Windows is a surveillance software

A complaint against alleged Scattered Spider member Peter Stokes, revealed that Microsoft can correlate Windows activity with the “Global Device ID,” which researchers used to link his computer to his online activity.

While unique device identifiers are common, the case raises privacy concerns because that identifier can apparently persist across updates, and could allow Microsoft to link a Windows installation to activity on third-party services.

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

As we reported last week, the US announced it had extradited 19-year-old Peter Stokes for allegedly being a member of the notorious hacking group Scattered Spider. But this case stands out because Microsoft played a key role in connecting Stokes to the hacking crimes, according to the complaint. Stokes allegedly hacked a jewelry retailer in May 2025 using a VPN. The 39-page complaint shows that the FBI used Microsoft records to discover that his IP address was associated with a Microsoft device identifier known as a Global Device ID (GDID).

“According to a Microsoft spokesperson, a Global Device ID in the Windows ecosystem is a persistent device-level identifier designed to uniquely identify an installation of a Windows operating system on a device,” the complaint states.

A device's global identifier is not surprising, as it is common practice to assign a unique identifier to each account or device so that a technology provider can identify and distinguish them.

But the complaint reveals that Microsoft can associate GDID with third-party services, as well as time, giving Redmond a way to theoretically track a user's online activity. In other words, Redmond may be able to track your Windows PC's online activity without third-party cookies in your browser.

Stokes used a web development tool called ngrok to bypass the jewelry retailer’s network defenses. The complaint states that Microsoft had records showing that on May 12, 2025, at 19:21 UTC, the GDID associated with Stokes’ computer “accessed, among other pages, ‘https://dashboard[.]ngrok.com/signup’, the ngrok page to create an account.”

So, federal investigators used the Microsoft ID to arrest a suspected hacker, which raises concerns that it could be used for other surveillance purposes.

“Microsoft Windows is surveillance software,” cyber expert Matthew Hickey said in a tweet.

newsbot

Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.