5 ms·

Never trust a lawyer with a redact tool any more complicated than a marker. I've seen lawyers at major, high-priced law firms make this same mistake. Once it

by rkagerer 10mo ago

Never trust a lawyer with a redact tool any more complicated than a marker. I've seen lawyers at major, high-priced law firms make this same mistake. Once it was a huge list of individuals names and bank account balances. Fortunately I was able to intervene just before the uploaded documents were made public. Folks around here blame incompetence, but I say the frequency of this kind of cock-up is crystal clear telemetry telling you the software tools suck. If the software is going to leverage the familiarity of using a blackout marker to give you a simple mechanism to redact text, it should honour that analogy and work the way any regular user would expect, by killing off the underlying text you're obscuring, and any other correponding, hidden bits. Or it should surface those hidden bits so you can see what could come back to bite you later. E.g. It wouldn't be hard to make the redact tool simultaneously act as a highlighter that temporarily turns proximate text in the OCR layer a vibrant yellow as you use it.

jdlshore 10mo ago
Apple’s Preview app (which has a very thorough PDF markup tool) does this right: it has an explicit “redact” tool which deletes the content it’s used on.
- bg_tagas 10mo ago
  [dead]
bena 10mo ago
I think it's part laziness here. Placing a black rectangle on a PDF is easier than modifying an image or removing text from that same PDF.
- maxerickson 10mo ago
  The tool in Acrobat is exactly placing black rectangles on stuff. There's a second step you are supposed to do when you are finishing marking the redactions that edits out the content underneath them, and offers to sanitize other hidden data: https://www.adobe.com/acrobat/resources/how-to-redact-a-pdf.html https://www.adobe.com/acrobat/resources/how-to-redact-a-pdf.... That failed redactions happen over and over and over is kind of amazing.
  - metabagel 10mo ago
    I hope you're not blaming the users. It's understandable they would be confused. The software needs to clarify it for the user. Perhaps, when you try to save it, it should warn you that it looks like you tried to redact text, and that text is still embedded in the document and could be extracted. And then direct you to more information on how to complete the redaction.
    - maxerickson 10mo ago
      Professional users doing more than 1 document? Yes, I'm absolutely blaming them. I agree that affordances are good, but tools are tools, they can have rough edges, it's okay that it occasionally takes more than zero knowledge and attention to use them.
    - creata 10mo ago
      The software could do better, sure, but in this case the accountability clearly falls on the lawyers. It's their job - and it's a job that can profoundly impact people's lives, so they need to take it seriously - to redact information properly.
    - mrguyorama 10mo ago
      We have 30 years direct evidence that the users would ignore that warning, complain about the computer warning them too much, insist that the warning is entirely unnecessary, and then release a document with important information unredacted. The problem is that the user generally doesn't have a functioning mental model of what's actually going on. They don't think of a PDF as a set of rendering instructions that can overlap. They think it's paper. Because that's what it pretends to be. The best fix for this in almost any organization is the one that untrained humans will understand: After you redact, you print out and scan back in. You have policy that for redacted documents, they must be scanned in of a physical paper.
      - tremon 10mo ago
        The problem is that the user generally doesn't have a functioning mental model of what's actually going on Sorry, but a professional user not having an operational understanding of the tools they're working with is called culpable negligence in any other profession. A home user not knowing how MS Word works is fine, but we're talking desk clerks whose primary task is document management, and lawyers who were explicitly tasked with data redaction for digital publication. I don't think we should excuse or normalize this level of incompetence.
- RajT88 10mo ago
