On 3 June, FBI agents arrived at the house of government contractor Reality Leigh Winner in Augusta, Georgia. They had spent the last two days
investigating a top secret classified document that had allegedly been leaked to the pres s. In order to track down Winner, agents claim they had carefully studied copies of the document provided by online news site The Intercept and noticed creases suggesting that the pages had been printed and “hand-carried out of a secured space”.
In an affidavit, the FBI alleges that Winner admitted printing the National Security Agency (NSA) report and sending it to The Intercept. Shortly after a story about the leak was published, charges against Winner were made public.
Many colour printers add the dots to documents without people ever knowing they’re there
At that point, experts began taking a closer look at the document, now publicly available on the web. They discovered something else of interest: yellow dots in a roughly rectangular pattern repeated throughout the page. They were barely visible to the naked eye, but formed a coded design. After some quick analysis, they seemed to reveal the exact date and time that the pages in question were printed: 06:20 on 9 May, 2017 – at least, this is likely to be the time on the printer’s internal clock at that moment. The dots also encode a serial number for the printer.
These “microdots” are well known to security researchers and civil liberties campaigners. Many colour printers add them to documents without people ever knowing they’re there.
In this case, the FBI has not said publicly that these microdots were used to help identify their suspect, and the bureau declined to comment for this article. The US Department of Justice, which published news of the charges against Winner, also declined to provide further clarification.
In a statement , The Intercept said, “Winner faces allegations that have not been proven. The same is true of the FBI’s claims about how it came to arrest Winner.”
But the presence of microdots on what is now a high-profile document (against the NSA’s wishes) has sparked great interest.
Based on their positions when plotted against a grid, they denote specific hours, minutes, dates and numbers
“Zooming in on the document, they were pretty obvious,” says Ted Han at cataloguing platform Document Cloud , who was one of the first to notice them. “It is interesting and notable that this stuff is out there.”
Another observer was security researcher Rob Graham, who published
a blog post explaining how to identify and decode the dots. Based on their positions when plotted against a grid, they denote specific hours, minutes, dates and numbers. Several security experts who decoded the dots came up with the same print time and date.
Microdots have existed for many years. The Electronic Frontier Foundation (EFF) maintains a list of colour printers known to use them. The images below, captured by the EFF, demonstrate how to decode them:


As well as perhaps being of interest to spies, microdots have other potential uses, says Tim Bennett, a data analyst at software consultancy Vector 5 who also examined the allegedly leaked NSA document.
The Electronic Frontier Foundation has an online tool that should reveal what information the pattern encodes
“People could use this to check for forgeries,” he explains. “If they get a document and someone says it’s from 2005, [the microdots might reveal] it’s from the last several months.”
If you do encounter microdots on a document at some point, the EFF has an online tool that should reveal what information the pattern encodes.
Hidden messages
Similar kinds of steganography – secret messages hidden in plain sight – have been around for much longer.
Slightly more famously, many banknotes around the world feature a peculiar five-point pattern called the Eurion constellation. In an effort to avoid counterfeiting, many photocopiers and scanners are programmed not to produce copies of the banknotes when this pattern is recognised

Sure they do. Just like a camara