How to set a canary trap
· by Peter W. Szabo
Give each person a slightly different version of a document. If it leaks, the version that got out tells you whose copy it was.
What a canary trap is
A canary trap, also called a barium meal test, plants a unique detail in each copy of a message. The detail that resurfaces in the leak points at the copy it came from.
Tom Clancy coined the name in his 1987 novel Patriot Games. The method is older: Peter Wright’s memoir Spycatcher, published the same year, describes the barium meal test as standard practice at MI5. In 2008, Tesla’s Elon Musk reportedly sent employees slightly different versions of an email to find a leaker (Wikipedia).
Why it’s hard by hand
- Ten recipients means writing the same paragraph ten different ways.
- Changed wording stands out when two recipients compare notes.
- You have to record which version went to whom, then match a leak against every version by eye.
- An edit, a re-save or a format change can blur the detail you planted.
Set the trap with LeakPrint
- Finish the document. Make the copies from the version you’ll send.
- Open LeakPrint, choose the .docx, and enter a key or click Suggest a key.
- Pick how many copies you need, from 2 to 10, and click Make copies.
- Send copy 1 to the first person, copy 2 to the second, and so on. Write down who got which number for this document.
- Keep the key and that list somewhere safe, apart from the copies.
- If a copy turns up, open Identify a leak, add the file and the key, and click Identify.
LeakPrint names the copy when the evidence is overwhelming, and says no copy matches when it isn’t. How LeakPrint works explains the test.
Tips
- Send each copy in its own email or message. A group email gives everyone the same copy.
- Don’t announce the trap. People who know about it can compare their copies.
- Ask recipients not to forward the document. A forwarded copy points at the person who forwarded it. Tesla’s trap reportedly failed when one recipient forwarded his own version to others.
- Make a new set of copies for each document, and keep a list for each set.
What a match proves
A match tells you which copy the leaked file came from. It doesn’t prove who leaked it: the recipient may have forwarded the file, left a laptop unlocked or had an account broken into. Treat the copy number as a lead, and talk to HR or a lawyer before you act on it, above all with employees.
Questions
What is a barium meal test?
The intelligence services’ name for a canary trap: feed each suspect a unique detail and watch where it turns up.
Can I set a canary trap after a document has leaked?
No. The different copies must exist before the leak. Set the trap with the next document you send.
Does a canary trap work for emails?
LeakPrint marks Word documents, so send the text as a .docx attachment, one copy per recipient, rather than in the body of the email.
Is a canary trap the same as a canary token?
No. A canary token is a planted file or link that alerts you when someone opens it. A canary trap varies a document between recipients, so the leaked version names its source.