| Oregon State Bar Bulletin — JANUARY 2011 |
|
|
Delete Me:
Can Acrobat PDF Redaction be Trusted?
By Mark Niemann-Ross
 |
Former Illinois Gov. Rod Blagojevich issued a subpoena to President Barack Obama in April 2010. Not so surprising. Then the Chicago Tribune did what newspapers are supposed to do and reported on the subpoena. They not only reported on it, but also published a copy of the legal document, with certain elements redacted. Unfortunately, the document provided by Aaron Goldstein, Blagojevich’s lawyer, wasn’t redacted correctly, and the complete text is available to any kid with a copy of Acrobat Professional.
Oops.
What got Aaron Goldstein in trouble was assuming if you can’t see the text on screen, or in print, then the text isn’t available. Someone in Goldstein’s office used the text background paint bucket to draw a black background, and also made sure the text was also black. But the text was still there, waiting to be discovered.
Oops.
By the way, there are Microsoft Word redaction add-ins that do work — they draw a black background, but also convert the underlying text into “||||||||||||||||||” — no text remains.
Nobody wants to have their name appear in the document properties dialog when this mea maxima culpa appears on the Internet. It’s embarrassing at best, cause for serious disciplinary sanctions at worst. It’s certainly not impressive to a client. So isn’t there a way to confirm that redaction has actually happened and that there isn’t any chance for error?
Ensuring That All is Well
There is a fairly good way to confirm that things are not astray. The first step is to use the right tools. The second step is to confirm you’ve used them correctly.
To perform redaction in an Adobe Acrobat document, use the official tool: Adobe Acrobat Professional. Invest in the latest version. Last I checked, it costs $449 for a single copy purchased directly through the Adobe store. Look around, you can get it for cheaper. You could save money and get a third party Acrobat editor, but they don’t have Adobe’s reputation. Adobe is really concerned about security, as it reflects on their share price. Given the current state of the market, that’s a great motivator for them to get it right. By the way — I do not get a kickback from Adobe; I just sincerely believe that buying the original is the cheapest solution in the long-run.
You may not be aware that Acrobat has a redaction tool because you’ve never seen it. If you are using the free Adobe Acrobat Reader, then you are missing this tool. Reader is great for, well, reading. But it doesn’t have editing tools such as redaction. Only Adobe Acrobat Professional has the redaction tool.
There are several excellent tutorials about using the redaction tool, but it’s actually rather simple. Open the Acrobat document. Select the redaction tool from the “Advanced” menu. Select the text or object you want to redact, then apply the redaction. Save the new document, and you’re done. There are more steps you could take, and some precautions regarding metadata, but for the purposes of this article, that’s enough to know to get it to work.
Acrobat not only produces a big black box, but also removes the text or image that was redacted. Not there, not to be found. You can also elect to use US FOIA or US Privacy Act codes, as well as search and redact through an entire document.
If everything goes right, the document, when released into the wild, will not embarrass you, or your firm. But as the great philospher Woody Allen reminds us, “Paranoia is knowing all the facts.” And the facts are that redaction sometimes gets done incorrectly, in spite of best intents.
How to Confirm That the Text
is Gone?
Here are three ways.
First, simple. Open the document in Adobe Acrobat, and go to the “Tools” menu. Select “Select & Zoom” and then “Select Tool.” Use the cursor to drag-select text that is supposed to be redacted, copy it, and then paste it into a blank word-processing document. If the redacted text appears, you have your fears confirmed.
Second, paranoid. Open the redacted PDF in Acrobat, and the original in whatever word processor it was created with. From the original, find some of the text that is supposed to be redacted, then search for it in the redacted PDF. If that text has been properly redacted, you will get a dialog that states: “Acrobat has finished searching the document. No matches were found.” That is a pretty good indicator that text is gone. Two warnings about this: First, check that you didn’t introduce a typo in the search string. Second, Acrobat sometimes treats the spaces between words in odd ways. It’s best to search for a single word, not a phrase.
If the text is found, Acrobat will jump to the page. (A dead give-away that something was found.)
Third, complex. This time, open the document in Acrobat Professional. Look in the “Tools” menu for “Advanced Editing” and then for the “TouchUp Object Tool.” Now you are using the tool that all the other document hackers are going to use to discover nonredacted text. The cursor has changed to an arrow… Move it to where there is supposed to be redacted text, and click. You may notice a long rectangle become highlighted, which indicates the presence of text. That highlighted rectangle can be dragged to a different place on the page, after which you’ll be able to read its contents. If you can do it, so can the rest of the world!
With a bit of care, redaction can be done effectively and permanently. But it does require that you spend a moment learning the tools of the trade. Or you can simply hope for the best, and blame it on the intern. Just make sure it’s their name in the document properties dialog — and not yours!
ABOUT THE AUTHOR
Mark Niemann-Ross is an Adobe certified expert on Acrobat Professional 8 and 9, and has spent most of his professional career in software product management as well as developer relations. He can be found at www.niemannross.com
© 2011 Mark Niemann-Ross