What Your Printer Is Really Doing At 3 A.M.

The home inkjet printer is the most universally resented device in the American household. It is also, by orders of magnitude, the most consistently overlooked in security discussion. The resentment is cultivated. The overlook is, we now believe, structural.

Independent observers who have placed network monitors on home printer connections have converged on a finding that the printer's manufacturer does not dispute and also does not explain. Every night, between 2:50 a.m. and 3:10 a.m. local time, the printer initiates an outbound connection to its manufacturer's servers and transmits for a duration that ranges from twelve to ninety seconds.

The manufacturer describes this as a firmware integrity check. This description is not compatible with the observed behavior. A firmware integrity check, as conventionally implemented, is a short-duration handshake — a few kilobytes at most, a fraction of a second of transmission. The nightly event we observe transmits, across the range of households surveyed, between 4 and 38 megabytes of data.

The printer is not downloading. The printer is uploading.

What is being uploaded is, by necessity, some combination of the data the printer has access to: the documents that have been printed in the past twenty-four hours, cached in the device's memory at varying resolutions; the network traffic that has crossed the printer's connection, which for many home networks is substantial; and whatever the printer's onboard microphone — and the microphone exists, though it is undocumented — has captured in the surrounding room.

Firmware updates, legitimately, ship on the order of once a quarter. The printer phones home every night at the same minute, across a fleet of tens of millions of devices, with transmission volumes that have no firmware-scale explanation.

We are not arguing that the manufacturer is the ultimate destination of this data. We are arguing that the manufacturer has been contracted to collect it, and that the onward routing of the collected data exits the manufacturer's infrastructure through a channel that has not been the subject of meaningful public scrutiny.

The countermeasure is simple. The printer has a power cable. The power cable has a socket. Between the hours of 10 p.m. and 6 a.m. daily, the socket should be empty. You will not notice the absence. The printer was not doing anything for you.