How to protect off-the-record information