Why black boxes fail: redaction mistakes

A PDF page is not a picture; it is a list of drawing instructions. "Set this font, place these glyphs at these coordinates, fill this rectangle." When you add a black rectangle with a drawing tool, the viewer appends one more fill instruction after the text instruction. On screen the rectangle wins because it is drawn last. In the file, the text is still there, byte for byte.

This is the single most common failure, and it is the one behind most of the public cases: legal filings where a party's "confidential" figures were readable after select-all and paste, government reports whose blacked-out names appeared in the text layer, and contracts published by companies with prices hidden by shapes that any editor could delete. The lesson is blunt: a tool that lets you undo the box has not removed anything.

The classic test takes five seconds. Open the PDF, press Ctrl+A, Ctrl+C, and paste into a text editor. If words appear that you cannot see on the page, the redaction is cosmetic. Journalists and opposing counsel do this as a matter of routine, and so do automated scrapers that index every document a public body publishes.

A related trick works on documents where a rectangle was drawn in a word processor before export: highlight the black area, change the highlight colour, or simply change the font colour of the "hidden" run to white-on-black. Word processors also store previous versions and tracked changes; a document "redacted" by typing over a paragraph may still contain the old paragraph in its revision history.

A subtler variant: the author pastes a screenshot of the redacted page over the original page, or the PDF was produced from a scan with an OCR text layer that sits invisibly behind the image. The visible page looks like a flat image with black bars. Underneath, the invisible text layer still lists every word, including the ones under the bars. Text extraction reads the layer, not the picture.

PDF also supports optional content groups — layers that a viewer can show or hide. A page exported from a design or CAD program may carry a "redaction" layer that a reader can switch off with one click in the layers panel. Annotations are another hiding place: a redaction drawn as a comment, stamp or highlight annotation lives in a separate object that can be hidden, deleted or simply ignored by a viewer that does not render annotations.

Even a properly flattened page can leak through the rest of the file. The document information dictionary carries a title, author and subject; XMP metadata may include the full path of the source file, the name of the person who last saved it and the software version. Bookmarks copy headings verbatim, and a heading that names the redacted party defeats the redaction on the page.

Attachments and embedded files are worse: a PDF can carry the original spreadsheet inside it. Form fields keep their values in a separate structure from the page appearance. Incremental updates — the way many editors save — append the new version after the old one, so the pre-redaction page objects are still in the file for anyone who reads the earlier cross-reference table. Public cases involving court filings and regulatory releases have turned on exactly this kind of leftover.

In every case the person doing the redaction trusted what they saw on screen. The screen shows the final rendering; it does not show the file's structure, the text layer, the layers panel, the metadata or the previous revisions. Redaction is a property of the file, not of the picture, and it has to be verified against the file: extract the text, list the annotations, read the metadata, and look at what is actually inside.

The dependable method follows from that. Render the page to pixels, paint the box into the pixels, and build a new document that contains only those pixels — no original text objects, no annotations, no old revisions, no metadata. Then open the result and check it the way an adversary would. That is what RedactDrop does, and it is why the tool shows you the verification numbers instead of a green tick.