🔒 Cybersecurity for lawyers

• Be careful about metadata
  • Removing metadata from Word documents
  • Removing metadata from PDFs
  • Removing metadata from images
• PDFs are editable
• If you need to redact a document, do it properly

Metadata are “data about data”.

If you think about a pretty typical document, you might have some text in it, and some images. These are data that you know about - the intended content of a file.

The file may also include some other data, either describing the file itself, or describing activities which have happened on the file. For example, if you have tracked changes enable, metadata within the file displays who has made what changes. You might also find information about when changes were made, for example, how long you worked on a document, or the name of the author.

If you are concerned about making this information available, you might want to explore options for either removing it, or not creating it in the first place.

If you, like many lawyers, work in Microsoft Word, Word offers an option for removing personal data from a document when saving. On Word for Mac version 15, this is a setting under Tools / Protect Document.

As far as I know, you need to set this for each and every document.

Microsoft’s website sets out what the tool clears:.

If you are sufficiently concerned, you might want to validate this yourself. However, another option would be to use a tool other than Microsoft Word, which creates or permits less metadata in the first place. Perhaps a simple text file would do the trick?

As with Word documents, PDFs can contain metadata, and that might include information you don’t want to share — your name, for example.

Wiping all metadata from a PDF is not particularly easy so, as a format, it might be worth avoiding it if this is of particular concern.

Some tools will just update the metadata fields, leaving the original metadata in situ and recoverable.

Images, especially photographs, can be extremely rich in terms of the metadata that they retain.

If you take a photo on the camera on your iPhone, for example, you can view a lot of metadata about the image, including when it was taken, the camera settings, and potentially even the exact GPS coordinates of the image.

There are reasons why you might want this – to plot on a map the pictures you’ve taken on holiday, for example.

Equally, you might not want to have location recorded with every image. You can turn this off in the Location Services settings on your phone - and, while you are there, you may well want to turn off other location-using applications too.

You can remove metadata from images on macOS using ImageOptim (but note that this is not coming from the App Store).

You might be better off not sharing a document at all, but rather sharing an image of it. If you take a screenshot of the page of a document and share that, any metadata residing in the document will not be shared. However, there may still be metadata in the screenshot itself.

Do not send someone a PDF thinking that they cannot edit it.

They can.

(And if it's part of a contract negotiation, sending a PDF is usually passive-aggressive at best and, even if they don't edit it directly, you'll probably just get back a lot of hand-written changes.)

If you need to redact information from a document while still retaining the document (as opposed to just extracting the particular information you need to provide), look for tools which do a proper redaction, rather than just covering the information up.

For PDF, Adobe Acrobat can do a proper redaction, as can PDFpen (for macOS).

If you are unsure if you have done it properly, print the document with the redactions in place, then scan the printed document before shredding it. (Don't shred it before you scan it; that makes life unnecessarily difficult.)