Redacted Data and Security
What is Redaction?
Redaction is the deliberate removal or suppression of words, numbers, phrases, or even graphics from a document to preserve confidentiality. A redacted document may show black overlays where the original text appeared, or the text might be totally removed resulting in ‘white space’.
Redaction Law in the UK
How redactions must appear in the final document is governed by many laws and regulations which vary from country to country. In the United Kingdom, a document released under the FOIA (Freedom of Information Act) requires that redactions must be in black to indicate data which has been supressed, and for each redaction there must be an explanation.
Redaction in the Corporate World
In the commercial world, a business may redact a document with ‘white space’, and show no indication of the redaction, if this is for the suppression of personal data or commercially confidential information. However, such an approach is for the internal governance of that data.
A typical example of such usage would be where the HR department uses redaction to suppress automatically any user printing those parts of an employee file which reference specific classes of personal data, such as those related to an employee’s health. It might be decided that only HR personnel with roles of ‘Manager’ or ‘Director’ may see this data, but an HR Administrator should not – while still requiring sight of the file overall.
Redaction and Information Governance
To anyone involved in data protection, information governance, or regulatory compliance, the act of redacting a document is second nature. Unfortunately, all too often, redaction is happening in response to an event and not to prevent that event in the first instance.
Redaction and the GDPR
For many organisations, their first encounter with the process is when responding to a Subject Access Request as a result of their compliance with the GDPR. On the face of it, redaction is simple enough: strike out (obliterate) sensitive or privileged data from a document prior to releasing to a third party. The reality is more complex!
Law firms and government agencies use redaction extensively too, often when endeavouring to control events where a degree of public disclosure is required, while simultaneously needing to prevent classified or commercially sensitive data from being revealed.
The AstraZeneca E.U. Contract Example
Taking a topical example, central to the dispute between the European Union and the British pharmaceutical, AstraZeneca, was their contract which committed AstraZeneca to make ‘best reasonable efforts’ in respect of vaccine production.
The page which contains that phrase has now been revealed, but since the contract itself contains substantial amounts of highly confidential information, much has been rendered unreadable. These redactions were required in order that the E.U. would not cause harm to AstraZeneca’s intellectual property.
Reading Time: 7 minutes
In January 2019, the World woke up to what happens when people get redaction wrong: as lawyers representing Paul Manafort (a former lobbyist and lawyer, who chaired the Trump Presidential campaign team) filed a response to special counsel Robert Mueller’s claims that he violated his cooperation agreement by repeatedly lying to prosecutors.
Open the document as a PDF, copy the blacked-out text from page five, and paste it into a Word document. The hidden text which you now reveal shows that that Paul Manafort shared “polling data” that was “related to the 2016 presidential campaign” with Konstantin Kilimnik, a former colleague of his who the FBI’s Robert Mueller has claimed is tied to Russian intelligence. The redacted text also reveals that Manafort initially didn’t admit to meeting with Kilimnik in Madrid, and that Mueller has questioned Manafort about a “Ukrainian peace plan” that Kilimnik was involved in.
The redacted text exposed
Few professionals will have ever tried this, but the lesson learned will be remembered throughout your career. Here’s one extract:
attorneys and investigators. (See, e.g., Doc. 460 at 5 (After being shown documents, Mr. Manafort “conceded” that he discussed or may have discussed a Ukraine peace plan with Mr. Kilimnik on more than one occasion); id. at 6 (After being told that Mr. Kilimnik had travelled to Madrid on the same day that Mr. Manafort was in Madrid, Mr. Manafort “acknowledged” that he and Mr. Kilimnik met while they were both in Madrid)).
Recent history is littered with such redaction failures: other examples include photocopying printed documents which have been struck out with black felt tip pens which often reveals the ‘hidden’ text.
There is sound advice from the UK National Archives on how and when to redact, and of their seven ‘principles of redaction’, two stand out for near-universal consideration:
4.2 Redaction is carried out in order to edit exempt details from a document. Use it when one or two individual words, a sentence or paragraph, a name, address or signature needs to be removed.
4.3 If so much information has to be withheld that a document becomes nonsensical, the entire document should be withheld. In the case of paper documents the same principle should apply to individual pages.
… to which one should add personal data (personally identifiable information, or PII, for USA readers), where there is no lawful basis for the release of those data.
Where Kofax Equitrac wins in the print management software review challenge, is that it’s the cream of the crop for detailed analytics and customised reporting. In fact, the analytics are precisely what the CIO and CISO want at their fingertips as they explore their total print device utilisation.
It’s not a perfect software suite, yet, since Kofax Equitrac is not yet in the cloud, and the configuration can prove to be quite complex. These are justifiable trade-offs, though, in a world where security is paramount, and your organisation is complex.
