www.nsa-observer.net

[dan at geer.org]

 | Depends on the converter, whether it keeps the Adobe spying
 | features witting or unwitting -- which it may be aware of or not.
 | And whether it has a deal with Adobe to retain disguised.
 | ... 

John, you know this I'm sure, but for the record the highest
security places use sacrificial machines to receive e-mail and
the like, to print said transmissions to paper, and then those
(sacrificial) machines are sacrificed, which is to say they
are reloaded/rebooted.  Per message.  The printed forms then
cross an air gap and those are scanned before transmission to
a final destination on networks of a highly controlled sort.
I suspect, but do not know, that the sacrificial machines are
thoroughly instrumented in the countermeasure sense.  For the
entities of which I speak, the avoidance of silent failure is
taken seriously -- which brings us 'round to your (and my)
core belief: The sine qua non goal of security engineering is
"No Silent Failure."

--dan