TSA redaction fail: hidden text easily readable via copy & paste

http://www.wanderingaramean.com/2009/12/tsa-makes-another-stupid-move.html

by anigbrowl • 17 years ago

108 54 17 years ago

This isn't the first time this has happened. Several years back, another government agency made the same mistake. On a slow computer, the text would render first, and could be seen for several seconds before the black boxes would appear.

Googling around, it seems to be a fairly common mistake, going back to at least 2000.

http://www.securityfocus.com/news/7272

http://cryptome.org/iran-cia/cia-iran-pdf.htm

http://blogs.zdnet.com/BTL/?p=12907

pasbesoin2• 17 years ago

In the same vein, if not the same format: Distributing a Word document from which you've not removed change tracking (and/or other metadata). (Or whatever Word calls it; it's been a while.) I had to correct my teammates on this one, a while back (and yes, the documents were going to external clients). Nothing novel; the problem's been in the news repeatedly. Nonetheless, people -- even "technical" -- still don't get it right.

(I encouraged them to go further and switch to PDF format for the distribution, but they wouldn't.)

wgj2• 17 years ago

Want to know which twelve passports will instantly get you shunted over for secondary screening, simply by showing them to the ID-checking agent?

Cuba, Iran, North Korea, Libya, Syria, Sudan, Afghanistan, Lebanon, Somalia, Iraq, Yemen, or Algeria

staunch• 17 years ago

That's such an obvious list I'm not sure if it's from the document itself, or if you just wrote down what it would probably be.

endtime• 17 years ago

I was a little surprised about Cuba. They're not our favorite government, but I don't see them as a security risk.

wgj2• 17 years ago

It's from the doc.

sage_joch2• 17 years ago

The absence of Saudi Arabia is pretty interesting.

RyanMcGreal• 17 years ago

Sounds like George Carlin's seven words you can't say on TV.

cduan• 17 years ago

It's helpful to understand a little bit of how a PDF file works.

A PDF file stores a sequence of instructions for what do draw on a page. The instructions are commands, such as "write this text here" or "draw a circle there." When you draw black redaction boxes, you are just appending an instruction to the end of the list ("draw a box here"), but most of the time the previous instructions are all still there.

Really, the only way to redact a PDF with certainty, short of manually reading the file itself (yes, PDF files are text-readable; you just have to decompress them) is to rasterize the file to a large image. Otherwise, the instructions for writing the text are all still in the file, and there are any number of ways to extract them (for example, simply by deleting the instruction to draw the redaction box).

anigbrowl5• 17 years ago

Mrs Browl works at a e-discovery company where documents are often redacted depending on which bits are admissible in court; I gather they use TIFF files for exactly the reasons you describe.

I suppose the (extremely limited) redaction features in Acrobat stem from the belief that the document is ultimately destined for printing rather than computer reading.

pasbesoin2• 17 years ago

I have no personal experience and at best perhaps a vague recollection of having read or heard something, but would document images be or in the past have been used also to make discovery as inefficient as permitted for the opposition? Images require a person to analyze, or pre-processing before electronic search and analysis can be performed against them.

eli• 17 years ago

I heard once that NSA guidelines are to print out PDFs, redact portions with a marker and then rescan them into new files.

metachor• 17 years ago

I also work at an e-discovery company and can confirm the use of TIFF files as the court-admissible format for producing any sort of document (especially if it has redactions).

Here is an example of the process to apply redactions to a PDF file (or any sort of electronic document). The document is opened in a third-party native viewer with redaction capabilities (and not in the original application like Arcobat or Office). The end-user draws a black box over the appropriate text using the third-party native viewer. This redaction is saved as a separate layer that can be rendered on top of the native document when viewed in the software, as well as printed out. Finally, when documents need to be produced for court, they are printed out to a TIFF-printer driver, effectively converting them to TIFF and "burning in" the redaction layer. The TIFFs are delivered to the courts and opposing council.

mschwar992• 17 years ago

A government document can't (shouldn't) be rasterized because it would loose all the tagging information making it non-accessible in a 508 sense.

