By Cory Doctorow/The Electronic Frontier Foundation
Since its founding in the 1930s, Hewlett-Packard has been synonymous with innovation, and many’s the engineer who had cause to praise its workhorse oscillators, minicomputers, servers, and PCs. But since the turn of this century, the company’s changed its name to HP and its focus to sleazy ways to part unhappy printer owners from their money.
Printer companies have long excelled at this dishonorable practice, but HP is truly an innovator, the industry-leading Darth Vader of sleaze, always ready to strong-arm you into a “deal” and then alter it later to tilt things even further to its advantage.
The company’s just beat its own record, converting its “Free ink for life” plan into a “Pay us $0.99 every month for the rest of your life or your printer stops working” plan.
Plenty of businesses offer some of their products on the cheap in the hopes of stimulating sales of their higher-margin items: you’ve probably heard of the “razors and blades” model (falsely) attributed to Gillette, but the same goes for cheap Vegas hotel rooms and buffets that you can only reach by running a gauntlet of casino “games,” and cheap cell phones that come locked into a punishing, eternally recurring monthly plan.
Printers are grifter magnets, and the whole industry has been fighting a cold war with its customers since the first clever entrepreneur got the idea of refilling a cartridge and settling for mere astronomical profits, thus undercutting the manufacturers’ truly galactic margins.
This prompted an arms race in which the printer manufacturers devote ever more ingenuity to locking third-party refills, chips, and cartridges out of printers, despite the fact that no customer has ever asked for this.
Lexmark: First-Mover Advantage
But for all the dishonorable achievements of the printer industry’s anti-user engineers, we mustn’t forget the innovations their legal departments have pioneered in the field of ink- and toner-based bullying.
First-mover advantage here goes to IBM, whose lawyers ginned up an (unsuccessful) bid to use copyright law to prevent a competitor, Static Controls, from modifying used Lexmark toner cartridges so they’d work after they were refilled.
A little more than a decade after its failure to get the courts to snuff out Static Controls, Lexmark was actually sold off to Static Controls’ parent company. Sadly, Lexmark’s aggressive legal culture came along with its other assets, and within a year of the acquisition, Lexmark’s lawyers were advancing a radical theory of patent law to fight companies that refilled its toner cartridges.
HP: A Challenger Appears
Lexmark’s fights were over laser-printer cartridges, filled with fine carbon powder that retailed at prices that rivaled diamonds and other exotic forms of that element. But laser printers are a relatively niche part of the printer market – the real volume action is in inkjet printers: dirt-cheap, semi-disposable, and sporting cartridges (half-) full of ink priced to rival vintage Veuve-Clicquot.
For the inkjet industry, ink was liquid gold, and they innovated endlessly in finding ways to wring every drop of profit from it. Companies manufactured special cartridges that were only half-full for inclusion with new printers, so you’d have to quickly replace them. They designed calibration tests that used vast quantities of ink, and, despite all this calibration, never could quite seem to get a printer to register that there was still lots of ink left in the cartridge that it was inexplicably calling “empty” and refusing to draw from.
But all this ingenuity was at the mercy of printer owners, who simply did not respect the printer companies’ shareholders enough to voluntarily empty their bank accounts to refill their printers. Every time the printer companies found a way to charge more for less ink, their faithless customers stubbornly sought out competitors who’d patronize rival companies who’d refill or remanufacture their cartridges, or offer compatible cartridges.
Security Is Job One
Shutting out these rivals became Job One. When your customers reject your products, you can always win their business back by depriving them of the choice to patronize a competitor.
Printer cartridges soon bristled with “security chips” that use cryptographic protocols to identify and lock out refilled, third-party, and remanufactured cartridges. These chips were usually swiftly reverse-engineered or sourced out of discarded cartridges, but then the printer companies used dubious patent claims to have them confiscated by customs authorities as they entered the USA. (We’ve endorsed legislation that would end this practice.)
Here again, we see the beautiful synergy of anti-user engineering and anti-competition lawyering. It’s really heartwarming to see these two traditional rival camps in large companies cease hostilities and join forces.
Alas, the effort that went into securing HP from its customers left precious few resources to protect HP customers from the rest of the world. In 2011, the security researcher Ang Cui presented his research on HP printer vulnerabilities, “Print Me If You Dare.”
Cui found that simply by hiding code inside a malicious document, he could silently update the operating system of HP printers when the document was printed. His proof-of-concept code was able to seek out and harvest Social Security and credit card numbers; probe the local area network; and penetrate the network’s firewall and allow him to freely roam it using the compromised printer as a gateway. He didn’t even have to trick people into printing his gimmicked documents to take over their printers; thanks to bad defaults, he was able to find millions of HP printers exposed on the public internet, any one of which he could have hijacked with unremovable malware merely by sending it a print job.
