Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The FBI currently prints and redacts documents using analog mechanisms. I'm curious to know if anyone has ever researched the accuracy of inferring the possible words or names. Certainly, given the static width of the characters in the variable width font-set, the limited space available, and the likelihood of character sequences, this should be doable.

Here is a snippet from the document taken from page 61.

Redacted FBI document

Snippet reads,

(U//LES) An identified `<REDACTED>` as of October planned to engage in sniper attacks
against protestors in Houston, Texas, if deemed necessary. An identified `<REDACTED>` had
received intelligence that indicated the protesters in New York and Seattle planned similar protests in
Houston, Dallas, San Antonio, and Austin, Texas. `<REDACTED>` planned to gather intelligence against
the leaders of the protest groups and obtain photographs, then formulate a plan to kill the leadership via
suppressed sniper rifles. (Note: protests continued throughout the weekend with approximately 6000
persons in NYC. "Occupy Wall Street" protests have spread to about half of all states in the US, over a
dozen European and Asian cities, including protests in Cleveland 10/6-8/11 at Willard Park which was
initially attended by hundreds of protestors).

That one little snippet covers the latin characters,

"(),-./0168:<>ACDEHLNOPRSTUWYabcdefghiklmnoprstuvwxyze

I'm sure the others can be be grabbed from the document too.

I took the last few lines (that have no redaction) and overlaid them with a copy of the same text in Times New Roman. I'm convinced that the font is Times New Roman, but that the scan is bad or that something was done to obscure the alignment.

Picture of overlay of Times New Roman

This whole vulnerability is predicated on variable width graphemes. Where many words can be disqualified for the lack of coherency and others for their constituent character size. With variable-width fonts each grapheme has it's own size signature and while there are certainly collisions I think they may do a lot to fill in the blanks. Here are two seven letter words for example -- we can see one of them is substantially bigger:

Two seven letter words

Looking however at the advance for Times New Roman, I'm not sure how useful this would be.

"512"  : "."
"569"  : "ijlt"
"682"  : "-frI"
"797"  : "sJ"
"909"  : "acez"
"1024" : "bdghknopquvxy0123456789"
"1139" : "FPS"
"1251" : "ELTZ"
"1366" : "BCR"
"1479" : "wADGHKNOQUVXY"
"1593" : "m"
"1821" : "M"
"1933" : "W"

We can see here in the [A-Za-z0-9.-] character class there is 13 different possible lengths.

share|improve this question
2  
You'll have to take kerning into account. You'll also have to measure the points inserted to pad the line to constant width. –  John Deters Apr 7 at 0:11

1 Answer 1

There are simply too many possible combinations for any reasonably-sized redaction for this to be useful. You can certainly use spacing analysis to reject possible values, but it's not a practical way to generate candidate values (an advance of 4096, for example, could be any of 60 words; 299 words if you permit 10% misalignment).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.