My organization has some Confidential (as in statutory requirements confidential) documents that go out to certain people and committee groups prior to their release into public domain. These documents need to be accounted for during this timeframe to prevent their "early" release. This has been done historically, by all the interested parties holding a meeting in a closed room, the documents passed out, the meeting held, and then they are collected as everyone leaves the room. I have been tasked with duplicating the same kind of policy mechanism using our publically facing web server (Debian 5.0.6 on Xen HVM running Apache2).
I immediately dislike the idea of keeping confidential material on a web server that is accessible by the entire world just on principle alone but we will put that concern aside for a minute. These documents need to be 1) accessible to only the interested parties, 2) the content of the documents protected somehow, 3) not able to be printed by the people that view it, 4) not able to be saved for re-distribution later.
I think using .PDFs is the best solution for this. I can constrain the ability to print, and edit the documents. Judicious use of .htaccess and SSL can prevent the whole world from downloading them. It's the single use, non-distribution part that I cannot think of a decent way to implement. Once they're downloaded, they're downloaded. And nothing I can think of, can prevent someone from passing the document to someone who shouldn't have it along with the password to read it. What I need is a single-use policy mechanism, like a one-time password for .PDFs. Use the password once and then we just rely on Adobe's encryption (for better or for worse).
Anyway, I'm kind of at an end on how to accomplish this, and I was hoping some of the good folks here could help me generate some ideas so I can present the pros and cons of this project to the boss.
Thank you kindly.
EDIT: It's been noted numerous times that any technical system to do this is easily circumnavigated by things like dictating the information out of the document to someone, taking a picture or screenshot or something like that. This threat already exists in the "closed room" model, although it's certainly much smaller. We can more or less trust the people on the other end, just not their computers.