The security risks posed by defects in HP’s engineering are serious. Criminals who hack embedded systems like printers and routers and CCTV cameras aren’t content with attacking the devices’ owners – they also use these devices as botnets for devastating denial of service and ransomware attacks.
For HP, though, the “security update” mechanism built into its printers was a means for securing HP against its customers, not securing those customers against joining botnets or having the credit card numbers they printed stolen and sent off to criminals.
In March 2016, HP inkjet owners received a “security update available” message on their printers’ screens. When they tapped the button to install this update, their printers exhibited the normal security update behavior: a progress bar, a reboot, and then nothing. But this “security update” was actually a ticking bomb – a countdown timer that waited for five months before it went off in September 2016, activating a hidden feature that could detect and reject all third-party ink cartridges.
HP had designed this malicious update so that infected printers would be asymptomatic for months, until after parents had bought their back-to-school supplies. The delay ensured that warnings about the “security update” came too late for HP printer owners, who had by then installed the update themselves.
HP printer owners were outraged and told the company so. The company tried to weather the storm, first by telling customers that they’d never been promised their printers would work with third-party ink, then by insisting that the lockouts were to ensure printer owners didn’t get “tricked” with “counterfeit” cartridges, and finally by promising that future fake security updates would be clearly labeled.
HP never did disclose which printer models it attacked with its update, and a year later, they did it again, once again waiting until after the back-to-school season to stage its sneak attack, stranding cash-strapped parents with a year’s worth of useless ink cartridges for their kids’ school assignments.
You Don’t Own Anything
Other printer companies have imitated HP’s tactics but HP never lost its edge, finding new ways to transfer money from printer owners to its tax-free offshore accounts.
HP’s latest gambit challenges the basis of private property itself: a bold scheme! With the HP Instant Ink program, printer owners no longer own their ink cartridges or the ink in them. Instead, HP’s customers have to pay a recurring monthly fee based on the number of pages they anticipate printing from month to month; HP mails subscribers cartridges with enough ink to cover their anticipated needs. If you exceed your estimated page-count, HP bills you for every page (if you choose not to pay, your printer refuses to print, even if there’s ink in the cartridges).
If you don’t print all your pages, you can “roll over” a few of those pages to the next month, but you can’t bank a year’s worth of pages to, say, print out your novel or tax paperwork. Once you hit your maximum number of “banked” pages, HP annihilates any other pages you’ve paid for (but continues to bill you every month).
Now, you may be thinking, “All right, but at least HP’s customers know what they’re getting into when they take out one of these subscriptions,” but you’ve underestimated HP’s ingenuity.
HP takes the position that its offers can be retracted at any time. For example, HP’s “Free Ink for Life” subscription plan offered printer owners 15 pages per month as a means of tempting users to try out its ink subscription plan and of picking up some extra revenue in those months when these customers exceeded their 15-page limit.
But Free Ink for Life customers got a nasty shock at the end of last month: HP had unilaterally canceled their “free ink for life” plan and replaced it with “a $0.99/month for all eternity or your printer stops working” plan.
Ink in the Time of Pandemic
During the pandemic, home printers have become far more important to our lives. Our kids’ teachers want them to print out assignments, fill them in, and upload pictures of the completed work to Google Classroom. Government forms and contracts have to be printed, signed, and photographed. With schools and offices mostly closed, these documents are being printed from our homes.
The lockdown has also thrown millions out of work and subjected millions more to financial hardship. It’s hard to imagine a worse time for HP to shove its hands deeper into its customers’ pockets.
Industry Leaders
The printer industry leads the world when it comes to using technology to confiscate value from the public, and HP leads the printer industry.
But these are infectious grifts. For would-be robber-barons, “smart” gadgets are a moral hazard, an irresistible temptation to use those smarts to reconfigure the very nature of private property, such that only companies can truly own things, and the rest of us are mere licensors, whose use of the devices we purchase is bound by the ever-shifting terms and conditions set in distant boardrooms.
From Apple to John Deere to GM to Tesla to Medtronic, the legal fiction that you don’t own anything is used to force you to arrange your affairs to benefit corporate shareholders at your own expense.
And when it comes to “razors and blades” business model, embedded systems offer techno-dystopian possibilities that no shaving company ever dreamed of: the ability to use law and technology to prevent competitors from offering their own consumables.
From coffee pods to juice packets, kitty litter to light bulbs, the printer-ink cartridge business model has inspired many imitators.
HP has come a long way since the 1930s, reinventing itself several times, pioneering personal computers and servers. But the company’s latest reinvention as a wallet-siphoning ink grifter is a sad turn indeed, and the only thing worse than HP’s decline is the many imitators it has inspired.
–
Comments welcome.
Posted on November 8, 2020