Volume 20, Number 4
June 2003
How to Protect Electronic Documents-From Yourself
By Wells Anderson
Wells Anderson delivers training and customizes software for law offices. He writes and presents regularly on legal technology topics. Reach him at wa@wellslegaltech.com or 800/575-0007.
How much confidential and hidden information in one of your
documents can someone uncover? Imagine you have negotiated most
of the terms of an agreement with the attorney for another party.
The other attorney e-mailed you a copy of the document
incorporating the agreed-upon changes. Would it be advantageous
for you to see the terms of the other party's previous deal,
which is very similar to your transaction? How would you feel if
you saw the following hidden text in the Microsoft Word (Word)
document you received: "Purchase Price-Buyer agrees to pay
$561887,000 less plus shipping per truckload." This article
explains how to clear out hidden text and protect against
unintended revelations and violations of confidentiality that may
be present in your electronic documents.
Metadata and Invisible Contents
Word documents and other files contain hidden information known
as metadata. The most common metadata are facts such as the size
of the file and the date it was created. The Word program creates
this trail of data from the computer on which the document or its
underlying template was first created. Other meta-data, such as
the editing time and word count, is recorded as you edit a
document.
Such metadata can be merely embarrassing or downright damaging.
You do not want an opponent to know that your document originated
on a computer at another law firm or company unrelated to this
case. That is embarrassing. It can be far worse if your opponent
can find old text you thought had been deleted.
Metadata in Word documents may include some or all of the
following: author name; organization; document title; template
name; date of creation; computer name; server or hard disk name;
document summary; previous document authors; document revisions;
editing times; document versions; template information;
deliberately hidden text; and comments.
Word automatically assigns a title based on either the first line
of the document or the title of the original template used to
create the document. If you do not take certain specific steps
when reusing a document first created by someone else, your
document will have different names for "author" and "last saved
by." Be sure to go to File/Properties/Summary to check
accompanying information before you send a document file.
Although this article focuses on documents created with Word,
WordPerfect users face similar issues and also may send text they
thought had been deleted. WordPerfect documents include an Undo
history by default, allowing others to see what has been cut,
pasted, or deleted. To get rid of this Undo history, click on
Edit, Undo/Redo History, Options, and un-check Save Undo/Redo
Items. Be sure to save the document again.
Metadata Problems and Fixes
There are several ways to remove metadata information from a Word
2002 document: On the Tools menu, click Options, Security, select
"Remove personal information from this file on save," check box
under Privacy options, and click OK. These steps will protect
against the disclosure of your name, address, and summary
information, but not hidden text, comments, revision marks, old
versions, and more. Microsoft Knowledge Base Article 290945,
found at www.microsoft.com under Resources, Support, contains
more than a dozen other steps to take to remove all metadata from
a file.
A much more efficient approach to stripping information from your
documents is to purchase a utility program such as Metadata
Assistant or Out-of-Sight. According to the vendor, Metadata
Assistant analyzes Word/Excel 97, 2000, and 2002 documents to
determine the metadata a client might see, displays its findings,
and offers options to clean the document. It can operate as a
stand-alone utility or work from within Word, Excel, and Outlook
2000 and above. Metadata Assistant retails for about $79; Payne
Consulting Group, www.payneconsulting.com.
Out-of-Sight performs individual or batch analysis and removal
functions on Word or Excel files. A Microsoft Outlook function
processes e-mail attachments. Its administration tool manages
Out-of-Sight on PCs throughout a network. Out-of-Sight retails
for $35; SoftWise, www.softwise.net.
Despite your best efforts to remove information from a Word
document, attaching a file to an Outlook 2002 e-mail message will
mean that some information can be automatically included: your
name, e-mail address, and a number that can be traced to your
computer. Outlook inserts this information into the custom
variables section of the document's properties. To prevent this,
in Outlook, choose Tools, Options, Preferences, E-mail Options,
Advanced, then uncheck "Add Properties to attachments to enable
Reply with Changes."
