Printer ink DRM —

EFF calls on HP to disable printer ink self-destruct sequence

HP firmware update rejected cheaper third-party ink cartridges.

EFF calls on HP to disable printer ink self-destruct sequence

HP Inc. should apologize to customers and restore the ability of printers to use third-party ink cartridges, the Electronic Frontier Foundation (EFF) said in a letter to the company's CEO yesterday.

HP has been sabotaging OfficeJet printers with firmware that prevents use of non-HP ink cartridges and even HP cartridges that have been refilled, forcing customers to buy more expensive ink directly from HP. The self-destruct mechanism informs customers that their ink cartridges are "damaged" and must be replaced.

"The software update that prevented the use of third-party ink was reportedly distributed in March, but this anti-feature itself wasn't activated until September," EFF Special Advisor Cory Doctorow wrote in a letter to HP Inc. CEO Dion Weisler. "That means that HP knew, for at least six months, that some of its customers were buying your products because they believed they were compatible with any manufacturer's ink, while you had already planted a countdown timer in their property that would take this feature away. Your customers will have replaced their existing printers, or made purchasing recommendations to friends who trusted them on this basis. They are now left with a less useful printer—and possibly a stockpile of useless third-party ink cartridges."

An HP OfficeJet ink cartridge, just $26.99.
An HP OfficeJet ink cartridge, just $26.99.

The printer DRM "was disguised as a security update," reducing trust in the software update process used to fix security flaws, Doctorow argued. If customers have reason to believe that security updates might compromise a device's basic functionality, they are more likely to reject updates and put their security at risk, he wrote.

The EFF asked HP to issue a firmware update that rolls back the self-destruct sequence; publicly commit to never using software updates to distribute so-called "anti-features" that are bad for customers; commit to disclosing the effects of future software updates; and "prominently disclose any capability or plan to remove features from devices in your sales literature, so customers know what they're getting before they buy."

Doctorow has not heard back from HP, he told Ars today.

It doesn't sound like the company will be making any changes. When we contacted HP today, the company did not say whether it will reverse course. Instead, a spokesperson said, "The purpose of this update is to protect HP’s innovations and intellectual property. These printers will continue to work with refilled or remanufactured cartridges with an Original HP security chip. Other cartridges may not function. In many cases this functionality was installed in the HP printer and in some cases it has been implemented as part of an update to the printer’s firmware."

The firmware in question is for the security chip "that maintains secure communications between the cartridge and the printer" in HP OfficeJet, OfficeJet Pro, and OfficeJet Pro X printers, HP said. The updates began rolling out in 2015, according HP's statement.

HP's use of a technical countermeasure to exclude non-HP ink cartridges raises concerns that HP might invoke Section 1201 of the Digital Millennium Copyright Act, which makes it illegal to circumvent technological measures that control access to copyrighted works, Doctorow also wrote. He asked HP to promise never to invoke Section 1201 against security researchers or "competitors who make legitimate aftermarket products."

"Security researchers rightly fear that disclosures of defects in products covered by Section 1201 could lead to severe punishments," Doctorow wrote. "Many respected researchers came forward at the Copyright Office's triennial 1201 exemptions hearing in 2015 to say that they'd been chilled from disclosing vulnerabilities in 1201-covered systems, from voting machines to tractors to insulin pumps. This means that bad guys are free to exploit vulnerabilities in these products, while good guys are scared off from warning the people who depend on them about the dangers lurking in them. Given the history of attacks on printers, and the widespread distribution of your products, this is the last thing you should want."

Nearly 8,000 people have signed an EFF petition calling on HP to restore the full functionality of its printers.

Channel Ars Technica