No can scan

The oddest thing to catch my eye so far this year was in a note I received from longtime reader Keith Krebs (aka “Just some guy”). Krebs wrote that users of Adobe’s Photoshop CS package were finding that the software seemed significantly slower than it should be when opening files. The reason turns out to be pretty interesting . . .

Bradner also discusses the new “feature” in Photoshop

Before the facts came to light a lot of people were scratching their heads and making wild guesses, but Adobe had nothing to say. The truth started to emerge when a user in Adobe’s Photoshop forum described receiving a TIFF image of a $20 bill from a customer. The user noted that the image did not violate the laws regarding reproduction of currency for several reasons, not the least of which was that the image was not even a “flat” portrayal; it was rendered as if it were a flag fluttering in the wind, and the colors weren’t even close to those of a real note.

Well, to make a long story short, it turns out the slow-loading problem is caused by Photoshop CS attempting pattern recognition on all images as they are loaded. If the program recognizes the image as a bank note it refuses to open the file and displays an error message about the legality of currency reproduction! Krebs and others did some tests and found that currency detection only applies to the new $20 and $100 notes and some U.K. pound notes.

And then, on Jan. 11, Adobe ‘fessed up: It had indeed included a bank note image-detection subsystem, but – and here’s the really interesting bit – it had not written the code. And as far as I can find out neither did it inspect the sources! Yep, you read that right: It incorporated third-party code without knowing exactly what it does or how it does it.

The embedded technology was apparently designed and built by a consortium of 27 central banks in the U.S., England, Japan, Canada and the European Union called the Central Bank Counterfeit Deterrence Group. To see where the political drive comes from consider that in the EU there is a proposal for legislation requiring all software companies to include similar anti-counterfeit technology.

Adobe isn’t alone in this; I just found out that Jasc Software’s Paint Shop Pro 8 does the same thing.

But the Photoshop CS implementation is hardly effective. It appears that you can get around the detection system by using several simple methods, including cutting the image of the bank note from another graphics utility and pasting it into Photoshop (a Homer Simpson moment if ever there was one: “D’oh!”).

There are some aspects to worry about in this story. Adobe’s new End User Licensing Agreement for the product reads “14.8.1 The Software may rely upon or facilitate your access to Web sites maintained by Adobe or its affiliates or third parties offering goods, information, software and services.” Hmm, can you say “spyware”? Is the detection code reporting to some server each time it blocks an image from loading?

Now I don’t think any of us upstanding citizens have any objection to the idea of anti-counterfeiting technologies; counterfeiting is an enormous and serious worldwide problem, but this system can never work.

You can never get all graphics software available (for example GIMP) to incorporate this functionality, and just locking down the market leader’s packages can never solve the problem (to misquote the old saw: “when unmodified image editors are outlawed, only outlaws will have unmodified image editors”).

Politics now are starting to try to change how software works, and the potential for introducing serious stability, functional and security problems is not to be taken lightly. If this becomes an established practice, what other detectors and limitations will be built into our software by law? Makes you wonder what other additional code you might already be running that you know nothing of.

Paranoid thoughts to backspin@gibbs.com.