E-mail spying

By Diane Hawkins-Cox
CNNdotCOM

(CNN) -- Telecommunications experts have found that wiretaps are not just for telephones. Computer science researchers with the Privacy Foundation recently learned of a technique people can use to eavesdrop on e-mail.

It works like this: John sends an e-mail to Joe. Joe adds a comment and forwards the message to Jane. Joe and Jane continue responding to each other via this e-mail message, and perhaps even forward it to other people. But unbeknownst to them, John can monitor everything they write to each other, as long as they are using his original e-mail as their base message.

David Martin, a computer science professor at the University of Denver and an associate of the Privacy Foundation, calls this technique e-mail wiretapping. He says it doesn't work with all e-mails.

"First, the e-mail has to be formatted with HTML," Martin explains. "If it looks like a Web page it probably is formatted that way. And second you have to use an e-mail reader that is vulnerable to this particular attack. Specifically, the reader has to have JavaScript enabled."

JavaScript is a type of code that's very useful in Web pages but less needed in e-mail messages. Nevertheless, JavaScript is enabled by default in several popular e-mail programs, such as Outlook, Outlook Express, and Netscape Six.

The JavaScript code can be made to forward any words added to the original e-mail message to the server of the original message sender.

It's hard to detect whether you're being spied on using this technique. You can try to avoid the problem by disabling JavaScript, but you would still be vulnerable if you forward e-mail to someone who hasn't disabled the program.

If you're JavaScript savvy, you might be tempted to take advantage of this situation yourself -- for instance, to find out if there was any response to a resume you sent to a potential employer. But Martin cautions against that.

"As far as we know the use of this sort of device in order to surreptitiously monitor other peoples' conversations is illegal," he says.

Hacker unleashers updated backdoor program
March 15, 2001
Hotmail addresses shared with Internet directory
March 6, 2001
Monitoring e-mail: Management or thought police?
February 27, 2001

Privacy Foundation

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.