On 28 April 2006, the Electronic Frontier Foundation filed a class-action lawsuit — Hepting v. AT&T — alleging that AT&T had secretly cooperated with the National Security Agency to allow warrantless mass surveillance of its customers' internet and phone traffic. The lawsuit was one of the first legal actions to challenge the NSA's post-9/11 domestic surveillance programme, and it depended heavily on a sworn declaration by former AT&T technician Mark Klein, who had witnessed the installation of a secret room at AT&T's San Francisco facility. AT&T's legal team, deeply concerned about classified information appearing in public court records, submitted a motion to seal certain exhibits. In support of that motion, they filed a PDF brief containing the very text they claimed was too sensitive to be public — protected, they believed, by solid black rectangles drawn over the sensitive passages. Within hours of the filing appearing in the public court docket, a technology journalist removed the black rectangles and read the hidden text. The "redacted" portions of AT&T's own legal brief described in plain language the architecture of the NSA's surveillance equipment, the specific AT&T facilities involved, and the technical methods used to intercept traffic. The cover had lasted less than a day.

What AT&T's lawyers did — and why it failed

The AT&T legal team had prepared their filing in a standard word processor, then converted it to PDF. To redact sensitive passages, they used Adobe Acrobat's annotation tools to draw filled black rectangles over the text they wanted to hide. The result looked correct on screen: black boxes covered the sensitive words and phrases, making them unreadable to the naked eye. The fatal flaw was that these black boxes were PDF annotation objects — a separate layer placed on top of the document's content stream. The original text remained in the file, completely intact, underneath the annotations. Because PDF annotations and page content are distinct objects in the file structure, any reader could simply select the annotation layer, delete the black rectangles, and read the uncovered text. Ars Technica reported on the exposure the same day. The journalist used nothing more than the standard PDF text selection tool: clicking and dragging over the black areas selected the hidden text, which could then be copied to the clipboard. The entire process took seconds. AT&T quickly withdrew the filing and resubmitted a properly redacted version, but by then the text had been copied, quoted, and distributed across technology news sites. The court proceedings took note.

What the exposed text revealed

The accidentally published passages described a highly classified NSA programme with unusual specificity. According to the exposed text — and later confirmed by reporting from Wired's Ryan Singel and others — AT&T had allowed the NSA to install equipment in a secret room (Room 641A) at its Folsom Street facility in San Francisco. The room contained Narus STA 6400 traffic analysis hardware capable of processing internet backbone traffic at 10 Gbps. Mark Klein's declaration, portions of which were meant to be sealed, described how AT&T had installed a beam splitter on its fibre optic lines that copied all traffic — not just communications involving foreign targets — to the NSA's equipment. This was significant legally because it implied the programme captured purely domestic communications, which required a different legal standard than foreign intelligence surveillance. The EFF's case page documents the full history of Hepting v. AT&T. The lawsuit was eventually dismissed in 2011 after Congress passed the FISA Amendments Act of 2008, which retroactively granted immunity to telecommunications companies that had cooperated with the NSA's surveillance programme.

This was not an isolated incident

The AT&T case is the most prominently documented PDF redaction failure involving national security, but it was far from the only one. A pattern of the same mistake — black shapes drawn over text rather than true content removal — has appeared repeatedly across government, legal, and corporate filings. 2005 — The Gonzales memo: A Department of Justice filing in a case involving the confidential source of an Associated Press reporter used the same technique. A black highlight was drawn over the reporter's name, which remained fully copyable. The exposure triggered significant discussion about the legal implications of inadvertent disclosure. 2011 — The Casey Anthony trial: Court documents filed during the high-profile murder trial contained poorly redacted PDF annotations. Technology bloggers discovered that personal identifying information about witnesses was accessible by removing annotation layers. 2019 — The Mueller Report: When the heavily redacted Report on the Investigation into Russian Interference in the 2016 Presidential Election was released, the DOJ used Adobe Acrobat's built-in redaction tool — which does perform true content removal. This was widely noted as a positive example of correct redaction procedure, by contrast with earlier failures. Independent researchers verified the redactions held by attempting text extraction over blacked-out areas. 2022 — Paul Manafort filing: In an earlier chapter, a 2019 filing by Manafort's legal team contained redacted text that was trivially extracted, revealing details about his cooperation with prosecutors regarding the 2016 campaign. The exposure led to significant legal fallout and was discussed at length in BuzzFeed News. The common thread across all these incidents is the same misunderstanding: that making text visually invisible in a PDF makes it informationally inaccessible. It does not.

The technical explanation: annotations versus content streams

Understanding why this happens requires a brief look at how PDFs store content. A PDF page has two distinct layers of objects. The content stream contains the actual page content — text operators, image references, vector drawing instructions — encoded in a compressed binary format. The annotation layer contains annotation objects (comments, highlights, links, form fields, and arbitrary shape annotations) that are associated with a page but stored separately from the content stream. When a lawyer or analyst draws a black rectangle over text using an annotation tool, they are adding a shape annotation — typically a square annotation (/Subtype /Square) with a black fill (/IC [0 0 0]) — to the annotation layer. The annotation renders on top of the content stream in the viewer. But the content stream is completely unmodified. Deleting the annotation reveals the original text exactly as it was. True redaction works differently. A proper redaction tool first applies a /Redact annotation (defined in PDF 1.7 and ISO 32000) that marks the region to be removed. Then, when the document is "applied" or flattened, the tool physically removes the text, image, or vector data from the content stream within that region and replaces it with a filled rectangle in the same operation. After this process, there is no original content to recover — it has been deleted from the binary data of the file, not merely covered. The distinction is invisible to the eye but absolute in its security implications.

How to verify your redactions actually worked

Before distributing any redacted PDF, a simple verification procedure can confirm whether content has been truly removed or merely covered: 1. Text selection test: Open the downloaded file in a fresh PDF viewer. Use the text selection tool (usually the cursor with an I-beam icon) and click and drag across every redacted area. If you can select, highlight, or copy any text over the black region, the redaction failed — the original content is still present. 2. Copy-paste test: Select all text on the page (Ctrl+A / Cmd+A), copy, and paste into a plain text editor. If the pasted text contains content that should be redacted, the redaction did not remove it from the file. 3. Annotation inspection: In Adobe Acrobat, open the Comments panel and check whether any annotation objects are listed over your redacted areas. True redaction leaves no annotation; a covered area leaves a shape annotation. 4. Content extraction tool: Use a command-line tool like pdftotext (Poppler) or Apache PDFBox's ExtractText to extract all text from the file. These tools ignore annotation rendering and work directly on the content stream. If a word appears in the extraction output that should have been redacted, the content stream was not modified. PDFTheGuide's redaction tool permanently removes content from the PDF structure — not a visual overlay. Run the copy-paste test on your downloaded file to confirm.
The AT&T/NSA PDF redaction failure of 2006 is now almost twenty years old, yet the same mistake continues to appear in court filings, government documents, and corporate disclosures every year. The technique — drawing a black shape over sensitive text — is intuitive but completely ineffective. The false sense of security it provides may be more dangerous than no redaction at all, because it encourages the publication of documents that appear protected but are not. The fix is not complex. Modern PDF tools including Adobe Acrobat Pro, PDFTheGuide, and several open-source libraries implement true redaction that removes content from the file structure. The critical habit to build is verification: always attempt to select text over every redacted area in the final file before distributing it. If you can select anything, the redaction did not work. For anyone handling legally sensitive, classified, or personally identifying information in PDFs, this single check takes thirty seconds and can prevent consequences that take years to resolve.