Uniquifying PDF for traceability

Question

I am planning to send out a confidential document to a number of people. Each of them will have to sign a non-disclosure agreement. Yet, maybe the document will find its way to the internet. If I happen to come across the document, I want to be able to identify who's made it available on the internet so I can contact the person.

How would I embed some sort of invisible signature that I can verify on a published version? I don't want the user to go through the hoops of entering a password. I also don't want to embed a clearly identifiable name. I'd just create a spreadsheet with names and associated embedded signature for later identification purposes.

I understand nothing's foolproof and someone could just copy the contents, rewrite it or whatever. I just want to increase the hurdle by embedding some sort of "silent" code in the hopes the infringing party was careless enough to just make the document available as is.

I would prefer to use some simple LaTeX code, accessing something like pdfinfo, rather than using a third-party tool.

Any suggestions?

Answer 1

You do ot need any LaTeX code: Every PDF file is supposed to have a unique ID, to see it just open the PDF file in a text editor and at the end of the file you find a line like this(with a different ID of course):

/ID [<B825FFAF5C24E0EBBF2E5D369546DC86> <B825FFAF5C24E0EBBF2E5D369546DC86>]

If you recompile your file, the ID changes.

You only care about the first ID, the second one is for tracking changes to the file: Here the secind is equal to the first, so we have the original file. A program which changes the file is supposed to change the second ID and keep the first one intact.

Of course, this might be too obvious. It is easy for the receiver of the document to change these IDs.

You can also just write down the CreationDate (you can find it for example with pdfinfo). If you create a seperate file for each person, the will probably differ by a second or more.

Answer 2

Nobody in his right mind simply publishes a pdf as it is in the internet after signing a NDA. So how to find out, if the receiver of your PDF thinks twice before publishing?

The idea of an ID of any PDF doesn't help, because the ID changes completely if you send the PDF-file through a PDF-printer as pdf24 eg.

You have to produce individual PDFs for each receiver, which differ on every page. The easiest way to do that is to change the font or the fontsize and this will change a lot of line breaks on each page. The best way IMO is to have individual texts.

Clever receivers might just copy the text out of your pdf. You might produce a sandwich pdf and have a typo in the invisible background text, which differs only a little from the typo in the visible text.

Besides that, you can produce very indivually looking PDFs with the very nice luatex-package chickenize. The option randomcolor_grey might help you.

There is much more what you can do: use eso-pic for a dot-matrix in the background and so on. Countermeasure: take pictures with your mobile from the screen and run them through an OCR.

However, can't you just change the critical part of the text a little bit for each individual PDF?