{"id":10703,"date":"2023-01-31T05:00:59","date_gmt":"2023-01-31T10:00:59","guid":{"rendered":"https:\/\/jolt.richmond.edu\/?p=10703"},"modified":"2023-01-31T06:41:27","modified_gmt":"2023-01-31T11:41:27","slug":"digital-redaction-is-out-sharpies-and-scissors-are-in-how-digital-redaction-fails-to-keep-information-secure","status":"publish","type":"post","link":"https:\/\/blog.richmond.edu\/jolt\/2023\/01\/31\/digital-redaction-is-out-sharpies-and-scissors-are-in-how-digital-redaction-fails-to-keep-information-secure\/","title":{"rendered":"Digital Redaction Is Out, Sharpies and Scissors Are In: How Digital Redaction Fails to Keep Information Secure"},"content":{"rendered":"<p>By Brianna Hughes<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>The harm from a breach of privacy can not only be potential fines, litigation costs, loss of trade secrets and reputational damage, a breach of privacy can also put the nation\u2019s safety at risk.<a href=\"#_ftn1\" name=\"_ftnref1\">[1]<\/a> An important tool to maintain privacy and secure confidential information is the technique of redaction.<a href=\"#_ftn2\" name=\"_ftnref2\">[2]<\/a> Redaction is used to filter information out of documents to keep that information secret from unauthorized individuals.<a href=\"#_ftn3\" name=\"_ftnref3\">[3]<\/a> In the past, redaction was performed manually by using a black marker to mark out the information or by cutting out the information with scissors.<a href=\"#_ftn4\" name=\"_ftnref4\">[4]<\/a> These manual methods were costly and time-consuming.<a href=\"#_ftn5\" name=\"_ftnref5\">[5]<\/a> As technology evolved, different digital techniques for redaction came to light, making it easier to filter out confidential information.<a href=\"#_ftn6\" name=\"_ftnref6\">[6]<\/a> Many individuals, businesses, and governments rely on these digital techniques to keep their sensitive information confidential.<a href=\"#_ftn7\" name=\"_ftnref7\">[7]<\/a> Though these digital techniques are easier, this does not mean that the redactions done are secure.<a href=\"#_ftn8\" name=\"_ftnref8\">[8]<\/a><\/p>\n<p>Those who use digital redaction typically use PDF redaction tools.<a href=\"#_ftn9\" name=\"_ftnref9\">[9]<\/a> This involves placing a black box over the sensitive information that is supposed to remove the information behind the box.<a href=\"#_ftn10\" name=\"_ftnref10\">[10]<\/a> When this technique fails, it is usually because the text data remained in the document.<a href=\"#_ftn11\" name=\"_ftnref11\">[11]<\/a> This allows an individual who would like to access the information to simply copy and paste the information behind the black box into a new word document, defeating the purpose of the redaction.<a href=\"#_ftn12\" name=\"_ftnref12\">[12]<\/a> Some information can also be shown when converting a redacted document from Microsoft Word to PDF.<a href=\"#_ftn13\" name=\"_ftnref13\">[13]<\/a> Additionally, the inclusion of enough details can allow individuals to decipher what the redactions were meant to be.<a href=\"#_ftn14\" name=\"_ftnref14\">[14]<\/a> When these failures occur, information that was supposed to be unknown to the public could be exploited through the press.<a href=\"#_ftn15\" name=\"_ftnref15\">[15]<\/a> Examples of this include the redacted court deposition of Ghislaine Maxwell, the partner of Jeffrey Epstein, being published after being deciphered by journalists.<a href=\"#_ftn16\" name=\"_ftnref16\">[16]<\/a> The journalists were able to decipher many names that were redacted, many of those names being high-profile individuals.<a href=\"#_ftn17\" name=\"_ftnref17\">[17]<\/a> Redaction failures do not only happen in court filings; anyone using digital redaction techniques can fall victim.