Feeds

MS ID number system could track all Windows users

Redmond knows all about you - but it's not going to abuse the data, honest...

  • alert
  • submit to reddit

Gartner critical capabilities for enterprise endpoint backup

Earlier this year the built-in serial numbers in Intel's Pentium III caused a privacy storm. But now a software company has revealed that Microsoft has been running a rather more effective identification system since the launch of Windows 98. So Redmond knows a lot more about you than you might have thought. The point about the Intel system is that it could be used to track personal data relating to PC users, but the Microsoft system is apparently doing so already, and has the potential to operate as a digital fingerprint that tracks where you go, and the documents you produce, anywhere on the Internet. Robert Smith, president of development tools company Phar Lap, last week pointed out that the Windows 98 registration wizard, which is used to register for support and updates, does cute things in addition to just sending Microsoft the Windows 98 registration number. This number, known as a Globally Unique Identifier, is sent to Microsoft along with name, address, phone number, plus demographic details and information on the hardware and software being used. Note that with the progressive tightening-up of Microsoft's registration procedures it is becoming more and more difficult to get support from the company, or to get software updates, without registering, so Microsoft is going to acquire more and more of this data. In the Windows 98 install procedure, users are not told that all this data is being sent, but Smith says that the data Microsoft is gathering is being used to build a database of Windows users globally. From what Smith says, it would also seem that Microsoft has been doing a pretty through job of 'integrating' the number into a user's entire installation. Aside from being linked to the user's name, it also appears in files the user has created, so Microsoft's database could be used to track both users and the documents they produce across the Internet. Microsoft denies that it ever intended to use the data it's gathered for marketing, but as the Windows 98 registration wizard clearly says that the data will be used by Microsoft and its affiliated companies, and the usual check box asking if you mind being sent information is there, this is obvious nonsense. Users do have the ability to decline to send inventory information during registration, but they clearly can't do much about identification numbers embedded in the data files they produce. Microsoft may change the registration wizard in the next Windows 98 service pack (which may be a while yet), but may also (probably depending on the level of the privacy firestorm) produce a utility that will delete the information from the local machine's registry. The company also apparently intends to delete information already collected from its database, but it's not clear what this information consists of. Probably it will be data on users and their machine configurations which have been acquired as part of the online support and update processes. Microsoft's own privacy policy provides some information on what this data consists of: "When you buy and install a new product, we ask you to register your purchase," it says. "We then merge your registration information with any information you've already left with us (we call that information your personal profile). If you haven't previously registered with us, we create a personal profile for you from your registration information." This information is available at the Personal Information Center" on the Microsoft site. But here's the bit that makes you wonder why everybody got worried about Intel without noticing Microsoft: "In creating a new profile or updating an existing one, we obtain your hardware identification number from the registry on your computer's hard drive. If you have already registered, we also obtain the personal identification number you were assigned … We then send a small bit of code back to your hard drive. This code is uniquely yours and only includes your registration information. It is your passport to seamless travel across microsoft.com, allowing you to download free software, order free newsletters and visit premium sites without having to fill out another registration form. Even if you switch computers, you won't have to re-register." There - so it's all supposed to make it easy for you, right? Microsoft may however find itself having to clean up its act sooner rather than later. The US and the EU remain locked in negotiation over how to tackle EU privacy regulations which restrict the export of personal data. If a solution is arrived at, US companies holding data on EU citizens will have to adhere to some sort of mutually agreed code of conduct. One might observe that a company that gives the impression of neither knowing what data it has nor why it acquired it will have a bit of difficulty passing the tests. ®

The essential guide to IT transformation

More from The Register

next story
Assange™: Hey world, I'M STILL HERE, ignore that Snowden guy
Press conference: ME ME ME ME ME ME ME (cont'd pg 94)
Premier League wants to PURGE ALL FOOTIE GIFs from social media
Not paying Murdoch? You're gonna get a right LEGALLING - thanks to automated software
Caught red-handed: UK cops, PCSOs, specials behaving badly… on social media
No Mr Fuzz, don't ask a crime victim to be your pal on Facebook
Ballmer quits Microsoft board to spend more time with his b-balls
From Clippy to Clippers: Hi, I see you're running an NBA team now ...
Online tat bazaar eBay coughs to YET ANOTHER outage
Web-based flea market struck dumb by size and scale of fail
Amazon takes swipe at PayPal, Square with card reader for mobes
Etailer plans to undercut rivals with low transaction fee offer
Call of Duty daddy considers launching own movie studio
Activision Blizzard might like quality control of a CoD film
US regulators OK sale of IBM's x86 server biz to Lenovo
Now all that remains is for gov't offices to ban the boxes
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.