  The consequences of fucking it up are low, too. If they get caught, they just take the document down and deny it ever got posted. Claim whatever people can show is a fake. Since they control the levers of government, there's few with the resources and appetite for holding them accountable. So far, we haven't un-redacted anything too damning, so push hasn't come to shove yet. The only might change if there's a "blue wave" in the midterms, but even then I wouldn't count on it.
- dhosek 10mo ago
  I’ve not looked too deeply, but based on other discussion, I wonder if this was malicious noncompliance meant to reveal what the higher-ups were ordering hidden. If victims’ names are properly redacted that would be strong evidence.
- WackyFighter 10mo ago
  It is more likely they have no conceptual understanding that the PDF is a file format. They likely assume that whatever is shown in the interface is what is exported.
metabagel 10mo ago
> Folks around here blame incompetence, but I say the frequency of this kind of cock-up is crystal clear telemetry telling you the software tools suck. Absolutely. They know this is confusing, and they're bound and determined not to fix it. At the least, they need a pop-up to let you know that it's not doing what you might think it's doing.
- stocksinsmocks 10mo ago
  I’m optimistic that because LLMs have brought down the cost of the mere act of typing out code that we will see a shift in focus on certification and verification. Preferably with some legal protection for customers that are sorely lacking today.
- dhosek 10mo ago
  Apple’s Preview app does exactly that. I discovered this while trying to make a blanked copy of kid #2’s homework worksheet for kid #1 who left his at school after kid #2 already wrote on her copy.
jm4 10mo ago
It often comes down to not using the right software and training issues. They have to use Acrobat, which has a redaction tool. This is expensive so some places cheap out on other tools that don’t have a real redaction feature. They highlight with black and think it does the same thing whereas the redaction tool completely removes the content and any associated metadata from the document. This was basically the only reason we were willing to cough up like $400 for each Acrobat license for a few hundred people. One redaction fuckup could cost you whatever you saved by buying something else. I would like to believe that the DOJ lacking the proper software might have something to do with DOGE. That would be sweet irony.
- wildzzz 10mo ago
  If my law firm can't afford the $20/month for a copy of Acrobat Pro, I'd be very concerned what else they are cutting corners on.
  - jm4 10mo ago
    Law firms are notoriously behind in tech. I’ve seen some shit. A small firm running on the owner’s personal Dropbox account with client matter files stored alongside his porn collection, ancient, unsupported software, unpatched systems, basically zero information security, servers in a bathroom and network switches in a shower, a literal hoarder with garbage and shit in the office, etc. The Dropbox guy was basically a giant in his practice area. Very successful. You have no idea how bad things are behind the scenes.
  - hogrug 10mo ago
    I think it's usually a bit more complicated, i.e. the people who were expected to do processes don't and someone else shows the people asking for access that there's a faster, cheaper, cooler tool.
- ozim 10mo ago
  I think someone just got free marketing materials to promote the redaction tools. Now much more people will be aware of the issue.
- 10mo ago
tobyjsullivan 10mo ago
Always worth remembering that PDFs are basically a graphic design format/editor from the 70s. It was never intended for securely redacting documents and while it can be done, that’s not the default behaviour. No surprise non-experts muck it up and I don’t see that changing until they move to special-purpose tools.
fennecbutt 10mo ago
Of course we can blame incompetence. It's incompetent not to realise your own incompetencies, also known as overconfidence. Any lawyer should be like "I don't know what I'm doing here I'll get an expert to help" just like as a software developer I'd ask a lawyer for their help with law stuff...because IANAL uwu
m463 10mo ago
> Never trust a lawyer with a redact tool any more complicated than a marker. there's white-out on my monitor. > ...frequency of this kind of ... sometimes I wonder if it is plausible deniability. Like people don't WANT to cover this up and do it in a certain way.

