Failed redactions: what public mistakes teach law firms

Every few years, a carefully redacted document turns out not to be redacted at all. The pattern is almost always the same: the text was covered, not removed. Here are three well-documented cases, and what a firm can do differently.

Three public examples

A court filing, January 2019. Lawyers for Paul Manafort filed a motion with several passages blacked out. Reporters quickly found that the blacked-out text could be copied and pasted into another document, and published what it said. Above the Law described the redactions as a black layer placed over the text rather than removal.

A defence report, 2011. A UK Ministry of Defence report on nuclear submarine safety was published with sections redacted, but the redactions could be reversed by copying the text into another document. According to The Register, the ministry removed it and replaced it with a properly redacted version.

A security manual, 2009. A US Transportation Security Administration screening manual was posted online in redacted form. Anyone who copied the text into a word processor could read the hidden passages, Nextgov reported.

None of these involved sophisticated tools. In each case, the "redacted" text was simply still in the file.

Why it keeps happening

• The screen lies. A black box over text looks exactly like a redaction. You can't tell the difference by looking.
• Tools differ. Drawing, annotation and highlight tools add a layer on top. Only dedicated redaction tools remove content, and some need an extra step to clean hidden data.
• Deadlines. Redaction often happens at the end, under time pressure, by whoever is free.
• No final check. Few workflows include a step where someone tries to recover what was hidden.

What the rules ask for

Court rules usually say what must be removed, not how. In US federal courts, for example, Rule 5.2 of the Federal Rules of Civil Procedure limits filings to the last four digits of Social Security, taxpayer identification and financial account numbers, the year of birth, and a minor's initials. Other courts and countries have their own rules. A filing only meets them if the removed information is actually gone.

A redaction routine for firms

1. Use a dedicated redaction tool, never drawing or highlighting tools, and turn on any option to remove hidden information.
2. Work on a copy, with a name that makes clear which version is safe to send.
3. Search, don't just scan. Search for names, account numbers and the last digits of IDs to find every instance.
4. Try to break it. Before anything leaves, someone other than the redactor selects all, copies and pastes the text, and checks the document properties.
5. Keep a record of what was removed, by whom and when, without copying the sensitive text into the record itself.
6. Keep client files in-house where you can. Uploading them to an outside service to redact them adds risk of its own. See redacting client documents in-house.

Where Ombly fits

Ombly is built so the failure in all three examples can't happen. It suggests what to hide, a person reviews every suggestion, and the export is rebuilt from pixels, so there's no text underneath to copy. For teams, it runs on your own servers and keeps an audit trail of each step. Book a call to see it with your own documents, or read how we compare.