untangling_the_web

DOCID: 4046925
UNCLASSIFIEDfiF6R 6FFl61J8cL l:JSE et.LY
Convert with Caution
As part of its initiative to enhance software security and share this information with
users, the National Security Agency's Information Assurance Directorate published a
new guide in December 2005: "Redacting with Confidence: How to Safely Publish
Sanitized Reports Converted from Word to PDF." This is a very important issue
because failure to redact documents properly-whether they are declassified
government documents, court records, proprietary company documents-can lead
not just to embarrassment but also to very serious security violations and potential
risks to individuals. I call your attention to the very sad case in May 2005 in which an
improperly prepared PDF document about the killing of the Italian intelligence agent
Nicola Galipari in Iraq was quickly discovered and exploited by the press worldwide.
Not only was classified information leaked to the world, but the lives of those whose
identities were revealed were also put in jeopardy by the improper method of
removing data from a MS Word file and converting it to PDF. This is an important
guide and I urge you to keep a copy for yourself and your organization.
"Redacting with Confidence: How to Safely Publish Sanitized Reports Converted
from Word to PDF"
Architectures and Applications Division of the Systems and Network Attack Genter
(SNAG)
Information Assurance Directorate, National Security Agency
last updated 2 February 2006
http://www.nsa.gov/snac/index.cfm?MenuID=scg10.3.1
For details on the Calipari incident and the ensuing disclosure of classified
information, I recommend an article from the Times Online (UK).230
230 Simon Freeman, "Italy Releases Report into Death of Security Agent," Times Online, 2 May 2005,
(14 November 2006).
UNCLASSIFIEDf,'F6R 6FFl61AL l:J6E 9~JbY 603