What You Don't See Can Hurt You
By Donna Payne
WHILE concerns about "metadata" have been around for years, a recent front page article in The Wall Street Journal (Oct. 20, 2000) refocused the legal community's attention on client confidentiality when sending documents electronically.
First, let's define our terms. Metadata is "data on data." What this means is that every time you open, edit or save a document, extra data is stored within the document. This "metadata" is used to enhance a document in a variety of ways -- including storing file information on who created or edited the document; when and where it was saved; and much more. Even though metadata was designed to enhance your document, it can also inadvertently share confidential information with others.
Metadata can exist in many software applications, but a major concern is what information can be inadvertantly left behind in Word documents. This is particularly of concern to lawyers, who use Word to prepare sensitive court filings; agreements; merger and acquisition documents; among other critical papers.
It's possible to send a document to a client without realizing how much information is left behind. On one occasion, our company was sent an agreement where tracking changes and comments had been enabled, but the option to display changes on screen was turned off. By choosing "Tools," "Track Changes," "Highlight Changes on Screen," we were able to discover that the agreement had actually been originally drafted for another party -- and then, our company and product information was substituted. That may be "knowledge management" at work! But without proper safeguards, it's also "call the malpractice carrier" time.
Another feature to watch out for is comments. When collaborating with others on documents, it's useful to insert comments discussing issues or points to consider. But if the document is sent to a client with these comments still embedded, you could either spill your secret negotiating skills, or have a potentially embarrassing comment be uncovered.
Other features that can contain information that you might not want to share include:
- Deleted text (when "Fast Saves" is enabled under "Tools," "Options," "Save," it's possible to reveal some text that has been deleted).
- Hyperlink and embedded graphic properties.
- The template name that the document was based on.
- Earlier versions of the document, if the "Versions" feature has been turned on.
Other metadata is not as easily visible. For example, information on your computer is also stored with your documents. Remember the first time you accessed Word, and you were asked to type in your name, initials and company name? This information is called "File Properties," and is recorded with the document each time you save it.
Further, when you create a document and save it the first time, Word will extract the first few words, line or sentence of the document and store it as metadata. Even if you change this first line immediately after the document has been created, the original information will still exist. Metadata also keeps a list the names of authors of the document, the full document path where the file is stored and other information.
You create a document called Widget and Gidget Settlement Agreement, and in this agreement you specify details about a pending case for the client. A few weeks later someone in the firm searches through the Document Management System for a settlement agreement, and finds your file. They access the file and immediate save the file under a different name, let's say Fred and Sally Settlement Agreement. When they send the file to Fred and Sally, they discover the buried reference to Widget and Gidget. Not good!
It's really quite easy to uncover metadata and stored information and this is the problem: anyone can do it. Using Word again as an example, choose "File," "Open" and change the files of type to "Recover Text from Any File." When the document opens, it lists the text (without format), previous authors of the document, and other information that might be invisible to the eye.
Does this mean we shouldn't send electronic documents?
One of the driving factors of choosing one software package over another is the ease in which we can share documents. Therefore, there is really no alternative to doing this unless you want to create a .pdf version of every document that you send outside of the firm. But how realistic would that be?
But through educating users on potential areas of exposure, implementing policies regarding documents distributed outside your firm, and third-party utilities, you can substantially minimize your exposure to this risk.
Donna Payne is a principal of Payne Consulting Group, based in Seattle. Her company offers a free download to help lawyers with metadata problems, called The Metadata Assistant.