“Technology & Law” is a semi-regular column posted by Keith M. Survell. It deals with the interaction of technology and security with the modern law office.
“Who knows what secrets lurk in the hearts of documents?”
If you use e-mail to send documents back and forth between clients and counsel, chances are that someone has read more information from your document than you intended – maybe even a lot more.
The problem is “metadata,” which means “information about data.” It’s all the statistical information stored along with your documents that allows your computer to tell you who was the last person to edit a document, how many words are in your document, and what changes were made to the document by every person who had opened it previously.
Consider this scenario: you’re working on a document for a client (let’s call him “Client A”), but you need to start a new document for a different client (let’s call him “Client B”). You need to make the same type of document for Client B, so rather than start from scratch, you simply change some text in the current Client A document and save it into Client B’s file. Then, when you’re done, you e-mail it to Client B. What you may not realize, however, is that you may have just emailed a complete copy of Client A’s document – including all the possible sensitive, personal information – to Client B.
This sort of problem is becoming more and more frequent as an increasing number of people send documents – especially word-processing documents like Microsoft Word or Corel WordPerfect – back and forth via e-mail. Unlike printed documents, e-mailed documents can retain all of the file’s information, which often includes things such as the name of the last person to edit a document or fragments of text that had previously been deleted.
One solution that a lot of people are turning to is the Portable Document Format, more commonly known as PDF. When a document is converted to PDF, it loses a lot of the hidden information that the original document contained. However, PDFs are not a perfect solution. Depending on the settings you use when converting a document to PDF, most PDF creators try very hard to preserve everything about your document when it is converted to PDF – which can include hidden information. If you are sending redacted documents via PDF, it may still be possible for people to read the information you have blacked out – especially if you have simply highlighted words or paragraphs in black. Some PDF creators dutifully convert the blacked-out text when the PDF is created – and an industrious user can simply highlight the blacked-out text and read it. This is because the text is still there – it is just covered by a layer of black highlighting. This particular method of revealing redacted information has been used on documents released by government agencies – much to their chagrin. And it’s not just overzealous reporters who are looking for hidden information in documents – some attorneys regard this hidden information as a great source, and they regularly “mine” the data out of any documents sent to them. This has become such a privacy concern that some states’ bar associations have ruled the practice unethical.
There are ways to protect yourself from this kind of exposure, of course. Avoiding “copy and paste” creation of new documents can help keep sensitive information out of documents. If you use a document assembly program (such as TurboLaw) to create your documents, you’re even better off, as each document is created “cleanly” from a template that has no personal information in it.
Many of the options to save hidden data are turned on by default in most word processors, but they are options and can thus be turned off. Here are some tips on how to turn these options off for users of Microsoft Word:
Turn off “Fast Saves”
To turn off this option, click the “Tools” menu and choose “Options.” Then, click on the “Save” tab and un-check the box labeled “Allow Fast Saves.”
Remove “Hidden” Information
To stop Word from saving information about who has created or modified a document, click on the “Tools” menu and choose “Options.” Then, click on the “Security” tab and check off every box under the heading “Privacy Options.” This will stop some information from being saved, as well as give you warning when you are saving a document that contains other information (such as tracked changes).
Turn off “Versioning”
Word’s Versioning feature saves multiple copies of your document, providing a nice history of all the changes that have been made to it. Before you send a document to someone, you should check to make sure that you don’t have any saved versions hidden in the document. To do this, click the “File” menu and choose “Versions.” In the dialog box which appears, click on any versions which appear and click “Delete.”
Don’t use Highlighting to Redact Information
If you are going to send a document to someone else and you want to hide sensitive information (such as Social Security Numbers), you shouldn’t use the “highlight” feature in Word to redact the information. Instead, delete the information and replace it with something else, such as “xxx-xx-xxxx.” This will ensure that no one will be able to extract the hidden data beneath the highlighting. (You can, of course, put the original Social Security Number back after you have sent or converted the document.) This method is especially useful when converting a document to PDF.
Beware of “Track Changes”
The “Track Changes” feature is wonderful for collaborating with other users and when many people need to make changes to a document that is then reviewed by someone else. However, if turned on inadvertently, the Track Changes feature can save all of the edits and changes you have made to a document – which will then be visible to whomever you send the document. Turning off the Track Changes feature doesn’t remove the information, either – it’s still there, it’s just not shown onscreen.
To get rid of tracked changes and comments, you need to accept or reject the changes and delete the comments. Here’s how:
- On the View menu, point to Toolbars, and then click Reviewing.
- On the Reviewing toolbar, click Show, and then make sure that a check mark appears next to each of the following items:
Comments
Ink Annotations (Word 2003 only)
Insertions and Deletions
Formatting
Reviewers (Point to Reviewers and make sure that “All Reviewers” is selected.)
If a check mark does not appear next to an item, click the item to select it.
- On the Reviewing toolbar, click Next to advance from one revision or comment to the next.
- On the Reviewing toolbar, click Accept Change or Reject Change/Delete Comment for each revision or comment.
- Repeat steps 3 and 4 until all the revisions in the document have been accepted or rejected and all the comments have been deleted.
Convert Documents to PDF
In addition to all of the steps above, converting a document to PDF is one of the best ways to prevent sensitive information from being inadvertently disclosed to other parties. You can purchase Adobe’s Acrobat product to convert documents to PDF easily, or you can find several basic (but free) PDF-creating packages on the Internet.
For More Information
The following links provide more information and insight into the problem of hidden information in documents.
Colorado Bar Association: “Metadata: Hidden Information in Microsoft Word Documents and Its Ethical Implications” (PDF Link)
NSA Redaction Guidelines: “Redacting with Confidence: How to Safely Publish Sanitized Reports Converted From Word to PDF” (PDF Link)
Microsoft Office Online: “Get rid of tracked changes and comments, once and for all”
