Detecting remote operation of a computer by another computer by receiving pointing device movement event information associated with multiple pointing device movement events in a sequence of pointing device movement events detected at a first computer, determining a frequency of the pointing device movement events from the pointing device movement event information, and determining that the frequency is consistent with a frequency of pointing device movement events that are sent to the first computer, thereby detecting that the first computer is operated by a computer other than the first computer.