The following article is a guest post written by Christine Musil, Director of Marketing for Informative Graphics Corporation (IGC).

Fiascoes resulting from improper redaction have certainly made a lot of headlines recently. The most recent occurred last week when social networking juggernaut Facebook inadvertently revealed their internal estimated value for the company ($3.7 billion), which was in stark contrast to the valuation they had submitted to Microsoft ($15 billion). Now Facebook is scrambling to piece its integrity back together as they face definite embarrassment and possible allegations of fraud.  In 2005, U.S. military officials released improperly redacted documents to the media containing classified information on the shooting death of an Italian secret agent by U.S. soldiers in Iraq. Incidents like these prompted the NSA to produce a document* devoted to proper redaction methods and common pitfalls.
(*Link to NSA Document: http://www.fas.org/sgp/othergov/dod/nsa-redact.pdf)

Redaction is a simple but important process which involves concealing information in documents that is deemed sensitive or inflammatory.  Historically, redaction was done using black magic markers to cross out names, social security numbers, medical records, and the like.  More recently, law firms and corporations have been using various electronic methods to redact digital documents such as PDF files. 

One would think that companies like Facebook and the U.S. military would be savvy on electronic redaction technology, right?  So what went wrong?  In both examples, users creating the redaction simply drew a black box over the text they wanted to hide. Some used Microsoft Word’s drawing shapes to cover text then output that file to PDF. The faulty logic here is that converting a Word document to PDF does not actually remove hidden text. Recipients of that PDF can still select the text in the document and paste it into another application, where that covered text is then fully visible.

Additionally, many users don’t realize that deleted content is often still available through examination of invisible metadata. There are many applications that reveal this metadata, including any comments, text revisions and all usernames of people who commented or modified the document.  The moral of the story is – just because you can’t see it doesn’t mean it can’t be seen by others.
 
Best Practices for Electronic Redaction

Clearly, to avoid becoming a cautionary tale like Facebook, all users responsible for redacting documents must be adequately trained on how to perform proper redaction and on proper use of their selected redaction tools. This training must start with making the user understand that visible content—what you see on the screen and on hard copy prints—is not all of the information the document has to offer.  There are numerous ways to uncover data that’s invisible to the naked eye.

The safest method of redaction is to use a software application that creates an entirely new file with the content selected for redaction and all metadata omitted. True redaction software will let users open their original document, select areas for redaction (ideally collaboratively, so all interested parties can verify redactions) then finalize the file as a new rendition of the document as a clean TIFF or PDF.

There are a number of redaction tools available. Adobe Acrobat (www.adobe.com) now has a redaction feature in its Professional Extended version, but for less money there are several smaller products that focus strictly on redaction. These products include Redact-It® by Informative Graphics Corp. (www.redact-it.com), RapidRedact (www.rapidredact.com) and I.D. Shield from Extract Systems (www.extractsystems.com).

Electronic redaction is a simple concept, but it actually has great complexities.  Proper training and software with adequate functionality are essential ingredients that cannot be ignored.  Don’t end up like Facebook – face the facts about electronic redaction and get the tools and education to do it right!