<\/p>\n
Federal prosecutors on<\/span> January 9 charged Aurelio Luis Perez-Lugones, an IT specialist for an unnamed government contractor, with \u201cthe offense of unlawful retention of national defense information,\u201d according to an FBI affidavit<\/a>. The case attracted national attention after federal agents investigating Perez-Lugones searched the home of a Washington Post reporter<\/a>. But overlooked so far in the media coverage is the fact that a surprising surveillance tool pointed investigators toward Perez-Lugones: an office printer with a photographic memory.<\/p>\n News of the investigation broke when the Washington Post reported that investigators seized the work laptop, personal laptop, phone, and smartwatch of journalist Hannah Natanson, who has covered the Trump administration\u2019s impact on the federal government and recently wrote<\/a> about developing more than 1,000 government sources. A Justice Department official told the Post<\/a> that Perez-Lugones had been messaging Natanson to discuss classified information. The affidavit does not allege that Perez-Lugones disseminated national defense information, only that he unlawfully retained it. The Justice Department and the Washington Post did not respond to request for comment.<\/p>\n <\/p>\n The affidavit provides insight into how Perez-Lugones allegedly attempted to exfiltrate information from a Secure Compartmented Information Facility, or SCIF<\/a>, and the unexpected way his employer took notice.<\/p>\n According to the FBI, Perez-Lugones printed a classified intelligence report, albeit in a roundabout fashion. It\u2019s standard for workplace printers to log certain information, such as the names of files they print and the users who printed them. In an apparent attempt to avoid detection, Perez-Lugones, according to the affidavit, took screenshots of classified materials, cropped the screenshots<\/a>, and pasted them into a Microsoft Word document.<\/p>\n By using screenshots instead of text, there would be no record of a classified report printed from the specific workstation. (Depending on the employer\u2019s chosen data loss prevention monitoring software, access logs might show a specific user had opened the file and perhaps even tracked whether they took screenshots).<\/p>\n Perez-Lugones allegedly gave the file an innocuous name, \u201cMicrosoft Word \u2013 Document1,\u201d that might not stand out if printer logs were later audited.<\/p>\n In this case, however, the affidavit reveals that Perez-Lugones\u2019s employer could see not only the typical metadata stored by printers, such as file names, file sizes, and time of printing, but it could also view the actual contents of the printed materials \u2014 in this case, prosecutors say, the screenshots themselves. As the affidavit points out, \u201cPerez-Lugones\u2019 employer can retrieve records of print activity on classified systems, including copies of printed documents.\u201d<\/p>\n <\/p>\n