T 3.86 Unregulated and careless use of printers, copiers, and all-in-one devices

In every organisation, there is information that is not intended for the public. This information may include development results, strategy documents, or other confidential information. The reproduction of such documents is usually controlled so that this information cannot be disclosed to unauthorised persons.

While striving for the highest possible level of security for all information processed by IT systems, the security of the information in physical form must not be neglected. This includes, for example, printouts, paper files, or microfilms. The strongest encryption is useless when the encrypted document is printed out after decryption and can be viewed by unauthorised persons.

When network printers are used, the printed documents are often left for long periods of time in the output tray of the printer. Users will often print out several files before picking them all up together, especially if the printer is not located in the immediate environment of the users. Since floor or department printers are used by a large number of people, there are also many people who are able to read or take the printouts.

When printouts are not picked up immediately, the probability that they will be read or disappear entirely increases. This may not even be intentional. If an employee who also wants to use the printer needs to wait for their printout for a long time, they may pass their time waiting by looking at the documents printed out by other co-workers but which have not been picked up yet.

There are often also confidential documents near or in the copier, for example because they were forgotten in the copier.

Users often do not look for the cause when they cannot find their printouts in the printer. They will usually assume it was an IT problem and start a new print job since they are used to hardware and software problems occurring and causing inexplicable phenomena. The printouts may have been taken by someone else, though. It is also often the case that a user will accidentally select a different printer on their workstation computer than the printer they usually use. The user will then look for their printouts on the wrong printer. They will not find them there and simply start a new print job, this time on the standard printer. For this reason, you will often find printouts that were not picked up on many network printers.

Example:

• A user notices they printed out the wrong document in the printer room and disposes of the misprint directly in the waste paper bin provided there. Another employee who has to wait for a print job uses the back of the thrown away printout for notes. When these notes are passed on to an external company during a meeting, the misprint containing internal information is passed on as well.