Someone asks you to send a contract with the salary taken out. You open the PDF, grab the rectangle tool, drop a black box over the number, save, send. It looks right. The number is gone.
It isn't. It's underneath.
What the file actually contains
A PDF is not a picture of a page. It's a list of instructions: draw this glyph at this coordinate in this font, then this one, then this one. The text you see is a real string sitting in the file's content stream, with the positions that let a reader lay it back out.
When you draw a rectangle, you add one more instruction to that list. Paint a filled shape at these coordinates. That instruction runs after the text, so the shape lands on top and your eye stops there.
The text instruction is still in the file. Untouched. Select the area and copy, and your clipboard gets the words, because selection reads the content stream, not the pixels. Run any extraction library over it and the same thing comes out. So does search. So does a screen reader.
This is not a bug in whatever tool you used. Drawing a box is a drawing operation, and it did exactly what a drawing operation does.
It has gone wrong at scale
In 2005 the US Army published its report on the shooting of Nicola Calipari in Iraq as a PDF with sections blacked out. Copy the page into a word processor and the blacked-out sections came back, including names and troop movements. The Pentagon pulled the file; by then it was mirrored everywhere.
In 2009 the TSA posted its screening procedures manual with the sensitive sections covered the same way. Researchers had the full text out within hours.
In 2019 Paul Manafort's lawyers filed a court document with black bars over several passages. Reporters copy-pasted them and found, among other things, that he had shared campaign polling data with Konstantin Kilimnik.
Three organisations with lawyers, review processes, and a strong interest in getting it right. The failure mode does not care how careful you are, because it doesn't look like a failure until someone else finds it.
Real redaction removes the content
For the text to be gone, the instruction that draws it has to be deleted from the content stream and the file rewritten without it. Proper redaction tools do this. They mark a region, work out which glyphs fall inside it, strip those from the stream, then paint the black box as a visual marker of what was taken out.
Two different operations that produce the same screenshot. Only one of them changes what the file contains.
The same applies to everything else riding along in the document. Metadata with the author's name and the original filename. Previous versions kept in an incremental-save history. Comments and annotations. Attached files. A cropped image that still holds the full picture outside the crop box. Any of these can carry the thing you meant to remove.
Checking a file you already sent
You don't need a specialist tool for the basic test.
Open the PDF in any reader. Select across the area you redacted, copy, paste into a plain text editor. If your text appears, the file is not redacted. Then press Ctrl+F and search for a word you removed. A hit inside a black box means the same thing.
That catches the common case in about ten seconds. It won't catch metadata, annotations, or content hiding outside the visible page area, so for anything sensitive, treat the copy-paste test as the floor rather than the ceiling.
The rest of it
The full guide covers how to fix it at source: which tool operation actually
removes content, what else in the file carries the thing you deleted, and why
you have to verify the exported bytes rather than the document you were
editing.
Top comments (0)