d Smith, chief technology officer at the Privacy Foundation. The code makes it possible to track where a Word document goes when it leaves the author's hands. "A word-processing document can 'phone home,'" explained software analyst Richard Smith, chief technology officer at the Privacy Foundation. In theory the vulnerability would allow the author to find out when a document was passed from one reader to another, or sent outside of an organization's network. Smith said that although there is no known exploitation of the vulnerability, several likely uses exist. A company, for example, could plant code in documents that surreptitiously detects and tracks leaks of confidential documents. Or a copyright holder might use the feature to track possible copyright infringement of newsletters and reports. The problem affects Mac and PC versions of Microsoft Word 97 and all subsequent versions, in addition to other applications. Smith said the bug affects any application capable of displaying HTML-based content. The same issue, for example, has emerged in the use of HTML-enhanced programs such as Netscape Mail, Eudora, and Microsoft Outlook, which can notify a server when a user opens a message containing a Web bug. Web bugs don't require the use of cookies. They only need code that tells the document to access an invisible graphic file on a remote server, Smith said. Accessing the graphic file is all that's needed to enable document tracking. The logs on the server that delivered the graphic would then indicate that a computer with a particular IP address had accessed the document in question. At the present time there is no is no method of removing Web bugs from HTML pages. The reason for this is that there is no method of distinguishing Web bugs from “spacer GIFs” which are used on Web pages for alignment purposes. DoubleClick Case StudyThe information practices of DoubleClick, the leading Internet advertising firm, ha...
