Checkpoint 26: Security

Encrypted PDFs must be configured to allow content extraction for accessibility purposes. If encryption prevents assistive technology from accessing the document content, people who use screen readers cannot read the document at all.

What This Means

PDF encryption allows document creators to restrict what users can do with a document, such as preventing printing, editing, or copying text. These restrictions are controlled by a set of permission flags stored in the PDF's encryption dictionary.

One critical permission flag (the 10th bit position) controls whether text and graphics can be extracted from the document for accessibility purposes. When this flag is disabled, screen readers and other assistive technologies cannot access the document content - they see only a locked, empty document.

This is different from most accessibility issues, which degrade the user experience. A PDF with encryption that blocks content extraction provides zero access to assistive technology users. The document is completely, totally inaccessible regardless of how well the content itself is tagged and structured.

Importantly, this setting is often enabled by mistake. Document creators intend to prevent unauthorized copying but do not realize they are also blocking screen readers. PDF/UA requires that even encrypted documents allow content extraction for accessibility.

Why It Matters

When encryption blocks content extraction:

• Complete access barrier: Screen reader users cannot access any content in the document - not even the title
• No workaround exists: Unlike other accessibility issues, users cannot work around this barrier
• Wastes accessibility effort: Even perfectly tagged, accessible content becomes useless if extraction is blocked
• Violates legal requirements: Documents that completely block assistive technology access fail accessibility laws
• Affects legitimate use: Users who need to copy text for assistive purposes (like text-to-speech or translation) are blocked

The irony is that PDF encryption provides relatively weak protection against determined copying, but presents an absolute barrier to accessibility. Someone who wants to copy protected content can often find ways around the encryption, but a blind user who simply wants to read the document cannot.

Common Violations

The Matterhorn Protocol defines two failure conditions for security settings, both of which are machine-testable.

26-001: Encrypted File Missing P Key in Encryption Dictionary

What's Wrong: The PDF is encrypted but does not contain the permission flags (P key) in its encryption dictionary. Without these flags, there is no way to determine what operations are allowed, and most PDF readers default to maximum restriction.

How to Identify:

• Run a PDF/UA validator (PAC, veraPDF)
• The validator will report a missing P key in the encryption dictionary
• Opening the document in a screen reader may show no content or an error message
• Adobe Acrobat's Document Properties > Security will show encryption but may not display permissions clearly

Technical Details:

In an encrypted PDF, the encryption dictionary should contain:

/Encrypt <<
  /Filter /Standard
  /V 4
  /P -3904  (permission flags as a 32-bit integer)
  /U (...)  (user password hash)
  /O (...)  (owner password hash)
>>

If the /P key is missing entirely, the PDF is malformed. This typically results from:

• Corruption during encryption
• Use of non-standard or buggy encryption tools
• Manual manipulation of the PDF structure
• Very old PDF creation tools

How to Fix: This usually requires re-creating the PDF with proper encryption settings, as the missing P key indicates a structural problem rather than a simple settings issue.

26-002: Encrypted File Has P Key but 10th Bit Position Is False

What's Wrong: The PDF has encryption permissions configured, but the specific permission for "content extraction for accessibility" (bit 10) is not enabled. This explicitly blocks assistive technology from accessing the content.

How to Identify:

• Run a PDF/UA validator
• The validator will report "10th bit not set" or "content extraction not permitted"
• Screen readers will be unable to read the document content
• In Adobe Acrobat, File > Properties > Security will show "Content Copying for Accessibility: Not Allowed"

Technical Details:

The P value is a 32-bit integer where each bit controls a specific permission:

• Bit 3: Print (low quality)
• Bit 4: Modify contents
• Bit 5: Copy text and graphics
• Bit 6: Add or modify annotations
• Bit 10: Content extraction for accessibility
• Bit 11: Assemble document
• Bit 12: Print (high quality)

For PDF/UA compliance, bit 10 must be set to 1 (true), even if bit 5 (general copying) is set to 0 (false). This allows a document to:

• Prevent general copying (for rights management)
• While still allowing accessibility tools to extract content

Common Cause: Many PDF creation tools have a single checkbox for "Allow copying" that controls both bit 5 and bit 10 together. When creators uncheck this to prevent copying, they inadvertently block accessibility too.

How to Fix in Adobe Acrobat

Adobe Acrobat Pro provides straightforward tools to modify PDF security settings.

Checking Current Security Settings

1. Open the encrypted PDF in Adobe Acrobat Pro
2. Go to File > Properties (or press Ctrl+D / Cmd+D)
3. Click the Security tab
4. Look for "Content Copying for Accessibility" under Document Restrictions Summary
5. If it shows "Not Allowed," the document needs to be fixed

Changing Security Settings

To modify security settings, you need the owner password (permissions password), not just the user password (open password).

1. Open the PDF in Adobe Acrobat Pro
2. Go to File > Properties > Security
3. Click Change Settings or select Security Method: No Security and then re-apply encryption
4. If prompted, enter the owner password
5. In the security settings dialog:
   • Look for "Enable copying of text, images, and other content"
   • Find and enable "Enable text access for screen reader devices for the visually impaired"
   • This may be a separate checkbox or combined with copying permissions
6. Click OK and save the document

Removing Security Entirely

If the document does not need encryption:

1. Open the PDF in Adobe Acrobat Pro
2. Go to File > Properties > Security
3. Enter the owner password if prompted
4. Change Security Method to No Security
5. Click OK
6. Save the document

Re-Encrypting with Correct Settings

If you need to maintain some restrictions while allowing accessibility:

