Document protection in Word not so secure

Microsoft Word has this nifty feature called “Protect Document.” Basically, you can put in a password which prevents others who access the document from accepting or rejecting changes (but still allows them to make edits which show in redline). You can event set protection to allow only fillable fields to be edited, or to prevent someone from making any edits to a document entirely. (This protection is different from the password protection on opening a document.)

Many attorneys (and others) will lock a document, such as a nondisclosure agreement or a draft, with the “track changes” locked on. The idea is that by locking it, the drafter doesn’t have to go through the trouble of generating their own redline of changes sent back by the other side, which is often a good idea to ensure that no changes were “inadvertently” made but not marked in redline.

Microsoft’s dirty little secret, all the way back to the late 90’s when they released Word 97, is that the security mechanism for Word’s document protection is, well, bad. Really bad. In Word 2003 or earlier, you can get around it in 15 seconds by using Microsoft Script Editor to edit the script for the document and to remove the password entry, or even simpler, by saving a Word document in RTF (Rich Text Format), then closing it, reopening the RTF version, and saving it back into Word document format. Once you open the new Word version and click “Unprotect Document,” the password is gone and the document automatically unlocks. (You lose little if any formatting by converting it into RTF and back again.) You can do the same thing in Word 2007 by saving it from Word 97-2003 (.doc) format into Word 2007 (.docx) format, and then back again to Word 97-2003 format.

I use the Protect Document functionality to lock on “track changes” on almost every doc I send out. However, I’m sure to check to make sure that it comes back not only locked, but locked with the password I sent it out with. If you unlock it and it doesn’t have your password, it’s a sure bet that someone unlocked and then re-locked it.

So, if you rely on document protection in your Word documents, be warned…just because you always show your redlines when you prepare a revised version of an agreement, doesn’t mean everyone else will.

Let the blogging begin!

I suppose the best way to begin is to explain why I’ve started this blog. As a practicing attorney for almost 14 years, someone who likes and uses technology (had to be the first on the block with the Wii and Windows Vista), and someone who people occasionally claim to come up with amusing thoughts that make them question the way my brain works, I decided that it was time I shared some of my tips, tricks, thoughts, and general musings on things both contract-related and otherwise. Hence, this blog.

You’ve likely found my blog because you either (a) are interested in learning tips and tricks about in-house practice, (b) are strangely interested in what an attorney has to say anyway, or (c) a relative. To all in category (c), I apologize that your birthday card is late; I must have transposed two digits in your phone number, forgot to jot down your email address, and haven’t yet “friended” you in Facebook which would explain why I’ve been out of touch. To all in (b), I hope that many (or some, or a few, or even one) of my blog entries will make you laugh, smile, or at least justify your time spent looking at my blog. To those in (a), I hope that some of my posts might be of interest, or even helpful to you.
I suppose I should include the standard disclaimer here that I am not providing legal advice to anyone through this blog, and reliance on any information in this blog is at the reader’s own risk, and that simply visiting this blog, reading posts, posting comments, or thinking about posting something does not mean that I’m representing you as your attorney or that we’ve formed an attorney-client relationship.

Onward to more substantive blogging in the next post.