The Blog Formerly Known As Practical Paralegalism
By Beverly Michaelis, J.D.
Metadata is data about the data, or as forensic expert Craig Ball once called it, “the electronic equivalent of DNA.” It describes attributes and characteristics of the information contained in electronic files. It can be relatively benign: file name, date stamp, time stamp, size, or type of file created. Or it can reveal potentially compromising details, such as revisions, embedded comments, and where the file is stored on your computer.
What Does it Look Like?
In this example, I altered the properties image to redact the file location. Normally, the document name and file path would be visible. This view illustrates what can be seen under the “General” properties tab in a Microsoft Word document. More metadata waits under the “Custom” and “Summary” tabs.
While all electronic files contain metadata, word processing documents represent the greatest area of concern for most law offices. It’s easy to see how a Microsoft Word or Corel WordPerfect file might contain sensitive, confidential, or even privileged metadata. And what can’t be seen under properties is easily revealed using a metadata viewer.
What is the Sender’s Duty When Transmitting Metadata?
All 12 jurisdictions require attorneys to use reasonable care to “avoid providing electronic documents that inadvertently contain accessible information that is either confidential or privileged, and to employ reasonable means to remove such metadata before sending the document.” The American Bar Association takes the same position.
May the Recipient Review Metadata?
Alabama, Arizona, Florida, Maine, New Hampshire, New York, Washington D.C., and West Virginia restrict or prohibit the use of metadata by the recipient. Pennsylvania approaches the issue on a case-by-case basis. Colorado, Maryland, and Vermont permit data mining or review.
Must the Recipient Notify the Sender if Metadata is Found?
Arizona, Colorado, Florida, New Hampshire, New York, Pennsylvania, Vermont, Washington D.C., and West Virginia require notification (under varying circumstances). Maryland does not. Alabama and Maine have not addressed the issue.
What Should I Do?
- Know the rules that apply to you. If your firm practices in a jurisdiction that has issued a metadata opinion, follow the requirements of your jurisdiction. A detailed chart is available from the American Bar Association Legal Technology Resource Center.
- Encourage your firm to establish a metadata scrubbing policy. Even if not required, best practices dictate that metadata be removed from documents prior to transmission. This is the best way to protect sensitive, confidential, or privileged information.
- Master document revisioning tools. Nothing is more embarrassing than e-mailing a document you believe to be in “final” form only to find out from the recipient that redlining or track changes are still on and all your edits or comments are visible. Read more here about how to tackle this in Word.
- Learn how metadata is handled by your word processing application. To save a document without metadata in WordPerfect X4, choose File, Save without metadata. When the “Save Without Metadata” dialog box appears, select the metadata to remove. In Word 2007, click on the Office Button, select Prepare, then Inspect Document. Always make a copy of your document first, as using Word’s document inspector can produce unintended results (like deleting all your headers and footers). If you are a Word 2003 user, download the free “Remove Hidden Data” add-in from Microsoft’s Web site.
- Do not rely exclusively on your word processing application as a cure-all. Neither WordPerfect nor Word scrubs all metadata away. Try this test: publish or save a “metadata-free” document to PDF, then open it in Acrobat Standard or Professional, version 8 or higher. Select Document, Examine Document…Oops! Acrobat just found more metadata. If you are tempted to click “Remove all checked items” in Acrobat, stop! Click the “Learn more” button first, or you may be in for more unintended results.
- Consider commercially available metadata scrubbers, such as Javacool’s Doc Scrubber or Payne Consulting’s Metadata Assistant (my personal favorite).
- If all else fails, remember you can always print, then scan your document. The scanned version can be safely transmitted without metadata. This may not be the most sustainable solution, but it works well if you don’t have access to other tools.
Beverly Michaelis is a lawyer and practice management advisor with the Oregon State Bar Professional Liability Fund. You may follow her on Twitter at http://twitter.com/OreLawPracMgmt. Her blog is http://oregonlawpracticemanagement.wordpress.com/