Beware Prying E-Mail

Welcome Guest. | Log In| Register | Membership Benefits

December 01, 2000 (2:05 PM EST)

Technology that tracks e-mail recipients can be a lucrative tool for marketers, but it also can give e-mail solicitors unwelcome access to private user and company information, experts warn.

It's increasingly common for marketers to embed invisible HTML "bugs" in their e-mail.

These one-pixel images, which like all pictures in HTML e-mail must be retrieved from the sender's server when the message is opened, can include code that tells the sender when and how often recipients look at a message.

Senders can then gauge the effectiveness of sales pitches and other online solicitations.

That's great for the senders, but Web bugs can reveal much more than e-mail usage patterns.

If an IP address other than that of the original recipient calls for the image, senders can determine when and how often their e-mail has been forwarded inside the receiving company.

That's where privacy problems loom.

HTML makes browsers launch, letting senders place cookies on every PC that accepts an e-mail message containing such a bug.

Once a sender places those cookies, it can gather such information as recipients' IP addresses, the types of browsers they use, and the sites they have visited.

"On the one hand, I think it's very cool technology," said Hurwitz Group analyst Sharon Ward. "But on the other hand, it frightens me."

Gartner Group analyst John Pescatore labels these bugs "a definite security risk."

Vendor Internet Security Systems Inc. (stock: ISSX) recommends that employees set their e-mail programs to notify them before they send return receipts to the senders.

However, even when e-mail is read in preview mode, the vendor says, HTML tags hidden in headers will likely hit the remote Web server referenced in the tag -- making it possible for e-mail senders to gather information with cookies.

Pescatore advises clients to have their IT staffs configure all browsers to block cookies. Microsoft's Internet Explorer, for instance, has an add-on feature that can help block Web bugs and cookies.

Some e-mail programs, such as Microsoft Outlook, let users screen out images, thereby screening out Web bugs.

Vendors that assist marketers and other e-mail solicitors say they have strict policies to prevent the unauthorized use or sharing of information learned about individuals.

MindArrow Systems Inc. (stock: ARRW), which says 29 percent of the people it reaches with its rich-media messages get their e-mail as "pass-alongs," will share those names and addresses with marketing clients only if individuals opt in.

Digital Impact Inc. (stock: DIGI), another marketing vendor, says it doesn't store personal information on cookies and doesn't identify individuals' IP addresses.

Neither company sells information.

But other vendors are less scrupulous. Korea's Postel Services adds Web bugs to clients' e-mail before passing them along to the end recipient.

Such services could, for example, let an individual know when a company reads his e-mailed resume, or let a business know when a company reads its e-mailed business proposal.

Most of the self-imposed regulations that Net businesses abide by are designed to comfort consumers, not business recipients.

The TRUSTe program, for instance, requires companies bearing its seal to reveal to consumers which pieces of personal data they record and how that data will be used.

But individuals aren't regulated by trade group policies, of course, and neither are businesses sending e-mail of a non-marketing nature. And government regulation of e-mail is seen as anathema by most e-businesses.

Some IT managers are doing everything they can to block executable files and cookies.

Junk mailers use cookies to track which sites users visit and then spam those individuals -- which can shut down a company's e-mail server, said Danny Slagle, PC support specialist at automotive safety equipment maker Breed Technology.

Breed installed an add-on to Microsoft Internet Explorer 5.5 that disables cookies.

Paul Scarpa, president of research firm Switchcase, said it's likely that some companies and individuals will continue to use e-mail tracking technology to gain as much information as possible about the businesses and people in their address books.

"It's the old adage that man has never invented a weapon that he didn't use," Scarpa said. "If he can do it, he will."