CNET también está disponible en español.

Ir a español

Don't show this again

Tech Industry

Now your boss can read email you didn't send

Investigator, a $99 Windows-based surveillance program from WinWhatWhere, captures your keystrokes--even ones that are immediately deleted.

    You type, "My boss is a big fat idiot" into an email message, then backspace over it before clicking Send. But it's too late. Your boss already knows.

    Investigator, a $99 Windows-based surveillance program from WinWhatWhere, captures your keystrokes--even ones that are immediately deleted.

    Capturing keystrokes in itself isn't that new. But two weeks ago an even more controversial feature was quietly added to Investigator. The program can now capture text that you didn't type, but merely displayed momentarily on your screen.

    Investigator first gained its keystroke-capturing abilities in version 2.0, released last September. The new feature is part of an upgrade to version 2.0.539 this month.

    It's widely known, at least among the technically savvy, that companies can monitor email messages their employees send and receive on a corporate network. And most email travels on the Internet as plain text, where anyone can intercept it.

    But Investigator promises a higher level of monitoring than was previously possible. And more than 5,000 customers, mostly corporations, have purchased it. In addition, even more companies may monitor employees this deeply as software developers figure out how to create programs that bury themselves within Windows.

    Remember that politically incorrect joke file you briefly opened? Its contents may now be in your permanent log.

    On the one hand, Investigator could open new lines of communication between you and your boss. For example, you could type, "If you're reading this, you have too much spare time..."

    On the other hand, companies' new ease of monitoring raises important questions.

    Privacy advocates are concerned that the "deep monitoring" available with Investigator will become the standard.

    "It undoubtedly will catch on," said Jodi Beebe, hotline director of the Privacy Rights Clearinghouse in San Diego, Calif. "The more information companies can gather about their employees, the more information they will."

    The program's author, Richard Eaton, says Investigator captures only the name, not the content, of Web pages people view. Storing the full contents of Web pages made his logs far too large, he says. More interesting to company executives are files people view but never save, such as documents opened from a CD-ROM or a floppy disk.

    Investigator also is well hidden from PC users' view. It doesn't show up as a running program in Windows' Task List, for those people who are experienced enough to look there.

    The American Management Association, an organization with 10,000 corporate members, surveyed 1,054 companies last year and found that more than 45 percent of them save and review employees' email messages, computer files or telephone conversations. This is up from 35 percent two years earlier, the association said.

    Any company that installs something like Investigator on PCs without notifying people is unlikely to show up on any list of "the 100 best places to work." Perhaps in recognition of this, 83 percent of the companies that store and review email told the AMA that they do inform employees of that fact.

    Merely notifying employees that every keystroke is monitored may not be a good influence on company morale, however.

    Computer usage, even during an employee's lunch hour or coffee break, seems to have achieved some sort of taboo status. If you pour a cup of coffee from the corporate kitchen, it never seems to generate accusations of thievery. But use a PC to send a personal email and it somehow arouses talk of "theft of corporate resources."

    Corporate use of Investigator doesn't appear to have led to any lawsuits, at least so far. But monitoring may lead to a backlash by unhappy employees. Not all personal use of a company PC during a break is a violation of corporate ethics.

    Just because you're not paranoid, you can't assume your boss isn't watching you.

    Using your own cell phone to make personal calls, or a private laptop connected to a pay phone to check email, is a safer bet than using corporate equipment. Yes, someone may be scanning your cell call or intercepting your email. But it probably isn't your boss who's tuning in.

    Do you know of a problem affecting consumers? Send info to tips@BrianLivingston.com. He'll send you a book of high-tech secrets free if you're the first to submit a tip he prints.