Microsoft Word 'Bug' Enables Web Tracking

Welcome Guest. | Log In| Register | Membership Benefits

August 30, 2000 (3:55 PM EDT)

A previously uncharted feature in Microsoft Word could allow authors of documents to monitor the travels of their files through cyberspace, according to the Privacy Foundation.

Such surreptitious "bugging" can occur when the file, usually sent as a mail attachment, contains a link to an image file on a remote Web server. If the document contains an invisible marker that requests the image, once it is opened, it could send a signal back to the document's creator. That signal would contain the IP address of the recipient's computer, according to the foundation.

If the document is forwarded, the process repeats itself. Theoretically, the author could build up an impressive cache of information about the various recipients.

The so-called Web bugs in Word files can also read and write browser cookies in Internet Explorer. Those cookies could let the author match up the viewer of the document with visits to the author's website, according the foundation.

Richard Smith, chief technology officer for the Privacy Foundation, Denver, did not attribute any malignant intent to Microsoft, Redmond, Wash. "It's just sort of an unintended consequence of the merging of the Internet with desktop applications," he noted. "This is something software developers should think through. Imagine if MP3 started linking to Web images and you could watch every time someone played an MP3 file?"

Indeed, the trend has knit desktop applications more closely with Web-based content. And software vendors, including Microsoft, have encouraged users to update their software via the Web.

"As long as it's voluntary and I'm asked each time, I don't mind. It's when it's done secretly that it's a problem," Smith said.

The application is so popular that the foundation might never know if anyone uses the Word feature to secretly track document use, said Smith. So far, the foundation has no evidence of such use.

This is not the first time that a hidden aspect of Word has come under scrutiny. A few years back, Smith discovered that Microsoft embedded code in Word documents that would let the documents be traced back to their authors.

"This is almost the 180 degree opposite," Smith said. "In that case, if you had the Word document, you could trace who sent it. In this case, the author can track who reads the document."

Microsoft (stock: MSFT) did not immediately return telephone calls seeking comment, but Smith said the company acknowledged the issue and said it is "'just the way the Web works' -- which is true."

The foundation's website has a lengthy explanation of the bug and its ramifications. But, because the ability to link documents with Web-based content is useful, the foundation does not recommend the removal of the bug itself. It does, however, recommend that Web browser cookies be disabled inside Word documents.