jdlshore 10mo ago

Apple’s Preview app (which has a very thorough PDF markup tool) does this right: it has an explicit “redact” tool which deletes the content it’s used on.

bg_tagas 10mo ago
[dead]

bena 10mo ago

I think it's part laziness here. Placing a black rectangle on a PDF is easier than modifying an image or removing text from that same PDF.

maxerickson 10mo ago
The tool in Acrobat is exactly placing black rectangles on stuff. There's a second step you are supposed to do when you are finishing marking the redactions that edits out the content underneath them, and offers to sanitize other hidden data: https://www.adobe.com/acrobat/resources/how-to-redact-a-pdf.html https://www.adobe.com/acrobat/resources/how-to-redact-a-pdf.... That failed redactions happen over and over and over is kind of amazing.
- metabagel 10mo ago
  I hope you're not blaming the users. It's understandable they would be confused. The software needs to clarify it for the user. Perhaps, when you try to save it, it should warn you that it looks like you tried to redact text, and that text is still embedded in the document and could be extracted. And then direct you to more information on how to complete the redaction.
  - maxerickson 10mo ago
    Professional users doing more than 1 document? Yes, I'm absolutely blaming them. I agree that affordances are good, but tools are tools, they can have rough edges, it's okay that it occasionally takes more than zero knowledge and attention to use them.
  - creata 10mo ago
    The software could do better, sure, but in this case the accountability clearly falls on the lawyers. It's their job - and it's a job that can profoundly impact people's lives, so they need to take it seriously - to redact information properly.
  - mrguyorama 10mo ago
    We have 30 years direct evidence that the users would ignore that warning, complain about the computer warning them too much, insist that the warning is entirely unnecessary, and then release a document with important information unredacted. The problem is that the user generally doesn't have a functioning mental model of what's actually going on. They don't think of a PDF as a set of rendering instructions that can overlap. They think it's paper. Because that's what it pretends to be. The best fix for this in almost any organization is the one that untrained humans will understand: After you redact, you print out and scan back in. You have policy that for redacted documents, they must be scanned in of a physical paper.
    - tremon 10mo ago
      The problem is that the user generally doesn't have a functioning mental model of what's actually going on Sorry, but a professional user not having an operational understanding of the tools they're working with is called culpable negligence in any other profession. A home user not knowing how MS Word works is fine, but we're talking desk clerks whose primary task is document management, and lawyers who were explicitly tasked with data redaction for digital publication. I don't think we should excuse or normalize this level of incompetence.
RajT88 10mo ago
The consequences of fucking it up are low, too. If they get caught, they just take the document down and deny it ever got posted. Claim whatever people can show is a fake. Since they control the levers of government, there's few with the resources and appetite for holding them accountable. So far, we haven't un-redacted anything too damning, so push hasn't come to shove yet. The only might change if there's a "blue wave" in the midterms, but even then I wouldn't count on it.
dhosek 10mo ago
I’ve not looked too deeply, but based on other discussion, I wonder if this was malicious noncompliance meant to reveal what the higher-ups were ordering hidden. If victims’ names are properly redacted that would be strong evidence.
WackyFighter 10mo ago
It is more likely they have no conceptual understanding that the PDF is a file format. They likely assume that whatever is shown in the interface is what is exported.

metabagel 10mo ago

> Folks around here blame incompetence, but I say the frequency of this kind of cock-up is crystal clear telemetry telling you the software tools suck. Absolutely. They know this is confusing, and they're bound and determined not to fix it. At the least, they need a pop-up to let you know that it's not doing what you might think it's doing.

stocksinsmocks 10mo ago
I’m optimistic that because LLMs have brought down the cost of the mere act of typing out code that we will see a shift in focus on certification and verification. Preferably with some legal protection for customers that are sorely lacking today.
dhosek 10mo ago
Apple’s Preview app does exactly that. I discovered this while trying to make a blanked copy of kid #2’s homework worksheet for kid #1 who left his at school after kid #2 already wrote on her copy.

jm4 10mo ago

It often comes down to not using the right software and training issues. They have to use Acrobat, which has a redaction tool. This is expensive so some places cheap out on other tools that don’t have a real redaction feature. They highlight with black and think it does the same thing whereas the redaction tool completely removes the content and any associated metadata from the document. This was basically the only reason we were willing to cough up like $400 for each Acrobat license for a few hundred people. One redaction fuckup could cost you whatever you saved by buying something else. I would like to believe that the DOJ lacking the proper software might have something to do with DOGE. That would be sweet irony.

wildzzz 10mo ago
If my law firm can't afford the $20/month for a copy of Acrobat Pro, I'd be very concerned what else they are cutting corners on.
- jm4 10mo ago
  Law firms are notoriously behind in tech. I’ve seen some shit. A small firm running on the owner’s personal Dropbox account with client matter files stored alongside his porn collection, ancient, unsupported software, unpatched systems, basically zero information security, servers in a bathroom and network switches in a shower, a literal hoarder with garbage and shit in the office, etc. The Dropbox guy was basically a giant in his practice area. Very successful. You have no idea how bad things are behind the scenes.
- hogrug 10mo ago
  I think it's usually a bit more complicated, i.e. the people who were expected to do processes don't and someone else shows the people asking for access that there's a faster, cheaper, cooler tool.
ozim 10mo ago
I think someone just got free marketing materials to promote the redaction tools. Now much more people will be aware of the issue.
10mo ago

tobyjsullivan 10mo ago

Always worth remembering that PDFs are basically a graphic design format/editor from the 70s. It was never intended for securely redacting documents and while it can be done, that’s not the default behaviour. No surprise non-experts muck it up and I don’t see that changing until they move to special-purpose tools.

fennecbutt 10mo ago

Of course we can blame incompetence. It's incompetent not to realise your own incompetencies, also known as overconfidence. Any lawyer should be like "I don't know what I'm doing here I'll get an expert to help" just like as a software developer I'd ask a lawyer for their help with law stuff...because IANAL uwu

m463 10mo ago

> Never trust a lawyer with a redact tool any more complicated than a marker. there's white-out on my monitor. > ...frequency of this kind of ... sometimes I wonder if it is plausible deniability. Like people don't WANT to cover this up and do it in a certain way.