Microsoft Can Still Track Your Browsing History, Even with VPN
Virtual Private Networks (VPNs) are designed to protect your online activity from various entities like internet service providers or potential hackers. However, if you’re using a VPN on a Windows PC, there’s something you should know: Microsoft has the ability to access your browsing data, and, yes, they can report it to the FBI.
A recent court case disclosed on July 1 details involving a 19-year-old who was part of a hacking group named Scattered Spider. This individual managed to breach the systems of a luxury jewelry store, stealing sensitive company data and demanding a ransom of $8 million in cryptocurrency. In the end, the jewelry store managed to boot the hacker from their system without paying, leading to his arrest.
It’s a clear case of conspiracy, digital intrusion, and fraud, but it’s not straightforward. The sneaky bit? The hacker believed his identity was protected from law enforcement.
Reports suggest that the hacker utilized a Windows PC to infiltrate the store’s system and had installed a VPN to mask his IP address and identity. While the VPN did its job, it wasn’t enough to keep him under the radar from the FBI. Ironically, it was the operating system itself that revealed his activities, specifically a lesser-known identifier called the Global Device Identifier (GDID).
Understanding GDID
Every Windows installation gets assigned a GDID. Up until now, there hasn’t been much clarity around what this identifier can do, and even now, it’s not comprehensively understood. Yet, because of this incident, we can draw some conclusions.
What GDID can do: It can monitor and log the browsing history on the device it’s linked to, regardless of whether a VPN is active. This data accumulates over time and can’t be erased, even if you wipe or reinstall Windows.
What GDID cannot do: It doesn’t track what users see or read on websites—they couldn’t pinpoint specifics. However, simply visiting certain URLs might be sufficient to provoke legal action, as evidenced by this case.
Implications for Everyday Users
For those engaging in dubious online activities, GDID presents yet another tool for the FBI in capturing cybercriminals, especially in a world increasingly beset by digital threats and security breaches. With our digital landscape being targeted more than ever, the authorities need all the resources they can muster.
But what about the average person?
The fact that Windows includes built-in tracking mechanisms for browsing activity is unsettling, to say the least. It raises significant concerns about privacy, and how this could relate to proposed age verification legislation being discussed in Congress.
Just consider the implications if states were to enact age restriction laws. Instead of fulfilling ID requirements, individuals might opt for a VPN to bypass restrictions, which could violate the new laws. A Windows PC might catch this activity and notify authorities, leading to unexpected consequences.
At that point, reverting back might not even be an option.
Is it Possible to Disable GDID?
This would typically be the moment I’d present you with a helpful solution to safeguard your rights in this tech landscape. Unfortunately, there’s not much that can be done regarding GDID.
It’s incorporated directly within Windows; whether you log in via a Microsoft account or a local account, it remains. Once assigned, it is permanent and remains linked to you and your computer throughout its lifespan. Even when you transition to another Windows PC, that next GDID will tag along too.
Essentially, the only way to avoid this issue entirely would be to switch to a different operating system.
