English
← Guides

Journalists and sources: what a document gives away before you publish it

When a document leaves an organisation, what you read on the page is only part of it. Inside there can be the name of whoever wrote it, their company’s, who touched it afterwards and for how long, and in a scanned paper, marks you cannot see with the naked eye. For a source, that can be the difference between anonymity and none.

By

What an Office file or a PDF carries

  • In a Word, Excel or PowerPoint file: the author, who last modified it, the company, the number of revisions, total editing time, the template and the dates. The program itself fills them in with the details of the account using it.
  • In a PDF: the author, the title, the program that created it and the one that converted it, the dates and, often, an XMP block that repeats all of that and sometimes adds the history.
  • In the images it contains: a photo pasted into a document can keep its own metadata, GPS included.

A case: the Iraq dossier

In 2003 the British Government published on its website, as a Word file, a report on Iraq later found to be partly copied from an academic paper. Researcher Richard M. Smith pulled out of the file its revision log, invisible on the page, with the user names of the people who had worked on it; a journalist identified them as Downing Street and Foreign Office staff. Smith published it on 30 June 2003.

Not everything is metadata: scans

Scanning or photographing a paper does not remove the traces: it changes them. Many colour laser printers add to every page tiny, almost invisible yellow dots that encode details of the printer and the print job.

In 2017, The Intercept published a scanned NSA document. Journalists and security experts later pointed out that those dots were visible in the published image. The case against Reality Winner, the analyst who had leaked it, rested on other evidence — who had printed the document, her contact with the outlet and the creases in the paper — and she was arrested two days before the article came out. But the case left a lesson: what gets published from a source can say more about them than it seems.

Before publishing or sending a document

  • See what it carries. Drop the Word, Excel, PowerPoint or PDF file onto KillEXIF: you will see the author, the company, the dates and the rest. The analysis runs in your browser and the document never leaves your computer, which is exactly what matters with a sensitive document.
  • Clean the file, not a screenshot of it. KillEXIF removes the document’s properties without touching its content, and checks afterwards that nothing is left.
  • A redaction is not always a redaction. A black box over some text in a PDF may only hide it from view: the text is still underneath and can be copied. That is not metadata, and no metadata tool fixes it; the text has to be actually removed.
  • If it is a paper, publish it transcribed or reproduced, not the image of the original, and think about what the content itself reveals: who had access to that particular document.