Securing Old Text
-Redlining. The redlining feature in Word, Track Changes, poses
the biggest hidden text threat. Track Changes records deletions
and insertions, and any user can click it on to create a history
of changes. If you send a document before removing the history of
changes, the recipient can simply go into Track Changes to view
deleted and changed language. To prevent disclosure of redlined
information, go to Tools, Track Changes, Accept or Reject
Changes, click Accept All.
-Versions. Word allows you to save multiple versions of a
document within the same file. Clicking on File, Versions, Save
Now creates a copy of how the document looks now. Versions allows
a user to see snapshots of a document taken while it was under
construction. Remove the versions before sending a document by
going to File, Versions, then selecting and deleting each one.
Metadata Assistant and Out-of-Sight can remove both Track Changes
history and versions.
-Fast save. The Fast Save feature in Word accelerates the process
of saving a document. If you revise a document while using this
feature, the revision will look as you expect it to, but the file
itself will hide rather than delete text you think you deleted.
To protect yourself, turn off the Fast Save feature: Tools,
Options, Save, then uncheck Allow Fast Saves.
-Undo. A common misconception about resurrecting text in a Word
document is that the Undo function can recreate changed or
deleted text. When actively editing an open document, you can do
this. But I have found no evidence of "undoability" after a file
has been closed.
-Text remnants on disks. Document files are not the only place
where others may find remnants of documents you do not want them
to see. When you delete a file on a Windows PC, the text of your
file is not destroyed. The space on the disk where the file once
resided is now marked as available, but it is not erased. To
prevent unintentional release of deleted files, you need to be
careful with diskettes, rewritable CDs (CDRWs), and hard
drives.
When you give a document to another party on a diskette or CDRW,
be sure to use a brand-new disk. Merely deleting files or
reformatting an old disk will not destroy documents. If you sell,
donate, or discard a PC, reformatting the hard drive will not
erase all of its confidential contents. Using a secure erase or
wipe program on the hard disk is the only way to truly delete all
of its contents.
Prevent Alteration
If you provide paper documents to clients and other parties, it
is very difficult for them to make undetectable alterations.
Electronic documents, on the other hand, are very easy to alter.
The most commonly known methods of protecting them are far from
secure.
All versions of Word contain a password option. A quick search of
the Internet reveals any number of programs that can be used to
attack Word documents with built-in passwords. The most recent
version, Word 2002, is more secure than earlier ones. Using long,
non-obvious passwords can make it more difficult to break into a
protected Word document with hacker tools.
Another common approach to securing a document against alteration
is to create a PDF file using Adobe Acrobat (the full version,
not the free download that reads but does not create files). Many
people who use Adobe Acrobat are unaware that the Touch-Up Text
tool allows anyone to make limited changes to the text of a PDF
file, such as changing the word "not" to "now." Although Acrobat
has a password-protection feature, tools are also available for
attacking PDF files.
Acrobat has a seldom-used security feature that is much more
effective. Acrobat Self-Signed Security uses a private/public key
system that helps you verify that the document actually came from
an author who used the feature.
Lock Up Documents
Documents sent as attachments to e-mail can be intercepted. There
are a number of ways to use encryption to protect documents.
Striking a balance between security and convenience is difficult.
(See the article "Encryption," page 10 of this issue). PGP
Version 8.0 is an excellent encryption program now available as
freeware (www.pgpi.org/products/pgp/versions/freeware/winxp/8.0).
It's also available as a commercial product for $50 in versions
addressing the different needs of individual and organizations
from www.pgp.com. An excellent service that makes it simple to
secure e-mail and attachments is PKI Innovations, www.pk3i.com.
The service costs $99 per year.
Avoid Document Deletion
-Inadvertent deletion. You and your own actions present the
biggest threat to your documents. It is all too easy to delete or
overwrite a document you didn't intend to (no one is perfect).
The Windows Recycle Bin may come to the rescue if you
inadvertently delete a file. Utility suites such as Norton
SystemWorks provide even more protection, with Undelete utilities
and a Protected Recycle Bin. But even these tools provide no
protection against the most serious error, overwriting an
important file with a document you've given the same name.
