A feature within Windows that has drawn user criticism for its data-tracking capabilities, the Global Device Identifier (GDID), has reportedly been instrumental in the arrest of a suspected hacker. Peter Stokes, 19, allegedly a member of the Scattered Spider hacking group, was apprehended by US authorities. This group is believed to be responsible for over 100 network intrusions and more than $100 million in ransom payments.
One notable incident attributed to Scattered Spider involved a jewelry retailer. In May of last year, the group reportedly posed as employees and contacted the company's IT helpdesk, successfully obtaining password reset details. This access allowed them to compromise three accounts, for which they demanded $8 million. Although the retailer did not pay the ransom, the incident resulted in an estimated $2 million in costs.
Despite efforts to mask his online activity using a VPN and tunneling services, Stokes was allegedly identified through his Windows GDID. Law enforcement reportedly obtained a court order compelling Microsoft to provide data linking Stokes to a specific device. This evidence was then used by the US government to support his arrest.
Further complicating Stokes's situation were social media posts. According to reports, he shared photos of luxury hotels on Snapchat, allegedly showcasing wealth acquired through illicit means. A judgment detailing the case notes both the GDID link and these social media postings.
Upon his apprehension at an airport, Stokes was reportedly found carrying two hard drives containing evidence pertinent to the investigation. This physical evidence, combined with the digital trail from his device, appears to have solidified the case against him.
The use of GDID in this arrest, while leading to a positive outcome in stopping a potential cybercriminal, also raises privacy concerns. Privacy-focused service provider Proton has discussed "Windows as spyware," highlighting that while the system functioned as intended in this instance, the GDID's data collection prompts questions about user consent and ownership of hardware.
Proton points out that users do not explicitly agree to GDID's data collection practices. The feature is reportedly mentioned only once in Microsoft's extensive online documentation, buried within a technical document that is unlikely to be widely read. For users concerned about GDID and similar telemetry, switching to an alternative operating system like Linux has been suggested as a means to avoid such data tracking.