TSA redaction fail: hidden text easily readable via copy & paste

This isn't the first time this has happened. Several years back, another government agency made the same mistake. On a slow computer, the text would render first, and could be seen for several seconds before the black boxes would appear.

Googling around, it seems to be a fairly common mistake, going back to at least 2000.

http://www.securityfocus.com/news/7272

http://cryptome.org/iran-cia/cia-iran-pdf.htm

http://blogs.zdnet.com/BTL/?p=12907

It's helpful to understand a little bit of how a PDF file works.

A PDF file stores a sequence of instructions for what do draw on a page. The instructions are commands, such as "write this text here" or "draw a circle there." When you draw black redaction boxes, you are just appending an instruction to the end of the list ("draw a box here"), but most of the time the previous instructions are all still there.

Really, the only way to redact a PDF with certainty, short of manually reading the file itself (yes, PDF files are text-readable; you just have to decompress them) is to rasterize the file to a large image. Otherwise, the instructions for writing the text are all still in the file, and there are any number of ways to extract them (for example, simply by deleting the instruction to draw the redaction box).

On Scribd: http://www.scribd.com/doc/23757640/Screening-Management-SOP-...

Pretty ridiculous. Why not just make one version for internal distribution, and a completely separate document for the public?