Protecting Documents - From Yourself
/
How to prevent alteration of your documents, remove potentially embarrassing metadata, lock up your documents and protect them from yourself.
By Wells Anderson
TABLE OF CONTENTS
Metadata and Invisible Contents
How much confidential and hidden information in one of your documents can someone uncover? Imagine you have negotiated most of the terms of an agreement with the attorney for another party. The other attorney e-mailed you a copy of the document incorporating the agreed-upon changes. Would it be advantageous for you to see the terms of the other partys previous deal, which is very similar to your transaction? How would you feel if you saw the following hidden text in the Microsoft Word (Word) document you received: Purchase PriceBuyer agrees to pay $561887,000 lessplus shipping per truckload. This article explains how to clear out hidden text and protect against unintended revelations and violations of confidentiality that may be present in your electronic documents.
Metadata and Invisible Contents
Word documents and other files contain hidden information known as metadata. The most common metadata are facts such as the size of the file and the date it was created. The Word program creates this trail of data from the computer on which the document or its underlying template was first created. Other metadata, such as the editing time and word count, is recorded as you edit a document.
Such metadata can be merely embarrassing or downright damaging. You do not want an opponent to know that your document originated on a computer at another law firm or company unrelated to this case. That is embarrassing. It can be far worse if your opponent can find old text you thought had been deleted.
Metadata in Word documents may include some or all of the following: Author name; organization; document title; template name; date of creation; computer name; server or hard disk name; document summary; previous document authors; document revisions; editing times; document versions; template information; deliberately hidden text; and comments.
Word automatically assigns a title based on either the first line of the document or the title of the original template used to create the document. If you do not take certain specific steps when reusing a document first created by someone else, your document will have different names for author and last saved by. Be sure to check File/Properties/Summary to check accompanying information before you send a document file.
Although this article focuses on documents created with Word, WordPerfect users face similar issues and also may send text they thought had been deleted. WordPerfect documents include an Undo history by default allowing others to see what has been cut, pasted or deleted. To get rid of this Undo history, click on Edit, Undo/Redo History, Options and uncheck Save Undo/Redo Items. Be sure to save the document again.
Metadata Problems and Fixes
There are several ways to remove metadata information from a Word 2002 document: On the Tools menu, click Options, Security, select Remove personal information from this file on save, check box under Privacy options, and click OK. These steps will protect against the disclosure of your name, address, and summary information, but not hidden text, comments, revision marks, old versions and more. Microsoft Knowledge Base Article 290945, found at www.microsoft.com under Resources, Support, Knowledge Base contains more than a dozen other steps to take to remove all metadata from a file.
A much more efficient approach to stripping information from your documents is to purchase a utility program such as Metadata Assistant or Out-of-Sight. According to the vendor, Metadata Assistant analyzes Word/Excel 97, 2000, and 2002 documents to determine the metadata a client might see, display its findings, and offers options to clean the document. It can operate as a stand-alone utility or work from within Word, Excel, and Outlook 2000 and above. Metadata Assistant retails for about $79; Payne Consulting Group, www.payneconsulting.com.
Out-of-Sight performs individual or batch analysis and removal functions on Word or Excel files. A Microsoft Outlook function processes e-mail attachments. Its administration tool manages Out-of-Sight on PCs throughout a network. Out-of-Sight retails for $35; SoftWise, www.softwise.net.
Despite your best efforts to remove information from a Word document, attaching a file to an Outlook 2002 e-mail message will mean that some information will be automatically included: your name, e-mail address, and a number that can be traced to your computer. Outlook inserts this information into the custom variables section of the documents properties. To prevent this, in Outlook, choose Tools, Options, Preferences, E-mail Options, Advanced, then uncheck Add Properties to attachments to enable Reply with Changes.
Securing Old Text
· Redlining. The redlining feature in Word, Track Changes, poses the biggest hidden text threat. Track Changes records deletions and insertions, and any user can click it on to create a history of changes. If you send a document before removing the history of changes, the recipient can simply go into Track Changes to view deleted and changed language. To prevent disclosure of redlined information, go to Tools, Track Changes, Accept or Reject Changes, click Accept All.
· Versions. Word allows you to save multiple versions of a document within the same file. Clicking on File, Versions, Save Now creates a copy of how the document looks now. Versions allow a user to see snapshots of a document taken while it was under construction. Remove the versions before sending a document by going to File, Versions, then selecting and deleting each one. Metadata Assistant and Out-of-Sight can remove both Track Changes history and versions.
· Fast Save. The Fast Save feature in Word accelerates the process of saving a document. If you revise a document while using this feature, the revision will look as you expect it to, but the file itself will hide rather than delete text you think you deleted. To protect yourself, turn off the Fast Save feature: Tools, Options, Save, then uncheck Allow Fast Saves.
· Undo. A common misconception about resurrecting text in a Word document is that the Undo function can recreate changed or deleted text. When actively editing an open document, you can do this. But I have found no evidence of undoablility after a file has been closed.