<a href=\"#_ftn18\" name=\"_ftnref18\">[18]<\/a> An unintentional exploitation of private information through the press occurred through the New York Times when they published redacted information that fell victim to the copy and paste method.<a href=\"#_ftn19\" name=\"_ftnref19\">[19]<\/a> This redacted information revealed CIA operations and the name of a program&#8217;s target; this information is a matter of national security and was not intended to be known by the public.<a href=\"#_ftn20\" name=\"_ftnref20\">[20]<\/a> There are multiple high-profile redaction failures that have exposed information that someone wanted to keep secret.<a href=\"#_ftn21\" name=\"_ftnref21\">[21]<\/a><\/p>\n<p>Ineffective redaction can be detected before information is leaked; however, if it is not detected, that information sits available to all.<a href=\"#_ftn22\" name=\"_ftnref22\">[22]<\/a> Researchers have built a tool called Edact-Ray to identify, break, and fix information leaks.<a href=\"#_ftn23\" name=\"_ftnref23\">[23]<\/a> The program focuses on the size of the characters and their positioning; it then compares the size of the redaction with a predefined \u201cdictionary\u201d of words to estimate what has been replaced.<a href=\"#_ftn24\" name=\"_ftnref24\">[24]<\/a> This software can eliminate 80,000 estimates per second. When it detects a vulnerable PDF redaction, it removes the underlying text from the PDF.<a href=\"#_ftn25\" name=\"_ftnref25\">[25]<\/a> The inventors of this tool intend to release parts of this program to help identify non-excising redactions and help repair those redactions.<a href=\"#_ftn26\" name=\"_ftnref26\">[26]<\/a> For those individuals and entities that intend to use digital redaction in the future and do not intend on using Edact-Ray, changing the content of the original document before redacting can be one way to avoid failure.<a href=\"#_ftn27\" name=\"_ftnref27\">[27]<\/a> While redacting will never be proof, understanding that redaction is not as secure as one thinks will help avoid careless mistakes.<a href=\"#_ftn28\" name=\"_ftnref28\">[28]<\/a><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"#_ftnref1\" name=\"_ftn1\">[1]<\/a> <em>See<\/em> <em>e.g., <\/em>Adam Pez, <em>Digital Redaction Fails &amp; Best Practices: How to Keep Your Sensitive Information Safe<\/em>, Intralinks (Sept. 3, 2020), https:\/\/www.intralinks.com\/blog\/2020\/09\/digital-redaction-fails-best-practices-how-keep-your-sensitive-information-safe; Matt Burgess, <em>Redacted Documents Are Not as Secure as You Think<\/em>, wired (Nov. 25, 2022), https:\/\/www.wired.com\/story\/redact-pdf-online-privacy\/.<\/p>\n<p><a href=\"#_ftnref2\" name=\"_ftn2\">[2]<\/a> <em>See<\/em> Pez, <em>supra<\/em> note 1.<\/p>\n<p><a href=\"#_ftnref3\" name=\"_ftn3\">[3]<\/a> <em>Id<\/em>.<\/p>\n<p><a href=\"#_ftnref4\" name=\"_ftn4\">[4]<\/a> <em>See <\/em>Maxwell Bland, et al., <em>Story Beyond the Eye: Glyph Positions Break PDF Text Redaction<\/em> 1 (2022).<\/p>\n<p><a href=\"#_ftnref5\" name=\"_ftn5\">[5]<\/a> <em>See <\/em>Pez, <em>supra <\/em>note 1.<\/p>\n<p><a href=\"#_ftnref6\" name=\"_ftn6\">[6]<\/a> <em>See <\/em>Burgess, <em>supra<\/em> note 1.<\/p>\n<p><a href=\"#_ftnref7\" name=\"_ftn7\">[7]<\/a> <em>See id<\/em>.<\/p>\n<p><a href=\"#_ftnref8\" name=\"_ftn8\">[8]<\/a> <em>See<\/em> <em>id<\/em>.<\/p>\n<p><a href=\"#_ftnref9\" name=\"_ftn9\">[9]<\/a> <em>See<\/em> Bland, <em>supra <\/em>note 4, at 1.<\/p>\n<p><a href=\"#_ftnref10\" name=\"_ftn10\">[10]<\/a> Burgess, <em>supra <\/em>note 1.<\/p>\n<p><a href=\"#_ftnref11\" name=\"_ftn11\">[11]<\/a> Lisa C. Wood &amp; Marco J. Quina, <em>Litigation Practice Notes from the Field the Perils of Electronic Filing and Transmission of Documents<\/em>, 22 Antitrust ABA 91, 91 (2008).