A method and apparatus for tracing of computer documents is disclosed. A computer processor stores a processor identifier that is unique to the particular processor. Documents created by a computer system are tagged with an identification tag that is a value which results from performing a cryptographic function on the hash of the document and the unique processor identifier. Processor associators are stored in a secure database, with each of the processor associators being associated with one of the unique processor identifiers. In a first embodiment, the processor associators are the same as the processor identifiers. In a second embodiment, the processor identifiers are a function of their related processor associator. Documents may be traced by a third party possessing a document (including an attached identification tag) and a database of processor associators and user identification data associated with each of the processor associators. In one embodiment, the third party computes a document tag for the particular document using each of the processor associators until a tag is computed which matches the tag that was attached to the document. When such a match is found, the source of the document may be determined by reference to the user identification data associated with the processor associator that was used to compute the matching identification tag.