The arrest of a teenage hacker has revealed that Microsoft can track a Windows PC and its online activity through a 'Global Device ID' that seems to have no easy opt-out, sparking fears about potential surveillance. According to a Microsoft representative, a Global Device Identifier in the Windows ecosystem is a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device, either a physical device or virtual machine, across certain Microsoft services and scenarios. The global device ID isn't exactly surprising, given that it's standard practice to assign a unique ID to each account or device so a tech provider can recognize and distinguish between them. However, the complaint reveals Microsoft can associate the GDID with third-party services and the timing as well, giving Redmond a way to theoretically track a user's online activity.
In other words, Redmond might be able to track the online activity of your Windows PC without third-party browser cookies. Microsoft hasn't otherwise commented on the GDID publicly, but cybersecurity expert Matthew Hickey alleged in a tweet that 'Microsoft Windows is surveillance software.' The device ID is mentioned briefly on a support page, but it's not easy to reset the GDID on your own. 'A GDID remains consistent across Windows operating system updates on a device, but a reinstall of Windows, either on the same device or on a different device, will be tied to a new unique GDID,' the court document says. In a footnote, it adds, 'Thus, one Microsoft user could have multiple GDIDs.' Still, we suspect it wouldn’t be hard for Microsoft to tie a newly set GDID to the old one, since the company could look at other identifiers, such as a Microsoft account login or an IP address, and match them.
In response to the surveillance potential, some users have already been exploring ways to contain and scrub the GDID identifier. Meanwhile, cybersecurity researcher Costin Raiu is questioning whether other tech companies have the same surveillance capabilities, given the use of unique identifiers. 'I would also ask: how much of this is happening on Apple devices? Is it on the same scale?
Is it happening at an even higher level — do they tie it to the hardware, so that even if you reinstall, it doesn’t matter, because it’s hardware-based?' he said in the Three Buddy Problem podcast. 'Very likely it’s not unique to Microsoft.