<\/p>\n<p><a href=\"#_ftnref12\" name=\"_ftn12\">[12]<\/a> <em>See <\/em>Bland, <em>supra<\/em> note 4, at 2.<\/p>\n<p><a href=\"#_ftnref13\" name=\"_ftn13\">[13]<\/a> <em>See <\/em>Judge Herbert B. Dixon Jr., <em>Embarrassing Redaction Failures<\/em>, 58 the judges journal 37, 38 (2019).<\/p>\n<p><a href=\"#_ftnref14\" name=\"_ftn14\">[14]<\/a> <em>See <\/em>Burgess, <em>supra <\/em>note 1.<\/p>\n<p><a href=\"#_ftnref15\" name=\"_ftn15\">[15]<\/a> <em>See<\/em> Wood, <em>supra <\/em>note 11, at 91.<\/p>\n<p><a href=\"#_ftnref16\" name=\"_ftn16\">[16]<\/a> Burgess, <em>supra <\/em>note 1; Josh Levin, et al., <em>We Cracked the Redactions in the Ghislaine Maxwell Deposition<\/em>, slate (Oct. 22, 2020), https:\/\/slate.com\/news-and-politics\/2020\/10\/ghislaine-maxwell-deposition-redactions-epstein-how-to-crack.html.<\/p>\n<p><a href=\"#_ftnref17\" name=\"_ftn17\">[17]<\/a> Levin, <em>supra <\/em>note 16.<\/p>\n<p><a href=\"#_ftnref18\" name=\"_ftn18\">[18]<\/a> <em>Id<\/em>.<\/p>\n<p><a href=\"#_ftnref19\" name=\"_ftn19\">[19]<\/a><em> See<\/em> Dixon, <em>supra <\/em>note 13, at 39.<\/p>\n<p><a href=\"#_ftnref20\" name=\"_ftn20\">[20]<\/a> <em>Id<\/em>.<\/p>\n<p><a href=\"#_ftnref21\" name=\"_ftn21\">[21]<\/a> Burgess, <em>supra <\/em>note 1.<\/p>\n<p><a href=\"#_ftnref22\" name=\"_ftn22\">[22]<\/a> Wood, <em>supra <\/em>note 11, at 92.<\/p>\n<p><a href=\"#_ftnref23\" name=\"_ftn23\">[23]<\/a> Bland, <em>supra <\/em>note 4, at 2.<\/p>\n<p><a href=\"#_ftnref24\" name=\"_ftn24\">[24]<\/a> Burgess, <em>supra <\/em>note 1.<\/p>\n<p><a href=\"#_ftnref25\" name=\"_ftn25\">[25]<\/a> <em>Id<\/em>.<\/p>\n<p><a href=\"#_ftnref26\" name=\"_ftn26\">[26]<\/a> Bland, <em>supra <\/em>note 4, at 18.<\/p>\n<p><a href=\"#_ftnref27\" name=\"_ftn27\">[27]<\/a> <em>Id<\/em>. at 17.<\/p>\n<p><a href=\"#_ftnref28\" name=\"_ftn28\">[28]<\/a> <em>See <\/em>Burgess, <em>supra <\/em>note 1.<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-10704 size-full\" src=\"https:\/\/jolt.richmond.edu\/files\/2023\/01\/Screenshot-2023-01-30-at-11.22.02-AM.png\" alt=\"\" width=\"1784\" height=\"1300\" \/><\/p>\n<p>Image Source: https:\/\/images.squarespace-cdn.com\/content\/v1\/58090c87d1758ec5d1815f6f\/1507577772082-FHNXIFFO7VSSSFCMEWOB\/howto.PNG?format=1500w<\/p>\n","protected":false},"excerpt":{"rendered":"<p>By Brianna Hughes &nbsp; &nbsp; The harm from a breach of privacy can not only be potential fines, litigation costs, loss of trade secrets and reputational damage, a breach of privacy can also put the nation\u2019s safety at risk.[1] An important tool to maintain privacy and secure confidential information is the technique of redaction.[2] Redaction [&hellip;]<\/p>\n","protected":false},"author":5472,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[51366],"tags":[],"class_list":["post-10703","post","type-post","status-publish","format-standard","hentry","category-blog-post"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/paMHOZ-2MD","jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/posts\/10703","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/users\/5472"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/comments?post=10703"}],"version-history":[{"count":3,"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/posts\/10703\/revisions"}],"predecessor-version":[{"id":10731,"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/posts\/10703\/revisions\/10731"}],"wp:attachment":[{"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/media?parent=10703"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/categories?post=10703"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.richmond.edu\/jolt\/wp-json\/wp\/v2\/tags?post=10703"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}