Identifying the source of a leaked file

When a confidential file is leaked, an organization usually knows who was given it and cannot tell which copy was passed on. Invisproof issues each recipient an individual copy in advance, so that a leaked file can be compared with the copies issued and matched to one of them.

Request access

Leaked material and its investigation

Documents and media

A leaked file may be a document, a presentation, an image, a video or a recording, and it may surface in the press, on a public website or in the hands of a competitor.

Recipients with permission

In most cases the file was shared properly with a known group. Access controls confirm that each member of it was entitled to the file, which leaves the origin of the leak unresolved.

Preparation in advance

A leaked file can be matched only if individual copies were issued before the leak, and Invisproof is therefore introduced when material is distributed.

A finding with a stated probability

An investigation compares the leaked file with the copies issued and states the probability that it came from a given copy. Where the evidence is insufficient, it reports that no copy could be identified.

The process of an investigation

Issue

At the time of distribution, the Document Engine or the Media Engine prepares an individual copy for each recipient, and the issue of every copy is recorded.

Submit

When a leaked file is found, the organization submits it for investigation in the form in which it was found.

Identify

The investigation compares the file with the copies issued, identifies the copy it most probably came from, and states the probability of the match.

Circumstances in which a leaked file is investigated

A confidential document is quoted or reproduced by a newspaper or a website.

  • Board papers, results and announcements
  • The published file submitted as found
  • Compared with the copies issued

Controls in place before a leak

Files opened in the browser

A file is opened in the secure viewer in a browser, with nothing to download and nothing to install. The organization decides which files are opened only in this way.

  • Nothing to download
  • Nothing to install
  • Decided file by file

What an investigation provides

An investigation rests on the leaked file itself and on the record of copies issued, where an inquiry would otherwise depend on who had access to the material.

Questions about leak investigations

Can a file leaked before Invisproof was introduced be investigated?

No. An investigation depends on individual copies having been issued through Invisproof before the leak. A file that was distributed as identical copies offers no means of telling one recipient's copy from another's.

Can an investigation identify the wrong copy?

Every result states the probability that the leaked file came from the copy named, and no result is presented as a certainty. Where the evidence is insufficient, the investigation reports that no copy could be identified.

Does a match show who leaked the file?

A match identifies a copy and the recipient to whom that copy was issued. It does not show how the copy left that recipient's hands, and the conclusions drawn from it are for the organization.

What if the leaked copy is a photograph or a printout?

A photograph or a printout can be submitted for investigation like any other found file. The investigation states the probability that it came from a given copy; identification cannot be assured in every case.

Request access

Invisproof is provided to organizations by approval.

Request access