Schneier on Security

Clive Robinson • June 6, 2011 2:14 PM

Something I advise people when entering into litigation is,

“Paper, Paper, Never data”

Nearly all “data files” such as Wordpro documents contain an enourmous amount of redundant data. Often this includes “un-edit” information and alsorts of other data linking the file to a particular PC etc etc.

Now I don’t know what all that redundant data does nor do I suspect more than half the developers who made the software. Now some people earn a very respectable income out of finding out what all the redundant data means and selling their services to those involved with the legal proffession.

So if you give over the data files you don’t know what other information you are handing over to someone who is investing mind numbing levels of resources to attack you.

Thus why take the risk. If you must “file electronicaly” print the documents out and use a scanner to make image files and send those instead.

Clive Robinson • June 7, 2011 2:50 AM

@ godel,

“I’ve heard that one easy way to sanitize WP files of all the assorted cruft and old edits is to “save As an older file format. For example, save in Microsoft Word 6.0 format.”

The old way to do this was just to “save to floppy disk” as the wordpro would realise it had to dump the cruft. But who still uses floppy disks (except me 😉 these days? And as I’ve not upgraded my wordpro’s in a very very long time I don’t know if the functionality has been dropped or not.

However it does not get rid of all the data.

Another way is to first store in a human readable format such as RTF and then do a string search for data that should not be there. Then on a copy remove bits you don’t like (the RTF format is documented somewhere up on the web as it’s a quasi open standard).

Another way is to “print to file” in postscript format and go through it with open source postscript tools (there is atleast one book on postscript programing so you can check for dodgy program constructs).

Then again save as a txt file and then go to another wordpro import via the clip board etc and manually reformat (not realy allowable for legal stuff).

However I am in disagreement with one of the authors about saving in an electronic format that alows cutting and pasting, it does not do you any favours so why do them for your legal opponent.

There is a saying in the armed forces which is relevant,

“Don’t leave ammunition for the enemy.”

@ tommy,

Thanks I’ll go have a look.

Clive Robinson • June 8, 2011 12:01 AM

@ tommy,

“What exactly is wrong with what I said to godel about just saving it in .txt format and printing that out, without adding or changing any formatting which .txt hardly allows anyway, other than font etc.”

First off sorry yes I did read your earlier comment to godel,

“@ godel: Or Wordpad. Or Notepad. After all, it’s the data that are important, not how pretty the page looks, right?”

And should have mentioned what was wrong more clearly.

Firstly though please remember Judges in some respects are not as upto date / switched on as you might think (which can be a godsend in many ways but a nightmare in others).

The average judges work life has revolved, and usualy still does, around documents in the paper form. Thus they are very good at spotting when documents differ not just in words but in fonts, formating, smudges and creases as well.

This is because there is also this notion of “chain of evidence” which boils down to having certified / untampered originals with clear chains of custody etc. Or to put it another way they should be both traceable and authentic to the eye in all respects.

Most judges now understand about “the forensics” of photocopiers and how they can be used to make both good and bad copies of paper documents, and how the copies can be verified and authenticated etc.

So if a judge looks at a document that has been redacted they may ask to see the original and if the formating is not the same they are potentialy going to ask a lot of questions about authenticity, traceability and verification (the answers to which you realy realy don’t want to be trotting out in court after also removing metadata).

This is because their world view or assumptions about redacting is you “make a paper copy of the paper document and redact the paper copy” not “make an electronic copy of the electronic document and redact the electronic copy”.

This “paper copy” world view is clearly seen in the likes of FOI requests for documents, which has it’s downsides as sometimes the hole size gives significant information on what has been redacted.

A bit of illustrative history, I used to know an accountant who had the misfortune of having been unknowingly involved with an international land scam involving fax machines. Put overly simply the crooks had got him to certify a set of accounts then lifted out identifing account and other information and replaced it with false information and faxed the faked copy through to a bank in another country. The bank had incorrectly assumed the faxed fake documents were genuine faxed documents and released funds etc etc. Apparently it was the first case of fraud involving fax machines and his account of what happened in the court about how the judge had the whole of fax technology explained in great detail is an object lesson in why you don’t want “M’learned friends” enquiring to closely into technology involving their precious paper documents.

So to answer your question of,

“After all, it’s the data that are important, not how pretty the page looks, right?”

They are both as important in a judges eyes.

So on the “looks like a duck and quacks like a duck” theory your ducks “original and redacted” had better look like identical twins or M’learned friend is going to go hunting…