TSA Document Release Show Pitfalls of Electronic Redaction

The inadvertent exposure of a sensitive Transportation Security Administration security manual last month serves as a sobering reminder about the pitfalls of trying to redact, or hide, electronic text.

The lapse occurred when a contract employee posted the improperly redacted security manual — which described TSA airport screening methods that are designed to thwart terrorists — on a public Web site for federal procurements.

Other organizations, such as HSBC Bank and Facebook Inc., have also had embarrassing incidents in which text in electronic documents that they thought was unreadable was revealed.

Such lapses often result from a simple misunderstanding of how electronic redaction works, said Barry Murphy, an analyst at Murphy Insights, a Boston-based consultancy specializing in e-discovery and records management.

“Obscuring portions of text in a word processor by placing black boxes over it, for instance, does nothing to redact it,” Murphy said. The text may not be viewable, but it still can be indexed, making it very searchable and easily retrieved by copying and pasting the blacked-out portion to another document, he said.

Another common mistake is to overlook the metadata and revision histories that are often automatically embedded in Microsoft Word documents and PDF files, Murphy noted. Blacking out or deleting the text doesn’t get rid of this metadata. The only way to ensure that sensitive data isn’t simply visually hidden is to remove it using redaction tools, he explained.

In a 2005 document Merck & Co. sent to a publisher, the drug giant deleted information linking its drug Vioxx to an increased risk of heart disease. But the deleted information was included in the document’s metadata and was later recovered.

“The major, major thing is: Do not use your word processing programs for redaction,” said John Pescatore, a Gartner Inc. analyst. There are “very strong, usable software tools that can be used for electronic redaction,” he added.

Examples of automated redaction tools include Redact-IT from Informative Graphics Corp., Rapid Redact from Onstream Systems Ltd. and ID Shield from Extract Systems Inc.