Facebook settlement revealed via poor PDF redaction

Facebook’s confidential settlement of a lawsuit brought by social networking site ConnectU – created by Facebook CEO Mark Zuckerberg’s Harvard classmates, and worked on by a young Zuckerberg himself — was revealed Wednesday when Associated Press writer Michael Liedtke reported that redacted portions of a PDF transcript of a court hearing, at which details of the settlement were discussed, could be easily revealed.

“Large portions of that hearing are redacted in a transcript of the June hearing, but The Associated Press was able to read the blacked-out portions by copying from an electronic version of the document and pasting the results into another document,” Liedtke wrote in his article.

The improperly redacted document — an Adobe senior product manager says someone “added a white rectangle over the white text in order to cover it” thinking incorrectly it was “sufficient to make that content undiscoverable” — revealed that ConnectU received somewhere between from $31 million and $65 million to settle its lawsuit, and that Facebook’s internal valuation was about $3.7 billion.

It’s not the first time censors have gotten bitten by Adobe Acrobat’s PDF files and Microsoft Word’s documents. InformationWeek reports:

Earlier that year, the redacted text in a PDF of a U.S. military report containing classified information was revealed because the creator of the PDF reportedly placed black rectangles over the text rather than deleting it. The document described the investigation into the death of Nicola Calipari, an Italian citizen, at a checkpoint in Iraq on March 4, 2005.

A similar situation occurred in 2000, when The New York Times published on its Web site PDF files of a previously secret CIA report, “Clandestine Service History, Overthrow of Premier Mossadeq of Iran, November 1952-August 1953.” The Times electronically blacked out certain names in the scanned report to protect those named. But New York architect John Young, who maintains the sensitive document archive Cryptome.org, discovered that the black overlay used by The Times loaded slowly on an underpowered computer, allowing the covered text to be read.

Adobe has provided two tools to redact content and related information effectively: “Redaction,” a tool that will completely remove visible information from a document so that it cannot be recovered; and “Examine Document,” a way to detect and remove information that might not be readily apparent, like document metadata and comments.

Additionally, a document on proper redaction technique was published by the National Security Agency in December 2005.

As expected in the IT world, user education is key in changing behavior. Until then, PDF redaction continues to draw lawyers’ ire.