1. A computer-executable method for tracing information leaks, comprising: obtaining, by a computing device, a disseminated document to analyze; determining, from a collection of original documents, an original document that is most similar to the disseminated document; comparing the disseminated document to the most similar original document to determine differences between the disseminated document and the most similar original document; querying a database containing changes to documents, using the determined differences, to determine a most similar changed document; determining a distance value by comparing changes from the most similar changed document with the determined differences from the disseminated document; and responsive to determining that the distance value is less than a threshold value, determining a user identifier for a user associated with the most similar changed document.
1. A computer-executable method for tracing information leaks, comprising: obtaining, by a computing device, a disseminated document to analyze; determining, from a collection of original documents, an original document that is most similar to the disseminated document; comparing the disseminated document to the most similar original document to determine differences between the disseminated document and the most similar original document; querying a database containing changes to documents, using the determined differences, to determine a most similar changed document; determining a distance value by comparing changes from the most similar changed document with the determined differences from the disseminated document; and responsive to determining that the distance value is less than a threshold value, determining a user identifier for a user associated with the most similar changed document. 2. The method of claim 1 , further comprising: searching among change records for changes that are most similar to a determined difference between a second most similar original document and a second disseminated document; and determining a second user identifier associated with the changes that are most similar to the determined difference.