Metadata leaks that made headlines

In February 2003 the British government published “Iraq – Its Infrastructure of Concealment, Deception and Intimidation” on the Downing Street website as a Microsoft Word file. The old binary .doc format kept a revision log — the last ten people who saved the document, with their user names and the paths they saved to. Security researcher Richard M. Smith extracted the log and published it: the entries named four people who turned out to be Downing Street and Foreign Office press staff, and one path pointed to the Communications Information Centre.

The metadata mattered because of what Cambridge lecturer Glen Rangwala had found in the text: long passages copied, typos included, from a 2002 article by graduate student Ibrahim al-Marashi. Together the two findings showed that a paper presented as an intelligence assessment had been assembled by communications staff from published sources, and the document has been known as the “dodgy dossier” ever since. The lesson outlived the .doc format: DOCX files still record the last editor, the revision count and the reviewer of every tracked change.

In March 2004 the SCO Group, then suing companies over Linux, filed a complaint against DaimlerChrysler. A Word version of the complaint that circulated among reporters still contained tracked changes, and journalists who switched the markup on found that an earlier draft had named Bank of America as the defendant, with the edits dated shortly before filing. The company had changed its target; the document remembered the first one.

Nothing exotic was needed to see it — only the Review tab. Tracked changes are content, not metadata, but they behave like metadata in one respect: they are invisible in the default view and travel with the file. Accepting all changes and then cleaning the reviewer fields would have removed both the draft and the names attached to it.

In December 2012 John McAfee, founder of the antivirus company, was avoiding questioning by police in Belize and travelling with two Vice journalists. Vice published an article titled “We Are with John McAfee Right Now, Suckers” with a photo taken on a smartphone. The JPEG still carried its EXIF block, and the GPS fields placed the photo in Guatemala. McAfee was detained there within days for entering the country illegally. The magazine's own file had answered the question its headline was taunting the world with.

Earlier the same year, Higinio Ochoa, a hacker using the handle “w0rmer”, posted a photo of his girlfriend holding a sign that mocked law enforcement after a break-in at police servers. The picture had been taken on an iPhone; its EXIF GPS coordinates pointed to a house in suburban Melbourne, Australia, and the FBI used the location together with social media to identify her and then him. Ochoa pleaded guilty in 2012 and was sentenced to prison. Both cases involved a phone camera's default behaviour, not a bug: location tagging was simply on.

In 2003 television presenter Cat Schwartz posted cropped portraits of herself on her blog. The crop had been made in Photoshop, but the EXIF block of each JPEG still contained the thumbnail generated from the original frame — and the thumbnails showed the uncropped, topless photographs. Readers found them within days. The application had updated the pixels and left the preview untouched, a behaviour later fixed but still worth checking for in any editor.

In 2005 the United States military released its report on the death of Italian intelligence officer Nicola Calipari, shot at a checkpoint near Baghdad while escorting journalist Giuliana Sgrena. Sensitive passages were covered with black rectangles in the PDF. The rectangles were drawn over the text rather than replacing it, so anyone who selected the page and pasted it into a text editor could read the names, unit details and rules of engagement that had been “redacted”. Italian media did so the same day.

In June 2017 The Intercept published a scanned NSA document about Russian activity before the 2016 US election. Many colour laser printers add a nearly invisible pattern of yellow dots to every page, encoding the printer's serial number and the date and time of printing. The published scan reproduced the dots; researchers decoded them publicly within hours, and the FBI affidavit against contractor Reality Winner cited the printing records for that document. She was sentenced in 2018 to 63 months.

This is not file metadata in the strict sense, and MetaBroom cannot remove it. It belongs here because it is the same failure in another medium: identifying information added automatically by a device, in a channel the sender never inspected, preserved faithfully by a high-quality copy.

First, the leak lived in a layer the author never looked at — a properties part, an EXIF segment, a preview, a revision list, a print pattern. Second, the file was shared in its native, editable format instead of a flattened copy. Third, the tool that made the visible change did not touch what surrounded it: Photoshop cropped without regenerating the thumbnail, the PDF editor drew instead of redacting, Word kept the drafts it was asked to track. Fourth, the cost was out of all proportion to the effort a check would have taken.

The habits that follow are simple. Inspect every file before it leaves your control, in a viewer that shows metadata rather than the one that hides it. Strip EXIF from photos, and clean documents and PDFs with a tool that rewrites the file. Accept or remove tracked changes and comments before sharing. Use real redaction tools that delete text, and for anything sensitive prefer a flattened export over the working file. None of the people in these stories expected to be identified; all of them could have checked in under a minute.