Microsoft knows your entire browser history — and it can send it to the FBI

Virtual Private Networks are meant to shield your browsing history from all manner of prying eyes, including your internet service provider, your workplace or school, and even potential hackers. If you use a VPN with your Windows PC, though, I have some bad news: Microsoft has a full record of your browsing habits, and it can even report your activity to the FBI.

According to court documents released on July 1, a 19-year-old young man working with the cyber criminal group known as Scattered Spider was caught hacking into a computer system belonging to a luxury jewelry store. While inside, the hacker stole company data and demanded $8 million in cryptocurrency for ransom. Ultimately, the jewelry store kicked the hacker out of its system without paying the ransom, and the perpetrator was later arrested and charged.

Every user is susceptible to unwarranted surveillance and government overreach.

It’s a simple case of conspiracy, digital intrusion, and fraud … but there’s a catch.

The hacker’s identity should have been hidden from the feds.

Reports indicate that the hacker used a Windows PC to access the jewelry store’s system. Before breaking in, he installed a VPN onto his device that was meant to conceal his IP address, location, and identity. The VPN worked as intended, but it still wasn’t enough to keep his activity from leaking to the FBI. Even with protections in place, Windows itself was the thing that outed him in the end, thanks to a little-known device identifier called Global Device Identifier, or GDID.

What is GDID?

Every installation of Windows is assigned a GDID. Up until recently, there wasn’t a lot of information on exactly what this identifier could do, and even now, details are scant. However, thanks to this case, we can make a few deductions.

GDID can track and keep a record of the web browsing history on the device that it’s assigned, even if a VPN is installed. This information is saved over time, and it can’t be erased or cleared, even if with a system wipe or reinstall of Windows.

GDID can’t see what a user did on the pages they visited. It doesn’t know what that person saw or read on the screen. However, simply visiting a certain URL may be enough to draw conclusions and bring legal charges, as was the case with the Scattered Spider hacker.

What does this mean for regular users?

For the criminally inclined, GDID is just another way for the FBI to serve justice in a world increasingly plagued by cyber criminals, AI-powered security threats, and system breaches. As more of our digital infrastructure comes under attack at the hands of quantum computing and other innovations we haven’t yet imagined, the feds will need all the help they can get to stop criminals in their tracks.

And for the rest of us?

RELATED: New malware is crippling Android phones, but not yours if you do this

Jutharat Pinpan/Getty Images

The revelation that Microsoft created Windows with browser-tracking spyware baked directly into the OS is neither shocking nor acceptable. A feature that can monitor a hacker’s browsing activity is a fatal flaw that makes every user susceptible to unwarranted surveillance and government overreach. This is especially egregious when you take into account what this could mean for something like the age-verification bills that are currently at Capitol Hill.

Imagine what would happen if states begin to pass age-restriction laws. Instead of turning over their IDs, citizens would use a VPN to access the internet by routing their connection to a nonrestrictive state — a clear violation of the new law. A Windows PC would detect this behavior, and it could inform the government of such an infraction, resulting in legal repercussions.

At that point, there’s no going back.

How to disable GDID

This is usually the part of the story where I try to deliver some good news — a solution to keep you, your devices, and your rights safe from Big Tech and/or the government. Unfortunately, there isn’t much that can be done here.

GDID is built directly into Windows. It is assigned to your device whether you use your Microsoft account to log in or you use a local account. It is also persistent, meaning that once assigned, it doesn’t change. That identifier is attached to your computer and you for the rest of its life, and when you get another Windows PC, the next identifier will follow you too.

The only way to avoid it is to choose a different PC platform altogether.