Of course all of us knew this. The article is good for explaining to non-technical friends. http://interactive.wsj.com/articles/SB972002214791170991.htm October 20, 2000 Electronic Form of 'Invisible Ink' Inside Files May Reveal Secrets By MICHAEL J. MCCARTHY Staff Reporter of THE WALL STREET JOURNAL ST. PAUL, Minn. -- For weeks this summer, Mike Ciresi's campaign staff was baffled by a strange series of e-mail messages slamming the U.S. Senate candidate. Sent to Minnesota Democratic Party officials, the messages were signed by a Katie Stevens. But after a failed attempt to track her down, Mr. Ciresi's staff began to suspect foul play. The first e-mail, which arrived in May, impugned the candidate's ethics and those of his Minneapolis law firm. It was accompanied by six pages of court cases, citations and footnotes. The attachments convinced Mr. Ciresi's staff that the e-mail was part of a well-funded "opposition research" effort. But two months and three negative e-mails later, his staff still had nothing to go on. Then in July, one tenacious Ciresi aide, playing a hunch, made a few mouse clicks and uncovered an intriguing clue: hidden text that seemed to link the e-mail to the campaign of the Republican incumbent. Tracking the Metadata It turns out there's more than meets the eye in the average word-processing document. A typical Microsoft Word file, for example, can include the author's name, the name of his or her company, the names of each person who has worked on the document and, depending on the options selected, deleted text and other revisions, all hidden from view, as if written in invisible ink. That's because Word, the dominant word-processing software, contains a lot of what Microsoft Corp. calls "metadata," information that doesn't appear on a user's screen simply because commands in the file tell computer monitors and printers to ignore it. But a savvy reader can peek at much of this behind-the-scenes fiddling by using widely available text-reader programs, such as Notepad, or by simply selecting the right word-processing options. Sometimes, depending on a computer's settings, Word revisions that weren't at all visible to the writer are obvious to the recipient. And when those documents get zapped through cyberspace as e-mail attachments, the inside information they contain can set the sender up for embarrassment or worse. 'Highlight Changes' One such e-mail snafu in Seattle sent both parties scrambling for fixes. In late 1998, Payne Consulting Group received an e-mail that included an attached contract prepared for it by its law firm, Davis Wright Tremaine. By clicking on the "highlight changes" option, Payne and the law firm say, Payne could clearly see revisions that revealed the contract had originally been drafted for another Davis Wright client. The law firm quickly devised security procedures for removing hidden text from its files. Payne, meanwhile, developed a free program called Metadata Assistant to purge any unseen, unwanted information from documents. The program can be downloaded from the firm's Web site, www.payneconsulting (www.payneconsulting.com). One reason Payne doesn't charge for it: "We can't guarantee everything is stripped out," says Robert Affleck, vice president of development. "The big concern is that people are sending around things they don't know they're sending around," says Steve McDonald, associate legal counsel at Ohio State University, who teaches a class in cyberspace law. Microsoft has "gotten few customer complaints" about the problem, says Lisa Gurry, a product manager for Microsoft Office. But she adds that those will be addressed in late spring in the next version of Microsoft Office, which will include a "privacy option" to allow a Word document's author to "remove all personal information with the click of one button and be warned if you're saving tracked changes and comments." For now, Microsoft offers a nine-page article through its Web site on "How to Minimize Metadata in Microsoft Word Documents." It was this kind of data that gave Ciresi campaign aides the first break in their investigation of the e-mails plaguing their candidate. The first in the series, titled "Who Is Michael Ciresi?", arrived May 19. It described the clients of law firm Robins, Kaplan, Miller & Ciresi as "a rogues' gallery of polluters, price fixers, tortfeasors, predators, civil-rights violators and frauds." A second searing e-mail arrived just before Minnesota Democrats convened in early June to endorse a candidate in the state's senatorial race. A third followed. Then, a fourth. "I was getting so frustrated trying to figure out where these came from," recalls Mark Hinds, the campaign's deputy field director. But as he sat thinking at his desk in the Democratic Party's offices here in early July, a light bulb clicked on. Mr. Hinds suddenly recalled how at a previous job he used to sort Word documents by using keywords and names in the program's "properties" box. With that in mind, he clicked on the Word attachment to the fourth and latest e-mail, OIL SPILL LOBBYISTS.doc. The properties box, which he found by using Word's file menu, instantly showed that the document was created July 8 and was "Last Saved by: Chris Gunhus." His thoughts immediately turned to Christine Gunhus, the political director and former chief of staff for Sen. Rod Grams, the Republican Mr. Ciresi had been hoping to unseat. "Come here, you gotta see this," Mr. Hinds says he called out to fellow campaign workers, who gathered around his computer. They started searching through the previous e-mails. The first one said "Last Saved by: Kinko's Customer" and listed "gunhus" as the author. They found other names and more dates and times that the documents had been created and stored. The Ciresi campaign alerted local authorities to its discoveries, which were first reported by the Minneapolis Star Tribune. The campaign alleged that the masquerade wasn't just a political dirty trick but a possible misdemeanor. A Minnesota law, which was designed to discourage anonymous attacks on politicians, requires those involved in election campaigns to disclose that fact in any political literature they prepare or distribute. The law exempts individuals who spend less than $300 on their activities and observe certain other limits. By late August, the Anoka County attorney's office had amassed enough evidence to persuade a judge to let it seize two computers and nine computer disks from Ms. Gunhus's Ham Lake, Minn., home. Asked if Ms. Gunhus was involved in writing or editing any of the e-mails under investigation, Doug Kelley, her attorney, wouldn't comment. "In the long run," he says, "she will be found not to have violated any laws." Ms. Gunhus declined to be interviewed. Sen. Grams's campaign denies that it produced or authorized the e-mails. But after discovering the names tucked deep inside the e-mail messages, Bob Decheine, the Ciresi campaign manager, believes otherwise. "We think we have found a smoking gun," he says. County investigators, however, proceeded carefully, after learning that anyone could easily have framed Ms. Gunhus by entering her name in the properties box. "I could put in that 'William Shakespeare' is the author," says Bryan Lindberg, the assistant attorney leading the inquiry. But then, Mr. Lindberg says, his team uncovered a more substantive link. Subpoenaed phone and Internet-access records linked the "Katie Stevens" Hotmail account used to send the attack e-mails to a Kinko's document-processing center and a phone line listed as belonging to Ms. Gunhus's home, according to an affidavit filed by the county attorney's office as part of its search-warrant request. "The telephone number back to the Gunhus residence in Ham Lake gave us the probable cause to look at her computers," Mr. Lindberg says. Mr. Ciresi lost his state's Democratic primary last month. The investigation into the e-mail messages continues.