Are Your Documents Spilling Your Secrets?

Who knew that something as seemingly harmless as a Microsoft Word document could embarrass you, divulge information you’d rather keep to yourself or even open you up to liability? Meet metadata, literally “data about data.” It’s the information embedded as part of a document file that travels with the document if it’s electronically copied, e-mailed or posted on a website. (Another type of metadata is stored inside your computer’s binary system, but we’ll focus on the document file metadata here.)

Metadata can cause mischief in several ways. Imagine sending a finished document to a client and allowing them to view comments or hidden text, previous revisions of the document, a list of the last 10 authors to have worked on it or the dates and length of time the document was edited.

One New York area public relations firm was internally collaborating on a press release and incorporated derogatory comments about the client in the document. The comments were exposed when the metadata was revealed, and the firm ultimately lost the account. Another local company had its attorney draft contract language and received a legal bill that was higher than expected. Upon examining the metadata in the contract, the company saw that much less time had been spent editing the document than it was being billed for and that the draft had actually originated from a different law firm. Armed with this information, the company was able to negotiate a substantially reduced fee.

Metadata has been around since the first word processing programs and is a valuable internal tool for functions such as editing, viewing and document retrieval. It didn’t matter in the days when you printed out documents and faxed or mailed them. You can’t see metadata in a printed document. But e-mailing a document is different.

All documents created or edited using a Microsoft Office application (Word, Excel, PowerPoint) contain metadata. If you think you can avoid the issue by using WordPerfect or PDFs, guess again. There’s plenty of metadata there, too. But it’s easy to get at metadata in MS Office documents, and since these programs appear on virtually every desktop, everyone is at risk. In the box at right are two ways to easily access metadata in an Office document.

What can you do about metadata? You can search Microsoft’s website and read pages of cumbersome instructions on manual metadata removal. However, the best way to easily and consistently eliminate it is via software automation. Some of the leading software programs are Payne Group’s Metadata Assistant, Esquire Innovation’s iScrub and SoftWise’s Out-of-Sight. Most enable you to identify and analyze meta-data components within your documents, generate detailed reports of that metadata and then “clean” documents before sending them. These programs quickly provide a level of security that’s not achievable through any kind of manual process.

Regardless of the method selected, your company should protect against unintentional metadata distribution. It’s also important to understand how service providers (e.g., attorneys, accountants) deal with metadata. Remember, they’re working with your confidential information. Unless you make a point of getting rid of meta-data, it can tell the world more than you want to reveal.