Mail-Lock falls into a new category of email protection software, which the vendor calls email personal information containment, or EPIC for short. The software is claimed to allow users to carefully control what recipients of email can do with the messages and certain types of attachments. It does this using encryption technology to limit the functions within Outlook, as well as the length of time a message can be viewed by the recipient. The time control element is, as far as we can determine, the package's unique function within the POP-3/SMTP environment.
This version of Mail-Lock is designed to function as an add-in for Microsoft Outlook in all its desktop Windows variants, protecting the text of the email, as well as MS-Word, Excel and Powerpoint attachments. If an attachment from another application is attached and sent, Mail-Lock cannot control what happens to the attachment at the recipient's PC: it will simply open as normal. The company is developing versions for Outlook Express and Lotus Notes users, but no timescales for the updated releases have been made.
A version of the software for ISPs to offer to their customers on a value-added basis to their internet subscription, is also in the pipeline, although the functionality is also reduced. This version ('Mail-Lock Lite') is also likely to be released as a standalone version for consumer users. For now, however, Mail-Lock is available in one flavor: designed for Outlook business users.
Programmed in Visual Basic, with some C++ add-ons, the software installs quite quickly. The supplied documentation is adequate, and there is a lot of informative material, including FAQs, available online. We tested the software with a Windows 98 variant of Microsoft Office 2000, running under XP Pro. We also installed the reader software under XP Pro, Windows 98 and an ageing, but trusty, Toshiba Libretto palmtop running a late edition of Windows 95. The reader installed on all the machines although, officially, Treasure Coast does not support Win 95/98-based systems because of the large number of editions in circulation for these platforms.
Treasure Coast says that it guarantees that Mail-Lock will run alongside Outlook 2000 Service Pack 1, which dates from 1999/2000, but our observations suggest the software is pretty flexible in what systems it will install on. Each licensed version of the package allows a user to send email using up to five distinct origin addresses on their machine. Recipients of email encoded with Mail-Lock must install a reader application from Treasure Coast's web site.
The reader software, which is free to download, is a fairly hefty seven megabytes in size. We would have liked to have seen Mail-Lock generate a reader application that could be sent alongside a protected message. The company said that the wide variety of Windows environments that Mail-Lock is designed to run on would have made the messages too large for dial-up recipients, as even with a simplified reader, for a single platform such as Windows XP, the attachment still would work out at around a megabyte.
Once installed, the software sits inside Microsoft Outlook, creating a 'Send with Mail-Lock' option alongside the usual send button for messages. Users can control what recipients of their emails can do with the software - the default setting is no forwarding or copying, or printing, of the message itself, or its attachment. It is possible to set the software up so that recipients of the email could, for example, forward and copy, but not print, the message itself, and then do the reverse (i.e. enable print, but not forward and copy) for the attachment.
The final controlling parameter is for how long the recipient of the email can view and carry out other controlled functions with the message. The protection system on Mail-Lock is 128-bit triple-DES, which is all but uncrackable for most purposes.
So who would use this software? Treasure Coast is pitching the package at the legal, financial, medical, human resources and government agency users. In a typical sales scenario, the software could be used to create a sales quote for a given project, which expires after, say, 30 days, and with an attachment which cannot be forwarded or printed out.
Can Mail-Lock be beaten? The simple answer to this is yes - with a screen grab utility that uses programmable keys. Mail-Lock has locked down most of the standard keys, but it is possible to screengrab images of the messages and/or files. Oh, and in case you were wondering, dropping to DOS (or the command prompt) won't allow you to view protected emails.
Certain features of Mail-Lock are seen in Windows Server 2003 and Office 2003, but the administration of Microsoft's information rights management (IRM) system is complex. Mail-Lock does more, for less money, and is designed for most business users.
Overall, we were impressed with Mail-Lock. Within the operating system and software parameters the software is designed for, it performs perfectly. Like all security systems, with enough time and effort, it can be beaten, but for most company users, it works well. We also suspect that, as the software is updated, the number of methods by which its security functionality can be by-passed will be greatly reduced.