Sleazy computer-printer makers compromising your security

The Texas attorney general has been asked to investigate an alleged "sleazy" tactic by a major computer printer company that could allow for "spying" on home-printer owners or "attacks on other computers."

And that's just a side effect of a manipulation of software by Epson to prevent the use of aftermarket ink cartridges, contends the Electronic Frontier Foundation.

EFF is asking the attorney general's Consumer Protection Division to look into possibly "misleading, anticompetitive, and dangerous" business practices.

A WND request to Epson for comment generated only an automated response that did not address the issue.

EFF said: "If you've ever bought an inkjet printer, you know just how much the manufacturers charge for ink (more than vintage champagne!) and you may also know that you can avoid those sky-high prices by buying third-party inks, or refilled cartridges, or kits to refill your own cartridges."

The organization noted the major printer manufacturers "have never liked this very much, and they've invented a whole playbook to force you to arrange your affairs to suit their shareholders rather than your own needs, from copyright and patent lawsuits to technological countermeasures that try to imbue printers with the ability to reject ink unless it comes straight from the manufacturer."

"But in the age of the Internet, it's possible for savvy users to search for printers that will accept cheaper ink. A little bit of research before you buy can save you a lot of money later on," EFF said.

"Printer companies know that openly warring with their customers is a bad look, which is why they've invented a new, even sleazier tactic for locking their customers into pricey ink: they trick their customers."

It was in late 2016 or 2017 that Epson "started sending deceptive updates to many of its printers."

"Epson disguised these updates as routine software improvements, when really they were poison pills, designed to downgrade printers so they could only work with Epson's expensive ink systems," EFF said.

But "an eagle-eyed supporter in Texas" noticed the change, EFF said, prompting its alert to the Texas attorney general.

"It is not clear that customers were informed when buying an Epson printer that their ability to use third-party ink options could or would be later disabled," EFF wrote to authorities. "Moreover, it does not appear that Epson informed customers when it sent the firmware update that it would disable third-party alternatives to Epson cartridges.

"Epson's conduct may therefore be misleading or deceptive within the meaning of the Deceptive Trade Practices-Consumer Protection Act," EFF said.

The action also may have violated a Texas ban on "knowingly making false or misleading statements of fact concerning the need for parts, replacement, or repair service."

There also is a security issue.

"Using firmware updates to remove functionality that consumers desire threatens harm to the security of the internet. Printers sometimes have security vulnerabilities, which, when found, can be exploited – for example, to remotely execute computer code. Home devices that have been thus infected can be used to spy on their owners' local networks, or as a launching point for attacks on other computers," EFF said.

Manufacturers use firmware updates to fix such problems, but if consumers "come to believe that firmware updates, without warning, might also disable their ability to use third-party ink options, they might choose to forgo updates altogether."

"If warranted by the investigation," EFF wrote. "We would further encourage the consumer protection division to bring an action … are, at the very least, to seek an assurance of voluntary compliance."

EFF said printer giant HP did the same thing earlier in 2016.

"With these shenanigans, Epson and HP aren't just engaged in a garden-variety ripoff. Teaching Internet users to mistrust software updates is a dangerous business. In recent years, some of the Internet's most important services have been brought to their knees by malicious software running on compromised home devices. Compromises to your home devices don't just endanger the public internet, either: once your printer is infected, it can be turned against you, used to steal data from the documents you print, to probe the devices on your local network, and to attack those devices and send the data stolen from them to a criminal's computer."

In yet another related case, the U.S. Supreme Court refused permission for Lexmark to use copyright and patent infringement allegations to prevent printer owners from using third-party supplies.

The court ruled Lexmark could not use patent or other laws to prevent third parties from refilling and reselling old cartridges.

The high court decision had major implications for many other American businesses.

"The next logical step will be for courts to recognize that people who buy digital goods are owners of those goods, not mere licensees, and can resell and tinker with their digital goods to the same extent as purchasers of tangible property," EFF said of the case.