On 8 January 2019, Paul Manafort's legal team filed a 37-page PDF response in federal district court in Washington D.C. The document was their reply to special counsel Robert Mueller's claim that Manafort had breached his cooperation agreement by lying to prosecutors on five subjects. The filing was dense with legal argument and, crucially, contained multiple passages blacked out with what the lawyers believed were secure redactions. Within hours, reporters and court-watchers noticed something unusual. The blacked-out text was not truly hidden — it could be selected, copied, and read in full by anyone who pasted the content into a plain text editor. The lawyers had used a PDF tool that drew opaque black rectangles over the text as an annotation layer, leaving the underlying words completely intact in the document's content stream. By evening, BuzzFeed News had published the recovered text. What it revealed changed the public's understanding of the Mueller investigation significantly — and demonstrated once again that cosmetic PDF redaction is not redaction at all.

What the failed redactions revealed

The passages that Manafort's team had attempted to conceal were among the most consequential facts in the entire Russia investigation. Three disclosures stood out immediately. Polling data shared with Konstantin Kilimnik: The exposed text confirmed that Manafort had shared internal Trump campaign polling data with Konstantin Kilimnik — a Ukrainian political consultant whom the FBI had assessed to have ties to Russian intelligence. The data sharing had occurred during the summer of 2016, at the height of the campaign. Manafort had denied or minimised this in his cooperation interviews; the filing now confirmed it happened and that prosecutors considered it one of his material lies. The "peace plan" discussions: The redacted text described ongoing discussions between Manafort and Kilimnik about a proposed Ukraine peace plan that, critics argued, would have effectively legitimised Russian control of eastern Ukraine. These discussions continued into 2018 — well after Manafort had ostensibly begun cooperating with investigators. Contact with the Trump administration: The recovered passages indicated Manafort had been in contact with administration officials even after his indictment, a detail prosecutors considered relevant to the question of whether he was expecting a pardon. The Guardian, The New York Times, and The Washington Post all reported on the discovery the same evening.

How the failure happened technically

The mechanics of the failure were identical to the AT&T/NSA case from 2006 — and to dozens of other PDF redaction incidents in between. Manafort's lawyers used a PDF editing tool to place filled black rectangles on top of the sensitive paragraphs. In the rendered document, these rectangles looked like solid black bars. In the file's internal structure, they were annotation objects layered over an unmodified content stream. The test to expose the failure was trivial: open the PDF, press Ctrl+A to select all content, press Ctrl+C to copy, then paste into a plain text editor like Notepad or TextEdit. The text editor received the raw text from the content stream — ignoring all rendering annotations — and the supposedly hidden passages appeared in full. Several Twitter users and journalists independently discovered and published the trick within the same hour. Because the document was a public court filing available on PACER (the federal courts' public access system), anyone with a PACER account could download and check the original file. Manafort's lawyers filed a corrected version late the same night — this time with true redaction applied — but by then the text had been widely quoted and archived across dozens of news outlets. The legal team later described the error as a "technical issue" with their PDF software workflow.

The legal and political consequences

The exposed content had immediate consequences on multiple fronts. Legally, the revelation that Manafort had shared polling data with a person assessed to have Russian intelligence ties became one of the most scrutinised facts of the entire Mueller investigation. The Senate Intelligence Committee later cited this fact — confirmed in part by the accidental disclosure — in its bipartisan report on Russian interference published in 2020. For the legal profession, the incident triggered a wave of urgent guidance from bar associations and legal technology organisations about PDF redaction procedures. The American Bar Association's Law Practice Division published updated guidance reminding lawyers that visual obscuring of text in a PDF is not legally sufficient redaction, and that using the correct tool — specifically software that removes content from the file structure rather than covering it — is a professional obligation when handling sensitive court filings. For the media, the event became a widely cited example of why journalists and researchers routinely test PDF redactions on sensitive documents. Newsroom guides began explicitly including the copy-paste test as a standard step when reviewing legal filings.

The correct way to redact — what should have been done

The correct procedure, had Manafort's team followed it, would have taken only marginally more effort than what they did — but would have produced a fundamentally different result. Step 1 — Use a true redaction tool: Adobe Acrobat Pro's Redact toolset (Tools › Redact), PDFTheGuide's redaction tool, or any tool that explicitly states it removes content from the content stream rather than covering it. The key distinction is that a true redaction tool marks a region, then permanently deletes the underlying text or image data from the binary file when the redaction is applied. Step 2 — Apply and save: After marking regions, the "apply redactions" step must be explicitly executed. Many tools require this as a separate action to make clear it is irreversible. After saving, the original data is gone. Step 3 — Verify: Select all text on the page (Ctrl+A / Cmd+A), copy, and paste into a plain text editor. If any of the content that should be hidden appears in the paste output, the redaction did not work. This single check, which takes under thirty seconds, would have caught the Manafort failure before the document was filed. Step 4 — Repeat for metadata: Strip the document's metadata before filing. Metadata can reveal the author's name, the law firm's software, and when the document was created and modified — all potentially sensitive in a legal context. The failure was not a sophisticated attack. No technical expertise was required to exploit it. It was a workflow error that a thirty-second quality check would have caught.
The Manafort filing failure of January 2019 is the highest-profile PDF redaction incident of the past decade — both because of the political significance of what was exposed and because of the simplicity of the technique that exposed it. Copy, paste, read. It sits in a direct line with the AT&T/NSA case of 2006, the Gonzales memo of 2005, and dozens of lesser-known incidents across legal, government, and corporate filings. In every case the mechanism is identical: a black shape drawn on top of text that remains fully intact underneath. The PDF format is not at fault. It has supported proper redaction via the /Redact annotation mechanism since PDF 1.7, and every major PDF editing tool now includes a true redaction feature. The recurring failures are procedural — the result of professionals reaching for a familiar drawing tool instead of the dedicated redaction function, and skipping the verification step that would catch the mistake immediately. If you handle sensitive documents, the rule is simple: use a tool that states it removes content from the file, run the copy-paste test on the output, and never distribute a redacted PDF you have not personally verified.