Mark a document so you can tell whose copy leaked CANARY
Each recipient gets the same text with a different set of invisible characters in it. When a copy turns up somewhere it should not be, paste it back here and CANARY reads the marks and says which copy it was. It works when the marks survived the route the text took, and a good deal of the craft is knowing when they did not.
Confidential source text
Who received which copy
How it works
What the marks are, and what they survive
The text you hand out is identical to read. What differs between copies is a short run of characters that have no width: zero-width space, zero-width non-joiner, zero-width joiner and word joiner. They sit between ordinary letters, carry a few bits each, and spell out which copy this is. Nothing about the visible wording changes, so two recipients comparing their copies side by side see the same document.
They survive an ordinary copy and paste, and they usually survive being pasted into a chat message, a document or a ticket, because most software moves the characters along with everything else rather than deciding they are not wanted.
What removes them, usually without anyone trying
- Retyping. Somebody who reads your memo and types it out again hands you a clean copy. So does dictation.
- A screenshot, or a photograph of a screen. The marks are characters; a picture of text has no characters in it. Running that picture through OCR gives text with none of them.
- Printing, and scanning the print. Same reason.
- Anything that normalises the text. Several chat platforms, content management systems, ticketing tools and mail clients strip invisible characters as a matter of course, and a journalist's own editor may do it before publication without the journalist knowing.
- Somebody who knows to look. The marks are not hidden from a machine, only from a reader. Any tool that lists the code points shows them at once (UNSEEN, on this site, exists to find exactly this), and once found they are trivially deleted.
What a result does and does not establish
A match tells you which copy the text in front of you came from. That is a real and useful fact and it is the whole point of the technique.
It does not tell you who passed it on. A copy can be forwarded, shared on a drive, left on a screen or taken from a mailbox, and the marks travel with it whoever moved it. Treating a match as proof of who leaked something is the mistake this tool is most likely to be used to make.
And an absence of marks establishes nothing at all. It is consistent with a copy that was retyped, screenshotted, cleaned by a platform, or that never came from a marked copy in the first place. If you intend to rely on any of this, say so to a lawyer before you hand the documents out, not after.
Using it without making things worse
- Mark each copy at the moment you send it, one recipient at a time, and keep your own record of which identifier went to whom. The tool does not keep that for you and should not.
- Tell people the document is marked if your relationship with them allows it. A watermark that everyone knows about deters far more than one that catches somebody afterwards.
- Check what your own systems do to the text. If your mail client or your intranet strips invisible characters, every copy you send is clean and you will learn that only when it matters.
- Do not use it on anything where being caught out by a false negative would be serious. It is a deterrent and an indicator, not evidence.
Doing this often? When a document does leak, the OBSCURA Sovereign Suite runs it as an incident from a playbook, with the reporting clocks and notice drafts. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.