Document protection in Word not so secure

Microsoft Word has this nifty feature called “Protect Document.” Basically, you can put in a password which prevents others who access the document from accepting or rejecting changes (but still allows them to make edits which show in redline). You can event set protection to allow only fillable fields to be edited, or to prevent someone from making any edits to a document entirely. (This protection is different from the password protection on opening a document.)

Many attorneys (and others) will lock a document, such as a nondisclosure agreement or a draft, with the “track changes” locked on. The idea is that by locking it, the drafter doesn’t have to go through the trouble of generating their own redline of changes sent back by the other side, which is often a good idea to ensure that no changes were “inadvertently” made but not marked in redline.

Microsoft’s dirty little secret, all the way back to the late 90’s when they released Word 97, is that the security mechanism for Word’s document protection is, well, bad. Really bad. In Word 2003 or earlier, you can get around it in 15 seconds by using Microsoft Script Editor to edit the script for the document and to remove the password entry, or even simpler, by saving a Word document in RTF (Rich Text Format), then closing it, reopening the RTF version, and saving it back into Word document format. Once you open the new Word version and click “Unprotect Document,” the password is gone and the document automatically unlocks. (You lose little if any formatting by converting it into RTF and back again.) You can do the same thing in Word 2007 by saving it from Word 97-2003 (.doc) format into Word 2007 (.docx) format, and then back again to Word 97-2003 format.

I use the Protect Document functionality to lock on “track changes” on almost every doc I send out. However, I’m sure to check to make sure that it comes back not only locked, but locked with the password I sent it out with. If you unlock it and it doesn’t have your password, it’s a sure bet that someone unlocked and then re-locked it.

So, if you rely on document protection in your Word documents, be warned…just because you always show your redlines when you prepare a revised version of an agreement, doesn’t mean everyone else will.

Leave a Reply

Your email address will not be published. Required fields are marked *