False positives incidents show a date separator slash being recognised as a 1

Products

• Data Loss Prevention Enterprise Suite
• Data Loss Prevention Core Package

Issue/Introduction

You see false positives incident in the Enforce console where a date has been interpreted as a drivers license number, because the forward slash date separator has come through as a number 1.

 

Resolution

In this case the source document was a PDF form scanned from a hand completed original form. It appeared that, although all of the text was in fact an image, some of it was extractable by DLP.

Sensitive Image Recognition was not deployed in the customer environment, so any OCR conversion must have been performed by the PDF application and the extracted meta-data stored in the document.

Even when copying and pasting some of the image 'text' from the original document we saw that it was interpreted as mm1dd1yyyy format instead of mm/dd/yyy US date format.