If You BBC Someone on an Email, Can Other Recipients Find Out?

Email systems are designed to keep BCC recipients hidden, but mistakes -- and attacks -- can happen. Learn about CCing, BCCing, etiquette, and email security in this episode of BrainStuff.

Learn more about your ad-choices at https://www.iheartpodcastnetwork.com

See omnystudio.com/listener for privacy information.

Episode Transcript

Speaker 1 (00:01):
Welcome to brain Stuff, a production of iHeart Radio, Hey
brain Stuff, Lauren vog Obam. Here. Your typical email program
has several options to simultaneously message more than one person.
You can load up the two box with many recipients
and then blast away. Or you can put some or
one in the two spot and then see ce the

(00:23):
rest or b C C some or all. That b
C C might be the trickiest, as it means that
not everyone is privy to the same information, and it
has some of the biggest risk for pitfalls. So when
do you CEE CEE and when do you b C C?
First the basics, the C C field probably stands for

(00:44):
carbon copy and the b c C field stands for
blind carbon copy. The carbon copies were common prior to
email communication, and even more so prior to photo copying.
In those days, if you wanted to distribute copies of
a typed or handwritten document, you might writer type them
on stacks of thin sheets of paper with a piece
of pigmented carbon paper sandwiched between each sheet. The pressure

(01:08):
of writing or typing on the top sheet of paper
would transfer pigment from the carbon paper to the blank
sheet underneath. Creating a carbon copy of the inked original.
You can still find carbon copies in some memo pads
or similar technology in more modern checkbooks and restaurants server pads.
But these days, an email CC means you sent a

(01:29):
copy of a message to someone other than the direct
recipient in the two line. It's an easy way to
keep vested parties in the loop on a subject. Notably,
the CC format allows everyone to see each other's email
addresses as well. BCC works the same way as CC,
except the direct recipient in the two line doesn't know

(01:50):
that anyone was BC seed on the message. So, for example,
if you emailed the subordinate at work about being late
with the project and bcced your own boss to show
them that you were being diligent about tardiness, your subordinate
wouldn't know that their lateness was being pointed out to
your own superior. If that sounds a little secretive or tattily,

(02:11):
it can be. BCCs usage can be loaded with etiquette
pitfalls and potential backlash. It might be perfectly innocent. Let's say,
if you're asking a question to a large group but
don't want to burden the entire group with receiving every
single person's answer. Just BCC everyone, But if you're purposefully
hiding the fact that there are other recipients, it can

(02:32):
be trouble. BCC is a notorious office space landmine, particularly
if a secret person who's blind copied doesn't just reply
to you, but accidentally hits reply all. Their reply will
go both to you and the messages direct recipient. Now, whoops.
One of many reasons to be careful about reply all.

(02:55):
But still, there are some very good reasons to use BCC.
Maybe a year supervisor of various contractor freelance workers who
never interact with each other, and you want to update
them all on policy changes without having to send individual emails.
This isn't just a matter of convenience for you. It
also protects the privacy of your freelancers who probably don't

(03:15):
want a bunch of virtual strangers to see their personal
email address. Or maybe your company trying to contact many
customers about an important issue. You absolutely have to use BCC.
Otherwise hundreds or thousands of people will suddenly see private
email addresses. That's a major breach of trust. But is
there a way for recipients to find out who was

(03:36):
BCC on a message. We spoke via email with Shared
de Grippo, Senior director of Threat Research and Detection for
Proofpoint Email. She said, generally recipients can't see if someone
has been blind copied on a message. Servers that receive
messages are designed to strip out BCC information before they
pass the message on to the recipient. This is the

(03:58):
case for all recipients, including those in the two c
C and BCC lines. The most common way for someone
to figure out blind copied email addresses is when the
sender accidentally puts people meant to be in the BCC
line in the CC line. However, she notes that threat
actors or packers have found ways to attack the privacy

(04:19):
of BCC. One would be to access the target's inbox
in one way or another and then simply look in
the scent items to find out who was sent a
BCC message. Or if your device is infected with data
stealing malware, an attacker could access messages in the scent folder,
the Crippo said. Another opportunity for compromise occurs when an

(04:40):
attacker intercepts the sender's network traffic while the email is sent,
and they see all recipients, including those blind copied, and
she explained that this kind of thing happens frequently when
someone is using public unencrypted WiFi and an attacker taps
into the WiFi network traffic. And finally, quote if an
attacker has compromised the emails rivers of the sender or

(05:01):
any of the recipients, or intercepts the network traffic between
these servers, they can also see all recipients. In other words,
BCC is anything but impenetrable, so if you're a spy
training in state secrets, you've been warned to protect yourself
when using BCC, you can take a number of steps.
The first and most obvious is to double check your

(05:22):
recipients before you send any BCC messages, just to be
absolutely sure you're using BCC and not CC. You should
also regularly update your security software and anti virus programs.
That way, your device will be guarded against current threats,
the Grippo said. Be sure to also safeguard your email
accounts with strong passwords and multi factor authentication whenever possible.

(05:46):
It's important to avoid using un encrypted public WiFi networks,
and if you must use them, be sure to use
a virtual private network or VPN that will encrypt and
protect your information. Today's episode was written by Nathan Chandler
and produced by Tyler Clang. For more on this and
lots of other technological topics, visit how stuffworks dot com.

(06:08):
Brain Stuff is production of my heart Radio. For more
podcasts for my heart Radio, visit the I heart Radio app,
Apple Podcasts, or wherever you listen to your favorite shows.