Why a black box isn't enough: how redacted documents still leak

Every so often, a document released with heavy black boxes turns out to be readable. Someone selects the text, pastes it into another program, and the hidden names appear. The box was there; the redaction was not.

The box sits on top of the text

In a PDF, a drawn rectangle, a black highlight or a comment shape is added on top of the page. The words underneath stay in the file. They can be selected and copied, found with the search function, read aloud by a screen reader or pulled out by a script. Moving or deleting the box is often enough to reveal them.

Dedicated redaction tools remove the content itself instead of covering it; Adobe Acrobat, for example, offers a manual redaction tool for this. Drawing and comment tools do not. Our guide on how to redact a PDF so the text can't be recovered covers the method.

Six other ways a redacted file gives itself away

1. Scans with a hidden text layer. Many scanners and PDF tools add invisible, searchable text over the picture of each page. Blacking out the picture leaves that text in place, and removing the text leaves the picture.
2. Hidden copies inside the file. A name can also sit in the document properties, comments, bookmarks, form fields, attachments, scripts, or the small page thumbnails some viewers display. None of these show on the page itself.
3. Earlier versions. Some PDF editors save changes by adding them to the end of the file, so an earlier version of the page can remain inside it.
4. The file name. "Assessment_Alex_Martin.pdf" undoes careful work on every page.
5. Blur and pixelation. These can sometimes be partly reversed, especially on short text such as numbers. Solid boxes are safer.
6. Missed repeats. A name hidden on page 1 often appears again in a header, a footer, a signature block or a table on page 9.

What a box cannot hide

Even a careful redaction leaves two things behind:

• The size of the box. Its width can hint at the length of the hidden word, which narrows down a short name or a number in a known format.
• The context. A job title, a small town, a date or an unusual event can be enough to recognise someone, even with every name removed.

That is why redaction is a judgement, not only a tool. Read the cleaned document as the recipient would, and ask whether they could still tell who it is about.

How to check a file before you send it

1. Open the exported file, not the original.
2. Try to select and copy text where each box is. Nothing should come out.
3. Search the file for the names and numbers you removed.
4. Look at the document properties, and at the bookmarks, comments and attachments panels.
5. Read the file name.
6. Page through the whole document at a normal zoom level.

What Anonyma does with the copy

Anonyma removes the hidden text from the file instead of covering it. It also removes the hidden copies (document properties, comments, attachments, bookmarks, form fields, scripts and thumbnails), writes the copy as a new file, rebuilds scanned pages as images and reads the copy again after export, and cleans the file name. Your original is left as it was.

It cannot change the size of a box or the context around it, and automatic detection can miss things. You review every page, and you remain responsible for what you share.