Redact Documents and Protect Privileged Information

By Dee-Ann LeBlanc | Published Mar 3, 2009

Informative Graphics Releases Redact-It Enterprise Scrubbing (redacting) a sensitive document for electronic publication may seem like a simple process. Yet, as many high profile corporations and government agencies have shown, it's not as simple as it first appears.

The Informative Graphics Group's latest white paper, "Electronic Redaction: How to Properly Redact Documents," can help your organization's next redacted release be far more secure and far less embarrassing.

The Most Common Redaction Mistake

Believe it or not, Informative Graphics points out that a single technique is responsible for an amazing number of incidents.

Say that you have a document you want to release, but it needs to be redacted first so that sensitive information is not revealed to the general public. You open the document in your word processor. Then you open its handy drawing tool. With the tool, you draw a solid black shape over the text that needs to be hidden. Convert the document to PDF and put it online. Job done, right?

Wrong.

All someone has to do is select all of the text in the document, or even just the paragraph. A quick copy and paste and now they can read the whole thing, including the redacted information.

Even worse, if they really know what they're doing, they can view the document's metadata and see all of the document's revision information. Remember that sarcastic comment the CEO made about a poorly-chosen phrase? That's now front page news.

Avoiding Redaction Headaches

So how do you avoid these issues? Informative Graphics suggests the following:

A Formal Policy: Create a formal redaction policy so that everyone understand what types of documents need to be redacted before release and who should do it — a redaction expert? someone in house?
Identify Needs: Identify your redaction needs so that you can select an appropriate tool. Do your documents need to remain in a word processing format? A PDF? Your tool has to be able to generate a result that can't easily be worked around. Are you willing to save the results as a TIFF image, which can't be searched? Or are your sensitivity needs so stringent that you need to hide the length of words or phrases so no one can reverse-engineer the results
Verify and Verify Again: Verify that the proposed redactions are correct and correctly applied before completing the process, and then verify the document again once the redaction process is finished.

Try out the trick discussed above. If you can copy and paste and suddenly see all of that sensitive information, get a better tool.