Backup programs offer excellent protection against human
imperfections. In addition to a nightly backup routine, consider
running a backup utility that operates continuously or
periodically throughout the day, copying new and changed files to
an alternative location such as another computer's local hard
drive. BackUp MyPC for $79 from Stomp, Inc., is highly
recommended, www.stompinc.com.
-Software crashes. Older versions of Windows can be prone to
crash, especially after years of regular use. When Windows goes
down, it can take documents you're drafting with it. Be sure to
activate the AutoRecover option and reduce the time interval to
three minutes. AutoRecover periodically makes or updates a copy
of all documents you have open. To turn it on in Word 2000 or
2002, go to Tools, Options, Save, AutoRecover.
-Disk crashes. Computer hard drives are not designed to run
forever. Some day, the disk drive you're working on will stop
working. You have several methods for guarding against losing
files if your disk drive dies. The first line of defense is a
network backup system, but its files may be more than 12 hours
old. Instead, consider a second line of defense-periodic copies
of work in progress.
Network Unplugged synchronizes files to another drive, on the
same computer, another PC on your network, or across an Internet
connection, about $80 and up, from Mobiliti, www.mobiliti.com.
Worldox document management software constantly creates "shadow"
versions of your recent documents, storing them on a local hard
drive. If your network or server goes down, your recent work is
safe. You can pick up working where you left off and beat your
deadlines.
-Viruses. Unless you use software to purge incoming viruses
hidden in Word document macros, you will be exposed to losing
files and/or unintentionally sending out infected documents. All
major antivirus software products provide protection, but an
especially effective product is MailDefense (www.indefense.com),
which strips out malicious macros and allows you to receive safe
Word attachments. Viruses are now a fact of computer life. Be
sure you install and update good protective software, such as
Norton AntiVirus, and do not open an e-mail attachment,
especially from someone you trust, unless you are expecting
it.
-Hackers. Additional firewall software or hardware is necessary
to protect your documents from hackers. Hardware firewalls
protect most people at the office, but these need occasional
updates from the vendors, just like software. Make sure your
office stays current. Documents you create at home and on the
road need protection, too. Firewall software such as BlackICE
(www.networkice.com) or ZoneAlarm (www.zonelabs.com) can help
with this.
Forewarned is forearmed. The time you invest following these
recommendations will repay you many times over as you work more
securely with your valuable documents.
Taming Wild Docs
Document disorganization can eat up more of your precious time than all other computer threats. Don't waste time hunting for lost documents-organize them. Here are some of the best tools:
Network/Unplugged 4.0. If you work on more than one computer, get this. It automatically transfers documents between computers and, by using sophisticated synchronization techniques, ensures you have the most recent versions of your documents wherever you are. $80 per user, www.mobiliti.com.
Time Matters 4.0. This full-featured law practice software has extensive document management capabilities. It can automatically save documents into client and matter folders, synchronize files between your network and your notebook PC, and search through every word of every document you have. First user, $350; added users, $150, www.timematters.com.
Worldox 2002. Small offices (or large ones, for that matter) don't need expensive server software to manage documents. Law firms that use Worldox to organize, find, and safeguard documents wonder how they ever managed without it. $395 per user, plus $70 per year, www.worldox.com.
Document Protection 101
Take the following precautions. They will give you enough
peace of mind about document protection to get a good night's
sleep-most nights, anyway:
1. Install and use Metadata Assistant to strip out hidden
information.
2. Use only new or securely erased diskettes for documents you
give others.
3. Run a nightly backup program and other periodic backup
software during the day.
4. Use a strong encryption product to lock up sensitive
material.
5. Make sure your computer defenses are up to date and
working.
6. As noted in the sidebar "Taming Wild Docs," page 53, buy a
product that organizes
and finds documents for you.
Enjoy the benefits of membership:
- Award-Winning Periodicals
- Special Member Discounts
- Practice Area Committees
- Continuing Legal Education
- Networking Opportunities
- Leadership Opportunities
