Build vs Buy: Should You Write Your Own PDF Tamper Detection?

Deciding whether to write your own PDF tamper detection system or purchase an existing solution depends on the specific requirements and circumstances of your project. The decision-making process is complex and requires careful consideration of various factors.

Firstly, it is essential to define the scope of your PDF tamper detection project. There are three distinct levels of complexity: a narrow check on a single document type from one issuer, a general edit signal applied to any PDF from anyone, or a verdict that can be safely automated within your workflow. The level of complexity directly impacts the time and resources required to develop an in-house solution.

The prototype for building a PDF tamper detection system has already been created by someone on your team. It successfully identified tampered PDFs in five out of five sample files. However, the challenge lies in recognizing that the prototype represents only a fraction of the overall project. The initial development phase is relatively straightforward, while the subsequent maintenance and refinement of the code can become significantly more time-consuming and costly.

When building your own PDF tamper detection system is the optimal choice, there are specific scenarios where an in-house solution outperforms a purchased alternative. The first scenario is when you require a narrow and specific check on a single document type from a single issuer. In this case, utilizing mature libraries available in various programming languages can provide a robust and accurate solution without the need for further development.

Furthermore, if you have control over the document's origin, meaning you generated the PDF yourself, storing a hash at the time of generation and comparing it later is a more reliable approach than relying on forensic inference. This method offers stronger evidence and incurs almost no additional cost compared to building the system in-house.

However, there are certain circumstances where purchasing a pre-built PDF tamper detection solution may be the more practical option. If you handle a limited number of documents per month, typically reviewed by someone who is knowledgeable about detecting tampering, outsourcing the solution can be cost-effective and efficient. Additionally, if your organization operates within an environment that prohibits sending documents to third-party vendors, building the solution internally becomes a necessary requirement.

For organizations primarily engaged in document forensics research or have their differentiation based on the quality of document review, developing an in-house solution aligns with their core competency. In such cases, the expertise, corpus, and tuning processes become valuable assets that justify the investment in building and maintaining the system over the long term.

The decision to build or buy also depends on the volume of documents processed. If the volume is substantial, the cost of building and maintaining the system may become more favorable compared to the expense of purchasing a solution. At this scale, per-check pricing typically scales with the volume, making in-house maintenance a more cost-effective choice once the necessary corpus has been established.

It is crucial to consider the hidden costs associated with building a PDF tamper detection system. While the initial prototype may seem straightforward, real-world PDFs often deviate from the specified format, leading to parser errors that can reject legitimate documents. This ongoing maintenance work is substantial but often overlooked in estimates.

Moreover, false-positive tuning is a significant challenge, as distinguishing between genuine evidence of modification and legitimate document behaviors requires extensive effort to accurately differentiate and avoid flagging innocent documents.

From a strategic perspective, building an in-house solution may be advantageous if document forensics is a core competency of your organization. Developing and maintaining the system allows you to fully control the process, explain the reasoning behind decisions, and provide justifications that can withstand scrutiny from regulators, ombudsmen, or courts. Relying on a vendor's proprietary algorithm, while potentially more cost-effective, may lack transparency and present challenges in defending the decision-making process.

Lastly, if the volume of documents processed is high enough, the arithmetic supporting building an in-house solution becomes clear. The maintenance costs become relatively fixed, while the purchasing option's per-check pricing increases with volume. This cost curve serves as the primary driver in making the decision to build rather than buy.

In summary, the decision to write your own PDF tamper detection system or purchase an existing solution depends on the specific requirements, complexity, and volume of your project. Building an in-house solution is justified when you have a narrow, specific use case, control over document origin, document forensics as a core competency, or when processing a high volume of documents.

However, purchasing a solution may be more appropriate for organizations handling a limited number of documents, lacking the expertise to develop an in-house system, or operating within environments that restrict third-party involvement. Carefully evaluating these factors will guide you towards the most suitable approach for your unique circumstances.