· Text Remnants on Disks. Document files are not the only place where others may find remnants of documents you do not want them to see. When you delete a file on a Windows PC, the text of your file is not destroyed. The space on the disk where the file once resided is now marked as available, but it is not erased. To prevent unintentional release of deleted files, you need to be careful with diskettes, rewritable CDs (CDRWs), and hard drives.
When you give a document to another party on a diskette or CDRW, be sure to use a brand new disk. Merely deleting files or reformatting an old disk will not destroy documents. If you sell, donate, or discard a PC, reformatting the hard drive will not erase all of its confidential contents. Using a secure erase or wipe program on the hard disk is the only way to truly delete all of its contents.
Prevent Alteration
If you provide paper documents to clients and other parties, it is very difficult for them to make undetectable alterations. Electronic documents, on the other hand, are very easy to alter. The most commonly known methods of protecting them are far from secure.
All versions of Word contain a password option. A quick search of the Internet reveals any number of programs that can be used to attack Word documents with built-in passwords. The most recent version, Word is more secure than earlier ones. Using long, non-obvious passwords can make it very difficult to break into a protected Word document with hacker tools.
Another common approach to securing a document against alteration is to create a PDF file using Adobe Acrobat (the full version, not the free download that reads but does not create files). Many people who use Adobe Acrobat are unaware that the Touch-Up Text tool allows anyone to make limited changes to the text of a PDF file, such as changing the word not to now. Although Acrobat has a password-protection feature, tools are also available for attacking PDF files.
Acrobat has a seldom-used security feature that is much more effective. Acrobat Self-Signed Security uses a private/public key system that helps you verify that the document actually came from an author who used the feature.
Lock Up Documents
Documents sent as attachments to e-mail can be intercepted. There are a number of ways to use encryption to protect documents. Striking a balance between security and convenience is difficult. (See the article Encryption, page xx of this issue). PGP Version 8.0 is an excellent encryption program now available as freeware -www.pgpi.org/products/pgp/versions/freeware/winxp/8.0 ). Its also available as a commercial product for $50 in versions addressing the different needs of individual and organizations from www.pgp.com. PGP products product E-mail and attachments while in transit across the Internet. An excellent service that makes it simple to secure e-mail and attachments is PKI Innovations, www.pk3i.com. The service costs $99 per year.
Avoid Document Deletion
· Inadvertent Deletion. You and your own actions present the biggest threat to your documents. It is all too easy to delete or overwrite a document you didnt intend to (no one is perfect). The Windows Recycle Bin may come to the rescue if you inadvertently delete a file. Utility suites such as Norton SystemWorks provide even more protection, with Undelete utilities and a Protected Recycle Bin. But even these tools provide no protection against the most serious error, overwriting an important file with a document youve given the same name.
Backup programs offer excellent protection against human imperfections. In addition to a nightly backup routine, consider running a backup utility that operates continuously or periodically throughout the day, copying new and changed files to an alternate location such as another computers local hard drive. BackUp MyPC for $79 from Stomp, Inc., is highly recommended, www.stompinc.com.
· Software Crashes. Older versions of Windows can be prone to crash, especially after years of regular use. When Windows goes down, it can take documents youre drafting with it. Be sure to activate the AutoRecover option and reduce the time interval to three minutes. AutoRecover periodically makes or updates a copy of all documents you have open. To turn it on in Word 2000 or 2002, go to Tools, Options, Save, AutoRecover.
· Disk Crashes. Computer hard drives are not designed to run forever. Some day, the disk drive youre working on will stop working. You have several methods for guarding against losing files if your disk drive dies. The first line of defense is a network backup system, but its files may be more than 12 hours old. Instead, consider a second line of defenseperiodic copies of work in progress.
Network Unplugged synchronizes files to another drive, on the same computer, another PC on your network, or across an Internet connection, about $80 and up, from Mobiliti, www.mobiliti.com. Worldox document management software constantly creates shadow versions of your recent documents, storing them on a local hard drive. If your network or server goes down, your recent work is safe. You can pick up working where you left off and beat your deadlines.
· Viruses. Unless you use software to purge incoming viruses hidden in Word document macros, you will be exposed to losing files and/or unintentionally sending out infected documents. All major antivirus software products provide protection, but an especially effective product is MailDefense (http://www.indefense.com), which strips out malicious macros and allows you to receive safe Word attachments. Viruses are now a fact of computer life. Be sure you install and update good protective software, such as Norton AntiVirus, and do not open an E-mail attachment, especially from someone you trust, unless you are expecting it. Virus Watch, GPSolo (June 2001)
http://www.abanet.org/genpractice/magazine/june2001/june01_09.html
· Hackers. Additional firewall software or hardware is necessary to protect your documents from hackers. Hardware firewalls protect most people at the office, but these need occasional updates from the vendors, just like software. Make sure your office stays current. Documents you create at home and on the road need protection, too. Firewall software such as BlackICE (www.networkice.com) or ZoneAlarm (www.zonelabs.com) can help with this.
Forewarned is forearmed. The time you invest following these recommendations will repay you many times over as you work more securely with your valuable documents.
