A black rectangle is not redaction

Every few months a document is published with black boxes over the parts somebody wanted covered, and within a day the covered words are being quoted back at whoever published it. Nobody broke anything to do that. They opened the file, pressed Ctrl+A, pressed Ctrl+C, and pasted.

This is the most expensive misunderstanding in document handling, and it survives because the thing that goes wrong is invisible at exactly the moment you would want to catch it. The page looks redacted. In one sense it is redacted: a person reading it cannot see the covered words. The file is not.

What the box actually is

A black rectangle over text in a PDF is one of two things, and neither of them is a deletion.

It may be a filled path in the page's content stream — a rectangle, a fill colour, a fill instruction — emitted after the text-drawing operators, so it paints over them. The text operators are still there, earlier in the same stream, untouched. Painting order decides what you see. It says nothing about what the file holds.

Or it may be an annotation: an object in the page's annotation list, carrying its own appearance stream, floating above the page content rather than being part of it. That is what a highlighter, a square tool or a stamp usually produces. An annotation is weaker still, because a reader can select it and press Delete, and the words are there again.

Either way the glyphs are exactly where they were. Every text extractor in the world — a reader's own copy function, a command-line utility, a search indexer, an accessibility tool, the preview generator in a file manager — walks the text operators and never asks what got painted on top of them afterwards.

The patterns this produces

The failures are not random. They cluster into a handful of shapes, and the shapes are more useful to know than any particular incident.

• Boxes over live text in a released document. Court filings, regulatory disclosures, published contracts, responses to information requests. The covered material is usually a name, a price, or the reasoning somebody did not want quoted. It recurs because the person doing the covering is a lawyer or an official with a drawing tool, and has no reason to know what a content stream is.
• The crop used as a hiding place. Cropping changes the crop box, which is the region a reader displays. Content outside it stays in the file and comes back the moment the box is widened. A page cropped to lose a letterhead, a margin note or half a table still carries all of it.
• Metadata nobody read. The document information dictionary and the XMP packet carry an author name, the producing application, often the original file path with a username in it, sometimes a title inherited from a template that names a different client. None of that appears on a page, so nobody proofreads it.
• Earlier versions inside the same file. PDF supports incremental saving, where a change appends new objects and a new cross-reference section instead of rewriting the file. That is exactly what keeps an existing signature valid over the bytes it signed. It also means a superseded object can still be sitting in the file, and a document edited that way can be walked back a revision.
• Attachments and embedded files. A PDF can carry other files inside it: the spreadsheet the figures came from, the source document with its revision history intact. They travel with it and are visible in nothing but an attachments panel.
• The image that was never resampled. A photograph placed on the page at postage-stamp size is still stored at whatever resolution it arrived with. Scaling on the page is a matrix applied at draw time, not a resize.

Work of this kind has also been done on tools that do advertise a redaction feature, and the supposedly removed text came back out of a good many of them. A feature existing is not the same as the feature working, which is the uncomfortable half of this subject.

What actually removes text

Removal means the glyphs stop existing in the file. On a page with real text that means editing the content stream: taking out the text-showing operators for the material that has to go, or rewriting the run so the remaining glyphs are the only ones drawn. Then the document has to be written out whole rather than appended to, so no earlier revision carries the original objects.

A scan has no glyphs, because the page is a picture. Removal there means altering pixels — painting on the image and re-encoding it — and then confirming the original image object is not still in the file under another name. If the scan has been through recognition, the invisible text layer underneath it has to be cut as well, or the words come straight back out of the layer that was added to make them findable.

The same string also tends to appear in more places than the one you covered. Bookmarks. Form field values, which live in the form dictionary and not on the page. Annotation contents. The document title. A different page you had stopped thinking about. A file that is genuinely sanitised has been checked in all of them.

There is no redaction tool in Creasepoint

That is written on the limitations page and it belongs here too. The annotation tools draw on the page and remove nothing, and they are described that way in the product, because describing them any other way would be this article's mistake in miniature. The output check that runs on a save rebuilds the document and confirms the result holds a single revision. That is not sanitising: cropped-away content, metadata and attachments all survive it.

A password is not a substitute either. It decides who may open the file, and whoever opens it has all of it, including whatever is underneath the boxes. Protecting a PDF and removing something from a PDF are different jobs, and the first gets reached for when the second was what the situation needed.

The check takes two minutes

Whatever tool did the work, and however confident it sounded about it, do this to the output before the file leaves your hands.

1. Open the finished file. Select all, copy, paste into a plain text editor. Search that text for the words you removed. If they are in there, you have published them.
2. Reset or widen the crop, if the file was cropped, and look at what appears.
3. Open the document properties and read every field, including the ones that are usually empty.
4. Open the attachments panel and confirm it is empty, or that what is in it is meant to be.
5. Weigh the file against what a document of that kind should weigh. One far larger than its visible content is carrying something you have not looked at.

The first step alone catches the black-rectangle failure, in any reader, on any file. It is worth running on documents that arrive as well as documents you are about to send, because the same paste that recovers your own mistake recovers somebody else's, and finding it before you forward the file on is the cheaper end of that discovery.