Agencies redact imperfectly.
Publishing what they sent, unread, publishes that.

This is the page that earns the rest of the site. A platform that makes it easy to publish government records makes it easy to publish the personal information of people who appear in government records, and most of those people are not the subject of anybody’s investigation.

Why the records arrive dirty

A public-records officer redacting a release is doing it by hand, under a deadline, on documents written by other people for other purposes, often in a system that produces flattened images with no text layer. They are applying exemptions they have to reason about case by case. They are frequently the only person doing this job for their entire agency.

The failures that follow are ordinary and predictable:

• A black box drawn over text in a PDF that leaves the text selectable underneath.
• A name redacted on page 4 and left standing on page 41.
• A redacted name that is still identifiable from a badge number, a role, a date, or an address on the same page.
• An attachment or an email footer nobody thought to look at.
• Metadata: authors, revision histories, original filenames, embedded thumbnails of the unredacted page.
• A spreadsheet released with hidden columns, or a chart still bound to its source data.

None of that is a scandal on the agency’s part. It is what the work looks like. But it means the assumption “the agency released it, so it is fit to publish” is false often enough to be dangerous, and the person who publishes it is the one who put it in front of the world.

What the scan does

Every ingest is scanned before the response returns — summary text, extracted document text, and file names. The findings come back in the ingest response and are attached to the draft, and a draft with unresolved findings has no publish action at all.

The scan looks for, at minimum:

Why minors and medical go to review, not to the author

Every other category can be cleared by the author, because the author is the person who knows whether a phone number belongs to a press office or to a witness. These two cannot.

The reason is not that authors have poor judgement. It is that these are the two categories where the entire cost of a wrong call is borne by someone who is not in the conversation, where the harm does not decay — a child’s name attached to a case file follows them for years — and where the pressure to publish is at its highest precisely when the material is most sensitive. Asking an author under deadline to be the sole check on that is asking the wrong person at the wrong moment.

Review is a person, it is not instant, and it will occasionally hold up a post that turns out to be fine. That is the trade, stated plainly rather than buried.

What a finding looks like

Findings return in the ingest response, so the tool that submitted the documents shows them immediately — while the person still has the file open. This is the shape:

Illustrative findings, showing the categories and the shape of the response. They are not from a real submission.

Each finding names its category, says where it was found, and says what it wants. Nothing is auto-redacted: an automatic redaction that guessed wrong would either destroy evidence or, worse, produce a document that looks redacted and is not.

The scan is a net, and the author is responsible

This is why the language throughout the product is deliberate. A draft with no findings says “the scan raised nothing”. It never says “no personal information found”, and it never says “safe to publish”. The difference between those sentences is the difference between a tool that helps and a tool that launders a decision.

What that means in practice

• Read the documents. All of them, including the attachments and the pages that look like boilerplate.
• Redact before submitting where you already know something is there. The scan is a second pass, not the first.
• Ask whether a person named in a document is there because of what they did in an official role, or because something happened to them. Those two are not close.
• If you are unsure about a minor or a medical detail, you do not have to decide — that is what review is for.

Afterwards

Publication is not the last point of control. Anyone — an author, a reader, or a person who appears in a document — can ask for something to be removed, and the service holds itself to a deadline for answering. Requests from a person whose own personal information is at issue are handled first, regardless of who else is involved. Takedown →

Removal is real removal: the post stops being served, and it is pulled from the public read API the widget uses, so embedded copies on authors’ own sites stop showing it too.