It is however trivial for even a non-technically inclined person to remove the text content through Acrobat's content editing pane.

Just as you suggest, things like this seem to be an example of someone in a large organization not quite understanding how the "magic" behind the tools they use work and winding up with results they didn't expect.

weaksauce• 17 years ago

I understand that but why would they not just replace the area with text that says [ redacted ] instead of the black box?

Edit: you can pad the redacted box with spaces to keep the formatting consistent.

bia• 17 years ago

If you open the file in Adobe Acrobat Pro, there's a tool called "TouchUp Object" that lets you literally just click and delete the boxes.

milkshakes• 17 years ago

searchable too. are we feeling safer yet?

rms• 17 years ago

On Scribd: http://www.scribd.com/doc/23757640/Screening-Management-SOP-...

sage_joch2• 17 years ago

It's a lengthy document. Luckily, they've highlighted the areas of interest.

pmorici3• 17 years ago

They aren't all that remarkable.

zitterbewegung• 17 years ago

This should be required reading on redaction in the government. http://www.fas.org/sgp/othergov/dod/nsa-redact.pdf

anigbrowl5• 17 years ago

Nice one. I had to giggle at the ubiquity of the MS Office assistant down in the corner... It looks like you're trying to conceal some information from prying eyes. Would you like help with that?

julio_the_squid• 17 years ago

Pretty ridiculous. Why not just make one version for internal distribution, and a completely separate document for the public?

jrockway• 17 years ago

Because that would cut into your Solitaire time.

sorbus• 17 years ago

Using the link in the article, it appears that it's already been taken down (link leads to a 404 page). However, from the comments in the article, it's been mirrored at http://cryptome.org (at the top of the list, in fact, filename is tsa-screening.zip, in case that makes it easier to find it).

anigbrowl5• 17 years ago

Looking at the dates on the document, it was last revised in May 2008, so it seems like the horse left the stable some 18 months ago as far as actual bad guys and spies (who presumably seek out this information more actively than your or I) are concerned.

noonespecial• 17 years ago

I like watching Security Theater as much as the next guy, but this season's plot is so thin, I'm having trouble suspending disbelief.

zacku235• 17 years ago

I downloaded it earlier but it seems to have been taken down now. Very interesting. I bet that will lose some people their jobs - but I think it definitely highlights an underlying issue within the government bureaucracy that shows why people getting paid 30k with degrees from the University of Phoenix shouldn't be entrusted with national security... I wonder how many security people that passed through...

pmorici3• 17 years ago

"bet that will lose some people their jobs"

I doubt it. the more likely outcome is they mandate all their employees attend document redaction training developed and administered at great tax payer cost by a government contracting company. It's also quite likely that they use the incident to justify spending millions to have a government contractor write document redaction software.

grinich• 17 years ago

Here's a version with the redactions lifted and the areas highlighted. http://cryptome.org/tsa-screening.zip

clistctrl• 17 years ago

it would be really interesting if the government attempts to go after you for hosting that document.

carbon8• 17 years ago

That's actually hosted by cryptome: http://en.wikipedia.org/wiki/Cryptome

ryanwaggoner• 17 years ago

Most interesting thing I learned from the document: members of Congress get special ID cards. It makes sense, I just never thought about it before.

tlrobinson• 17 years ago

Schneier is going to have a field day with this one.

keenerd• 17 years ago

A responsible citizen would not google the following:

"SENSITIVE SECURITY INFORMATION" site:.gov filetype:pdf

Less than 2000 such PDFs. A very determined and very irresponsible citizen could have already mirrored all of them.

skorgu• 17 years ago

Well, not from their home IP they wouldn't anyway.

dhyasama• 17 years ago

My sister is an attorney and asked me about software that can catch things like this, remove metadata, etc. Does anyone have experience with something along these lines?

TSA redaction fail: hidden text easily readable via copy & paste

Related Stories