How Data Masking and Redaction Hide Parts of a Document, and Where They Fail
You have seen the screenshots: a card number with only the last four digits showing, or a contract with black bars over the salary. Both are ways of showing part of a document while hiding part of it. The two techniques behind those pictures are masking and redaction, and they are not the same thing. Mixing them up is how hidden data ends up in files that were supposed to be clean. A simple…
Masking and redaction are two techniques used to conceal parts of a document, but they serve different purposes and operate in distinct ways. Masking replaces sensitive information with altered yet visually similar values, while redaction removes the actual data from the document itself. Mixing up these techniques can lead to the accidental inclusion of hidden data in otherwise secure files.
To illustrate the difference, consider a photograph of a street scene. Masking could involve blurring a face so that the person's presence is still evident, but their identity remains concealed. In contrast, redaction would involve physically cutting out the face and taping over the hole, resulting in the face being entirely absent from the image.
Masking works by substituting real values with altered ones that retain a similar appearance. For example, a credit card number might be transformed into a string ending in "4242," a name might be replaced with a different name from a predefined list, or a date could be shifted by a few days. The goal of masking is often to maintain utility, such as allowing a support team to view that a payment was made without exposing the full card number.
Redaction, on the other hand, aims to permanently remove the sensitive information from the document. In a document workflow, true redaction should eliminate the underlying characters rather than merely drawing a black box over them. This distinction is crucial, as drawing a box alters what a reader sees, while removing the characters changes what the file actually contains.
A well-known failure occurs when someone copies text from a document that has been redacted with black bars, inadvertently including the hidden information in the copied content.
Tools used for masking and redaction employ various methods to identify what needs to be concealed. Pattern matching looks for recognizable patterns, such as 16-digit numbers or national identifiers. Dictionaries and name lists are also used, while trained models attempt to determine the likelihood of a string representing personal data. However, these approaches have limitations, as they may miss unusual number formats or fail to recognize sensitive information specific to certain regions.
Deciding how to handle the hidden values is another critical aspect. Some systems mask values only when displayed, leaving the original data intact in the stored file. Others create a new file without the sensitive information. In my opinion, the latter approach is preferable for sharing documents outside the company, as it ensures that the hidden data never travels with the file.
A real-world example is a hospital sharing patient records with a research group. The researchers mask patient names and shift admission dates to protect privacy while still allowing the study of patterns. Later, a report is shared with a partner, featuring black bars over an identifier field. The bars were added using a highlighting tool, so the original text still exists within the file.
Despite these efforts, masking and redaction are not foolproof. A common misconception is that masking makes data truly anonymous. In reality, masking reduces risk but does not eliminate it. Certain details, such as a rare job title combined with a small town and a rough age, can still pinpoint an individual. Additionally, redaction is not considered complete simply because a page appears correct. A thorough check should be performed on the actual file, not just the visual representation.
One potential pitfall is the presence of layers within modern documents. These documents are containers that can hold multiple components, including hidden text, tracked changes, comments, and older versions. Redacting the visible page may inadvertently leave these hidden elements untouched. Scanned images pose another challenge, as they consist of pixels rather than text, requiring special attention when redacting.
Lastly, it is essential to remember that masking and redaction pertain to a single version of a document, not all existing versions. Keeping track of document revisions is crucial to ensure that sensitive information remains concealed throughout the document's lifecycle.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
