IM can cause a history of insecurity
Giri, an editor at Kmart shopping site BlueLight.com, noticed this firsthand recently during an IM exchange with a friend on Yahoo Messenger. Midway through the conversation, her friend showed her a trick that would let her archive all of her conversations through Yahoo, a feature that troubled her.
"He recreated or retrieved an old conversation that we had," Giri said. "On one hand, it's fine if you're talking to a friend, which is funny. But on the other hand, the question we asked ourselves is, if this isn't private, there really aren't any places that are during business hours."
Instant messaging is just the latest tool to throw a spotlight on the Net's potential for taking private conversations public, an unsettling reality for some that raises far-reaching security and privacy concerns.
Making matters worse for Giri and millions of other IM users, there may be no way of knowing whether their exchanges are being recorded. That's because services such as Yahoo Messenger and AOL Time Warner's ICQ have begun offering message archive features that essentially allow one person to record a conversation without the other's consent.
It has always been possible to save am instant message conversation by cutting and pasting it into another document or performing a "save as" function. But the new tools make it much easier, and once turned on they start recording every word sent through the messaging program.
In Yahoo's case, the message archive feature was added in May when the company introduced a new version of the service. According to a Yahoo representative, the feature was added to let people manage their IM conversations in the same way e-mail is managed.
Yahoo Messenger users must turn on the archive. But people are not warned beforehand if the person they're chatting with has the archive turned on.
"As with any type of sensitive information, we stress to all our users that they use their best judgment when they're choosing their form of communication," said a Yahoo representative.
Instant messaging has become one of the most popular features on the Internet. Popularized by AOL Time Warner's America Online division, such services allow people to exchange text messages to each other in real time, melding the text communication of e-mail and the immediacy of the telephone.
Because of the nature of instant messaging, many people assume their conversations disappear after the IM window closes. But the addition of message archives on Yahoo Messenger and ICQ allows people to manage their conversations like they would an e-mail account. This makes some privacy advocates nervous.
"People are just getting around to the idea of how dangerous e-mail can be once it's archived," said Richard Smith, chief technology officer at the Privacy Foundation. "If we take IM, which is more casual than e-mail, it's a real danger when the conversation we're carrying with people gets carried away."
AOL's ICQ has had a message archiving feature since its inception. Unlike Yahoo, ICQ automatically logs conversations once someone signs on for the first time. However, ICQ users can choose to disable the logging on an individual or an overall basis. As with Yahoo, people are not alerted when someone logs their conversation.
AOL Instant Messenger and the instant messenger service in the AOL online service do not have any of these features. But both services allow people to save their IM windows as separate files.
In Microsoft's upcoming Windows Messenger service, a feature embedded in its planned Window XP operating system, people also can save their conversations as text files.
Whether these features are grounds for legal action remains questionable. So far, it's difficult to tell what laws they would violate, if any. Nonetheless, there have been incidents that have alerted people to express caution while using instant messaging.
In March, Sam Jain, the chief executive of Web start-up eFront, had hundreds of pages of his ICQ logs removed from his PC and posted on the Internet. The logs indicate that he knew ICQ was recording all his conversations.
The logs included embarrassing discussions regarding business partners, employees and affiliated Web sites. Legal experts, however, doubted the logs would be admissible in court should any of the subjects take legal action.
In addition, IM cases generally have not resulted in precedent-setting decisions.
If a party were to bring a case to court, alleging wrongdoing because the defendant didn't know the conversation was being recorded, the verdict could hinge on whether a judge thought instant messaging was similar to phone chat. In the United States, 12 states have laws requiring consent from both parties when recording a phone conversation. Federal law and the 38 other states require the consent of only one party when recording a phone conversation.
Privacy advocates maintain that it would take a savvy lawyer to make claims that conversations over instant messenger could violate wiretap laws. Some states, such as New York, do not require someone to ask permission before recording a phone conversation. Other states, such as Maryland, do require consent. The most famous case of this situation was the damaging audio tapes of former White House intern Monica Lewinsky's conversations with Linda Tripp. Tripp could have been prosecuted because she recorded her conversation without Lewinsky's consent.
Even though IM conversations often are conducted on the Internet and transmitted through phone lines, it's unclear whether laws applying to the phone can be applied to instant messaging.
"I don't think it's clear at all," said David Sobel, general counsel at the Electronic Privacy Information Center (EPIC). "The fact is that that laws that arose with the telephone have not kept pace with development of the Internet."
James Butler, co-chairman of the Internet practice group and a privacy expert at Atlanta-based technology law firm Morris Manning & Martin, would not address the Yahoo IM case in particular because the firm represents the Web portal. But he noted that the global nature of the Internet makes it tough to know where both IM parties are--so it's impossible to say which state laws will preside.
"I would think that, since it's difficult to know who you're talking to on the Internet generally, it would be difficult to figure out where people are when they're speaking," Butler said. "You'd have a potential problem as the recorder if you didn't have the permission of the other attendant...Unless you had a list in front of you of states and their regulations, and you knew where the person was, you'd need to disclose if you're taping."
For Giri, feeling safe online will not come in the form of laws or protective measures. It's a matter of friendship.
"There's still a trust factor there," she said. "You feel that with certain friends you know that they won't try to hurt you."
Hari Sreenivasan contributed to this report.