How NOT to redact a PDF - Nuclear submarine secrets spilled

Filed Under: Adobe, Data loss, PDF, Privacy

Is this PDF properly redacted?If you're an organisation that is making public an internal document, you best make sure that you have deleted or blacked out any personal, confidential or actionable information.

The act of obscuring the sensitive information is known as "redaction", and - for obvious reasons - needs to be done properly if you care about privacy and avoiding a potentially damaging data leak.

In the old days - before PDFs and Word documents - you might have redacted a document with a thick black marker pen, ensuring that anyone who made a photocopy of the document wouldn't be able to see the censored words. Things are different with electronic media, of course.

Unfortunately, time and time again we've seen sloppy security procedures make it far too easy for unauthorised parties to view information in electronic documents that should have been properly redacted.

The last example which has made numerous newspaper headlines, involves the British Ministry of Defence, which was found to have published a PDF document online, unintentionally revealing information about nuclear submarine security.

The PDF, entitled "SUCCESSOR SSBN - SAFETY REGULATORS' ADVICE ON THE SELECTION OF THE PROPULSION PLANT IN SUPPORT OF THE FUTURE DETERRENT REVIEW NOTE", was published on the parliamentary website following requests under the Freedom of Information Act. However, although sections were supposed to be protected through redaction - it was possible to copy-and-paste the blacked-out text straight out of it.

Quack quack oops!

As the Daily Star explained:

The bunglers turned the text background black - making the words unreadable - but crucially left them in place. That meant anyone wanting to read the censored sections just had to copy the text.

This was a real school-boy error to make - as anyone with even an ­elementary knowledge of computers would know how to read the "redacted" content.

If you want to learn how to properly redact Adobe PDF files, here's a great guide describing how to do it with Acrobat X Pro.

Good luck, and remember that simply marking text will not actually remove it from your sensitive PDFs. You also have to apply redactions!

, , , , ,

You might like

6 Responses to How NOT to redact a PDF - Nuclear submarine secrets spilled

  1. Thu Win · 1636 days ago

    Or why can't you just republish the PDF file without the censored info? :P

    • Dr Bob Matthews · 1635 days ago

      Thu Win Its rather difficult for the UK MOD civil servants to understand. Some 6years ago I worked as a contractor to the MOD advising them on computer security. They were interested in anything High Tech, but were apalling on the basics, i.e. leaving confidential files unattended on a desk, daily password written on white boards visible through a window to passers by. Using each others passwords to enter secure networks because they were too lazy to remember their own,illegal use of crypto keys.
      So for something as simple as republishing the file without the sensitive material they wouldn't even uderstand the concept!

      Best wishes

      Dr Bob Matthews

      • Thu Win · 1635 days ago

        Or why can't the creators make two copies, one with sensitive info and one without.

  2. Lexi · 1635 days ago

    Yeah, I'd think the good ol' [redacted] would work as well. . .

  3. Zenaida · 1635 days ago

    In order to work..."You must APPLY REDACTIONS to Remove Information."

  4. tahrey · 1591 days ago

    Teach 'em to use DATA EXPUNGED ... it'll score geek cred points at least.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley runs his own award-winning computer security blog at, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Follow him on Twitter at @gcluley