Legal Definitions - steganography

Steganography refers to the practice of concealing a message, file, or information within another non-secret message or file. The primary goal of steganography is not to scramble the hidden data (as encryption does), but rather to make its very existence undetectable to an observer. The hidden information is embedded in a way that it appears to be an ordinary, innocent-looking part of a carrier file, such as an image, audio file, or video.

• Example 1: Covert Communication

  Imagine a spy needing to send secret instructions to an operative in a foreign country. Instead of encrypting a text file, which might draw suspicion if intercepted, the spy embeds the detailed instructions within a seemingly innocuous digital photograph of a landscape. The photograph can then be sent via email or uploaded to a public social media site without raising red flags, as it simply appears to be a normal image. Only the intended recipient, knowing the specific steganographic technique and any necessary key, can extract the hidden instructions.

  This illustrates steganography because the landscape photograph acts as the carrier file, and the secret instructions are the hidden information. The technique ensures that the existence of the secret message is concealed, making it look like an ordinary photo.

• Example 2: Tracking Leaked Documents

  A corporation wants to prevent and track internal leaks of highly sensitive documents. When distributing a confidential report to various employees, the company embeds a unique, invisible identifier specific to each recipient into the background image or a subtle graphic element of their digital copy of the report. If the report is later leaked to the public, forensic analysis can extract the hidden identifier from the leaked document, allowing the company to pinpoint exactly which employee's copy was distributed.

  Here, the confidential report's digital background or graphic serves as the carrier, and the unique recipient identifier is the hidden information. The report appears normal to the recipient and any casual observer, but secretly contains a traceable mark.

• Example 3: Malware Concealment

  A cybercriminal wants to distribute malicious software (malware) without immediate detection by security systems. They might embed the executable code for the malware within a popular meme image or a seemingly harmless audio file. When an unsuspecting user downloads and opens the file, the embedded malware can then be extracted and activated on their computer, often without the user ever realizing that the image or audio file contained anything other than its apparent content.

  This demonstrates steganography as the meme image or audio file functions as the carrier, while the malicious software is the hidden information. The technique allows the malware to bypass initial security scans that might flag executable files, as it is disguised within a benign media file.