The key issue for many organisations is that data breaches remain a massive risk, and that the risks are growing daily. Your sensitive data must be protected ‘at rest’, and when you consider the millions of emails held by the typical mid-sized organisation, and the threat of that information being exposed, then drastic measures are required.
The SolarWinds Virus
This latest threat comes on the heels of the announcement in March 2020, with the coronavirus spreading uncontrolled, that Russia’s military cyber warfare teams released their own contagion by sabotaging a tiny piece of computer code buried in a popular piece of software called “SolarWinds.” The hidden virus spread to 18,000 government and private computer networks by way of one of those software updates we all take for granted.
It’s so serious that Brad Smith, President of Microsoft, said,
“I think from a software engineering perspective, it’s probably fair to say that this is the largest and most sophisticated attack the world has ever seen”.
At the time of writing, we’re now seeing how the use of webshells has exposed more than 5,500 Exchange servers across 115 countries to a new backdoor which probably originated in China.
Redacting at rest data
While ensuring the organisation’s cyber security defences are as robust as possible remains the best option, one must assume that the likelihood of a successful penetration at some point verges on the inevitable.
The second-tier defence should involve the encryption of data at rest, using ‘smart’ encryption so that data may not be replicated or broadcast if it contains sensitive information, or is stored in a specific file location, or if it matches any number of alternative parameters.
Such second-tier defences use AI-driven redaction software suites to protect your data dynamically, and this protects the organisation from internal data breaches, whether they’re the result of malicious intent or mere carelessness.
The high-profile cyber-attacks mentioned above can give a false sense of security to even the most experienced CISO (Chief Information Security Officer) or DPO (Data Protection Officer).
Data leaks from organisations all of the time, and some of the more common breaches result from:
- Emailing or posting personal data to unintended recipients.
- Emailing or posting documents which contain personal data to recipients who don’t have a lawful basis for receiving such data.
- Documents which are printed and then lost, or left in an insecure location, whether organisation internal (such as left in the printer’s output tray) or external, such as on the seat of a train.
- Improper document disposal, not least of all being as a result of staff working from home while lacking secure (3D) document shredders.
- Outright theft of documents and data by a staff member leaving his or her employer.
Since you cannot permanently secure all data all of the time and retain a functional organisation, it is still possible to control what data is printed or emailed. This can range from enforcing the printing of security watermarks, adding QR codes which prevent ‘Smart’ multi-functional printers from making copies, preventing printing altogether based on document classifications, assigning specific rights to documents based on user credentials, and much more besides.
All of these controls, as well as the tools to redact documents dynamically according to organisational rules, are achievable for any modern office.
Kofax Output Manager, part of Kofax ControlSuite, is the ‘next generation’ of redaction software prevents most of the data breaches noted above through advanced document inspection and interrogation. It works by detecting and redacting personal data and confidential data based on individualised configurations.
Using centralized print management and scripts to standardise documents across multiple print centres, when users commit documents to printers or email systems, the software implements intelligent document controls, along with print audit trail and reporting, to restrict what can be released.
Use Kofax Redaction to Ensure Compliance
Once you have trained the software, it can identify or remove sensitive information prior to printing or transfer, or simply remove the overall document from the normal workflow.
It’s clear that if a document can be identified according to its source, file location, tags, content, or user permissions, and then have that document protected from release to a printer or email application, that your compliance systems are immediately stronger.
These approaches enable the organisation to establish a true document ‘chain of custody’, so you gain an audit trail of how has accessed – or printed – controlled data.
Taking protection even further, Kofax Output Manager encrypts your file store too, so files that have printed or are waiting to be printed are encrypted. Such protection of ‘data at rest’ is essential in the modern organisation.
The final control is to demonstrate the organisation’s regulatory compliance, and this is facilitated by creating encrypted digital copies of documents printed, again with a full audit trail.
Kofax Output Manager’s best-in-class software for print management and document control capabilities deliver the level of process orchestration you need to be in control of your information governance.
Just by protecting printed documents and preventing the unauthorised flow of sensitive information, your risks diminish, and your customers and business partners are given increased confidence in your organisation.
How Do I Find Out More?
Call the Advanced UK sales team on 01895 811811 to configure your solution.
Humperdinck Jackman – Marketing Director
Humperdinck has a 30-year career spanning Document Management Systems (DMS), data protection, Artificial Intelligence, Data Protection and Robotic Process Automation. With many articles published in print internationally, he believes the advances in office technology are such that we’re entering the 4th Industrial Revolution. Now Director of Marketing and Consulting Services at Advanced UK, he’s as active with clients as he is in endeavouring to write original blog articles.
