From calculating expenses in spreadsheets to drafting letters or agreements, computers are utilized on a daily basis by almost every business in the world. Computers have exponentially increased the efficiency and means of generating information. With such increased technology, however, comes unintended and potentially damaging risks. One such risk is metadata.
Metadata is information that software embeds in computer-generated documents. If accessed, metadata can reveal information that the document’s author never intended for anyone else to access. Such information can include, for example, the date when the document was created, users who edited the document, the time spent on the document, and most importantly, changes that have been made in the document. Information deleted from an earlier draft of a document (because someone determined that its inclusion would not be in the company’s best interest) could be viewed by a third party accessing the document’s metadata.
Most of the software that businesses use daily generate metadata, including Word, Excel, PowerPoint and WordPerfect. There are several ways to block access to metadata. One simple method is to shut off specific features in the software. In Word, for example, a user can turn off the fast save option. Another method is converting the document into a Portable Document Format (PDF) and then sending it to the recipient. Thereafter, the recipient will only be able to view the document; he or she will not be able to edit the document. Nevertheless, some PDF software (such as Adobe Acrobat ) may contain metadata that be accessed through specialized detection software. Some businesses use “metadata erasing” software such as Metadata Assistant or Workshare Protect to restrict access to metadata. The cost of such software may run from under $100 (for basic software for a single computer) to upwards of $1,000 for more sophisticated “metadata erasing” software for an entire network.
The ethics of the use of metadata remains unresolved. In the legal community, for example, some legal organizations and state bar associations advocate the adoption of rules that would prohibit attorneys from accessing the metadata contained in documents that a lawyer receives. On the other hand, other organizations have adopted regulations or rules that do not contain specific prohibitions on the use of metadata. The implication is that if people are concerned about others accessing metadata from their documents, then they should use “metadata erasing” software before sending the document to the recipient. Another unresolved issue is whether documents to be produced in litigation must include metadata or if a party may remove the metadata prior to sending the document to the opposing party.
We will keep you advised on this issue as new developments occur.
— Andrew Berenson