A failure of people to follow a process, not of technology.
On January 8, 2019 Paul Manafort’s attorneys filed a motion in Manafort’s ongoing battle with Special Counsel Robert Mueller. Due to the sensitive nature of the materials contained in the motion, Manafort’s attorneys used black boxes to “redact” the material. Their intention was to conceal the information from anyone reading the filing. They failed miserably!
As is often the case, the Manafort team blamed technology (i.e., a “technical problem”) for the failure, however, the culprit was likely human error. The technology when applied correctly works every day for millions of users, so how did this happen?
A true redaction is the permanent deletion of information from a document or file. What Manafort’s team did was merely create a markup — no different than a yellow highlight — over the critical text.
It’s not entirely clear exactly what steps the team took, but what is clear is that their attempt to redact the document didn’t work.
The following seven steps are required to apply a redaction in Adobe:
1. Identify the text to be redacted
2. Prepare the document (such as converting to PDF format)
3. Mark the information requiring redaction
4. Review the markups using the commenting tools
5. Apply the redactions which permanently deletes the text
6. Scrub the metadata, removing the text layer as well
7. Save the redacted version of the file as a new document
If the user follows these step correctly, in the absence of a software failure, the redaction will be appropriately applied.
The filing the Manafort team sent was apparently in Adobe (PDF format) and it appears that the team only followed the process up to Step 3 — marking the text, instead of reviewing and applying the redaction, scrubbing the metadata, and then saving a redacted version of the file.
The result of stopping at Step 3 is that the text can easily be copied and pasted as a number of journalists successfully demonstrated. In short, it was a failure of the people applying the redaction to follow the required process.
The Manafort team should have quality-checked their work
Another failure was to not include a quality check. As a quality assurance step after completing the seven steps to appropriately apply redactions, a simple test — one that journalists actually conducted — would have revealed the incomplete application of the redactions.
1. Select the “redacted” text in the Manafort PDF (or a similar file with a markup) and click ctrl + c.
2. Open a word processing document, email, or other text file, and click ctrl + v. If the “redacted” text copies over, the redaction has not been applied properly and the text and metadata still exists in the source PDF file.
"This high profile blunder highlights a core belief of the FORTÉ team: that to be effective people and processes must align with any technology (even simple PDF redaction technology)."