Microsoft's 'Global Device ID' Ties Teen to Hacking Ring, Raising Surveillance Alarms

The arrest of a 19-year-old alleged member of the hacking group Scattered Spider has revealed that Microsoft can link a Windows PC's online activity to its user through a secret identifier, raising new privacy concerns. According to PCMag, the FBI used a Microsoft device identifier, dubbed GDID, to connect teenager Peter Stokes to the hack, an approach that "raised privacy red flags about Windows' surveillance capabilities." The case, detailed in an unsealed criminal complaint, marks the first public use of the Global Device ID in a law enforcement investigation.

PCMagA Hacker's Arrest Reveals Microsoft Can Track Users Via a Windows Device ID

"raised privacy red flags about Windows' surveillance capabilities."

PCMag's report highlights that the GDID appears to have no easy opt-out, meaning Microsoft can track a device across the internet without user awareness or consent. This identifier is built into Windows and is distinct from typical advertising IDs, potentially allowing the company to monitor a wide range of device activity.

"the GDID appears to have no easy opt-out mechanism for users, potentially allowing Microsoft to track devices across the internet."

Hacker News noted that the FBI leveraged this identifier to link Stokes to the crimes attributed to Scattered Spider, a group known for high-profile cyberattacks. The case has sparked debate about the balance between law enforcement tools and user privacy, especially given Microsoft's dominant market share in operating systems.

While the arrest of Stokes is a win for authorities, the revelation that Microsoft can silently assign and share a persistent device ID with law enforcement has alarmed privacy advocates. As PCMag and Hacker News both underscore, the existence of the GDID raises fundamental questions about how much control users truly have over their own devices and data.