farther down the food chain.
Large entities and/or especially those with security experience (banks, defense contractors, law enforcement) are probably naturally suspicious of any duplication technology and ask a ton of questions. They're also used to dealing with vendors who have experience selling to this field and understand that a low-level how-it-works transparency is necessary, probably both to win the business AND avoid some kind of Federal investigation in c
encryption by default (Score:1)
gee wiz here we go again (Score:1)
What's with the size of those hard drives? They don't need to be so large. Seems as though a small flash drive could be just as efficient.
Also look at the money they will be getting just to supply a app to erase that data. Total rip off.
I am crying foul over the whole deal. Just give it a little time, and someone will create a free app to clean those hard drives. I bet it