Email itself is a remarkably simple and well-engineered part of the Internet, but often the content of the email is used to track you. Full end-to-end encryption does nothing to protect you from this. How is it done, and how can it be prevented?

Originally emails were simple text, but MIME emails were introduced to allow other types of data to be sent. What is common today is HTML or essentially the email is a webpage, with the possibility of images, audio, video, and script. This allows you to send a photo to a friend via email, or an organization to include their logo or product images.

There are two ways for an image to be sent, embedded or linked. When an image is embedded into the email, a copy of the image itself becomes part of the email. It is a single complete package. If the image is large, the email will be large as it contains the image.

An alternative is to put a link to the image in the email, so the email itself remains a modest size. When the recipient opens the email, the linked image is fetched from the Internet. There are numerous advantages to this in that the transmission and storage of the email is far less, and if the end user does not view the email or does not view the images, no data has to be sent.

An obvious disadvantage is if after receiving the email the recipient goes offline, the image is not available to be viewed.

While this sounds great, the reality is this is one of the most common and powerful tracking tools used on the Internet. It can be used by high-tech organizations as well as the novice. It does not require anything more than a simple web server.

A clear way to see the difference of a fairly benign linked image and a tracking one is to look at the source text of the email. Most email clients have a way to allow you to see this. There will be some form of a link with something like “src="http://ShofarNexus.com/Example_Image.jpg?123abc"”. In the example “123abc” is what uniquely identifies the email. The next email to you might link to the same image but have “456def”. Typically this data appears as a random string perhaps 100 characters long. The sending party can then determine which unique email was viewed by each unique recipient.

One of the ways you can overtly see that an organization is using embedded images to track you is if your email client software allows you not to download the images by default. The organization does not have the tracking data of your viewing their emails so they may send you an email stating: “We've noticed that you haven't opened your emails in a little while, and wanted to check in to make sure you're still interested in the work of…” Does this happen? Considering this is a direct quote, the answer should be clear.

Keep in mind this technique can be done by anyone, including you, when you have a basic web server to host the image.

What are some examples of the information you can collect using this technique?

• The time the image was downloaded. This probably means when the email was viewed. If the email is viewed multiple times, by setting the cache time to zero, each view will be noted.

• The IP address of the client. This may give the general or specific location of the client at the time of viewing.

• Sometimes the client’s operating system, version, or device model.

While this is far less than what your ISP or other data collection organizations obtain, it remains blatant overt monitoring of you by the sending party. It is clearly not done by accident but by intent. What is their intent?

Does this matter? Could it be used to my detriment?

• This could be simple marketing to know if you are interested.

• It could be to verify that you are reading or viewing required emails.

• Forwarding of the emails provides the sender with data to connect you with those you forward to. While this is vastly more effective when done by other data collection techniques, building a dataset of relationships is a vital tool for the overlords.

• Provocative or incriminating images could be sent to you and now there is record that you saw it.

Can this be stopped while still allowing me to see the images?

Yes

When the ShofarNexus email server receives an email with a linked image, it will directly or via a surrogate, download that image. Optionally it can be embedded into the email or made available at a link specific for the recipient.

What is then seen by the sender?

For example an email is sent to you from Seattle to your server in Uganda that arrives at midnight. The server in Uganda, or perhaps a surrogate in Argentina will obtain the linked image. From the perspective of the sender, you got the email at midnight in Uganda, and you also got the image in Uganda or Argentina almost immediately thereafter. There is the possibility of adding a random delay before fetching the image.

If you are in Texas at noon when you view your email, all is normal. If your client software gives you the option of not downloading the images, that works normally. When the image is actually downloaded at noon to your client, it is from your server and the sending party only knows the image was downloaded once at midnight.

Is this important?

What is happening to you ranges from fairly benign marketing techniques to blackmail. You could also be linked to organizations or ideas that may have an impact on family or business relations. It may also be a technique to validate that you are submissive to a particular group or ideology.

Fundamentally encryption gets the fanfare, but tracking is the way you are controlled. Closing the major and minor holes in the tracking process of you can be vital. This is the goal of ShofarNexus.