1. First remove security (as above)
2. Go to File > Properties > Security
3. Select Security Method: Password Security
4. In the Password Security dialog:
   • Set passwords as needed
   • Under Permissions, configure restrictions
   • Crucially: Enable "Enable text access for screen reader devices for the visually impaired"
   • This may be in an "Accessibility" section or near the copying permissions
5. Click OK twice and save

Using Batch Processing

For multiple documents with the same security issue:

1. Go to Tools > Action Wizard
2. Click New Action
3. Add "Security" > "Remove Security" step
4. Or add "Security" > "Encrypt with Password" with correct settings
5. Configure the action for multiple files
6. Run the batch process

When You Do Not Have the Owner Password

If you do not have the owner password, you cannot modify security settings. Your options are:

1. Contact the document creator to request an accessible version or the owner password
2. Request a new version of the document with correct security settings
3. Use the original source (Word, InDesign, etc.) to create a new PDF with proper settings
4. Legal considerations: Some jurisdictions allow circumventing DRM for accessibility purposes, but consult legal guidance first

How to Fix in Microsoft Word

When creating PDFs from Word, security settings are applied during export.

Creating a PDF Without Security Restrictions

The simplest approach is to create an unencrypted PDF:

1. Go to File > Save As
2. Select PDF as the format
3. Click Options
4. Ensure accessibility options are checked:
   • "Document structure tags for accessibility"
   • "Create bookmarks using: Headings" (if applicable)
5. Click OK and save

This creates a PDF without encryption, ensuring full accessibility.

Creating a Protected PDF While Maintaining Accessibility

Word's built-in PDF export does not offer fine-grained encryption controls. For protected PDFs with proper accessibility settings:

1. Export from Word to PDF without encryption
2. Open the PDF in Adobe Acrobat Pro
3. Apply encryption with correct settings (see Acrobat instructions above)

Using Third-Party Tools

Some third-party PDF tools offer more control during export:

1. PDF-XChange Editor allows setting permissions during creation
2. Nitro PDF provides detailed security controls
3. Foxit PhantomPDF offers granular permission settings

When using any tool, look for options like:

• "Allow content extraction for accessibility"
• "Enable text access for screen readers"
• Separate checkboxes for copying vs. accessibility

Best Practice: Encrypt After Creation

The most reliable approach:

1. Create the PDF from Word without any security
2. Verify the PDF is accessible (run accessibility check)
3. Apply encryption in Adobe Acrobat with accessibility explicitly enabled
4. Re-verify accessibility after encryption

This ensures you do not accidentally block accessibility during the creation process.

Testing Your Fix

After modifying security settings, verify the document is now accessible.

Check Document Properties

1. Open the PDF in Adobe Acrobat Reader (not Pro)
2. Go to File > Properties > Security
3. Look at the Document Restrictions Summary
4. Verify "Content Copying for Accessibility" shows "Allowed"

Automated Validation

1. Run PAC (PDF Accessibility Checker)

   • Open the document in PAC
   • Run the PDF/UA check
   • Verify no Checkpoint 26 failures appear

2. Run Adobe Acrobat Accessibility Checker

   • Go to Tools > Accessibility > Accessibility Check
   • Run the full check
   • Verify no security-related failures

Screen Reader Testing

The definitive test is whether assistive technology can actually read the content:

1. NVDA (Free, Windows)

   • Open the PDF in Adobe Reader with NVDA running
   • Press Insert+T to read the title
   • Navigate through the document (arrow keys, Tab, headings navigation)
   • Verify content is announced correctly

2. JAWS (Windows)

   • Open the PDF with JAWS running
   • Try reading the document (Insert+Down Arrow for "Say All")
   • Navigate using headings (H key) and other navigation
   • Confirm content is accessible

3. VoiceOver (Mac)

   • Open in Preview or Adobe Reader
   • Enable VoiceOver (Command+F5)
   • Navigate through the document
   • Verify content is read correctly

Text Extraction Test

A simple technical test:

1. Open the PDF in Adobe Acrobat Reader
2. Try to select and copy text (Ctrl+C / Cmd+C)
3. If the document still has copy protection, text may not copy for regular users
4. But if accessibility is enabled, assistive technology will still work

Note: This test is not definitive - a document can allow accessibility extraction while blocking regular copying.

Verification Checklist

• PDF/UA validation passes (no Checkpoint 26 failures)
• Document Properties shows "Content Copying for Accessibility: Allowed"
• Screen readers can read all document content
• Navigation (headings, links, etc.) works in assistive technology
• Form fields (if present) are accessible
• Document opens in various PDF readers without errors

Additional Resources

Official Standards and Guidelines

• PDF Association Matterhorn Protocol 1.02
• ISO 14289-1 (PDF/UA-1) Standard
• ISO 32000-1 (PDF 1.7) - Section 7.6 Encryption

Adobe Documentation

• Adobe Acrobat Security Settings
• Adobe: Creating Accessible PDFs
• Adobe: PDF Security and Digital Signatures

Technical References

• PDF Reference 1.7 - Encryption Dictionary
• PDF Association: PDF/UA and Encryption
• Understanding PDF Permission Flags

Tools

• PAC (PDF Accessibility Checker) - Free PDF/UA validation
• veraPDF - Open-source PDF/UA validator
• NVDA Screen Reader - Free screen reader for testing
• QPDF - Command-line tool for inspecting PDF structure

Legal and Policy Guidance

• U.S. Access Board: PDF Accessibility
• Section 508 Requirements
• EN 301 549 (European Standard)

This documentation is based on the Matterhorn Protocol 1.02, the definitive reference for PDF/UA validation. Security settings that block content extraction make documents completely inaccessible to assistive technology. For the most current information, consult the PDF Association and relevant accessibility standards.