Feeds

MS ID number system could track all Windows users

Redmond knows all about you - but it's not going to abuse the data, honest...

  • alert
  • submit to reddit

Security and trust: The backbone of doing business over the internet

Earlier this year the built-in serial numbers in Intel's Pentium III caused a privacy storm. But now a software company has revealed that Microsoft has been running a rather more effective identification system since the launch of Windows 98. So Redmond knows a lot more about you than you might have thought. The point about the Intel system is that it could be used to track personal data relating to PC users, but the Microsoft system is apparently doing so already, and has the potential to operate as a digital fingerprint that tracks where you go, and the documents you produce, anywhere on the Internet. Robert Smith, president of development tools company Phar Lap, last week pointed out that the Windows 98 registration wizard, which is used to register for support and updates, does cute things in addition to just sending Microsoft the Windows 98 registration number. This number, known as a Globally Unique Identifier, is sent to Microsoft along with name, address, phone number, plus demographic details and information on the hardware and software being used. Note that with the progressive tightening-up of Microsoft's registration procedures it is becoming more and more difficult to get support from the company, or to get software updates, without registering, so Microsoft is going to acquire more and more of this data. In the Windows 98 install procedure, users are not told that all this data is being sent, but Smith says that the data Microsoft is gathering is being used to build a database of Windows users globally. From what Smith says, it would also seem that Microsoft has been doing a pretty through job of 'integrating' the number into a user's entire installation. Aside from being linked to the user's name, it also appears in files the user has created, so Microsoft's database could be used to track both users and the documents they produce across the Internet. Microsoft denies that it ever intended to use the data it's gathered for marketing, but as the Windows 98 registration wizard clearly says that the data will be used by Microsoft and its affiliated companies, and the usual check box asking if you mind being sent information is there, this is obvious nonsense. Users do have the ability to decline to send inventory information during registration, but they clearly can't do much about identification numbers embedded in the data files they produce. Microsoft may change the registration wizard in the next Windows 98 service pack (which may be a while yet), but may also (probably depending on the level of the privacy firestorm) produce a utility that will delete the information from the local machine's registry. The company also apparently intends to delete information already collected from its database, but it's not clear what this information consists of. Probably it will be data on users and their machine configurations which have been acquired as part of the online support and update processes. Microsoft's own privacy policy provides some information on what this data consists of: "When you buy and install a new product, we ask you to register your purchase," it says. "We then merge your registration information with any information you've already left with us (we call that information your personal profile). If you haven't previously registered with us, we create a personal profile for you from your registration information." This information is available at the Personal Information Center" on the Microsoft site. But here's the bit that makes you wonder why everybody got worried about Intel without noticing Microsoft: "In creating a new profile or updating an existing one, we obtain your hardware identification number from the registry on your computer's hard drive. If you have already registered, we also obtain the personal identification number you were assigned … We then send a small bit of code back to your hard drive. This code is uniquely yours and only includes your registration information. It is your passport to seamless travel across microsoft.com, allowing you to download free software, order free newsletters and visit premium sites without having to fill out another registration form. Even if you switch computers, you won't have to re-register." There - so it's all supposed to make it easy for you, right? Microsoft may however find itself having to clean up its act sooner rather than later. The US and the EU remain locked in negotiation over how to tackle EU privacy regulations which restrict the export of personal data. If a solution is arrived at, US companies holding data on EU citizens will have to adhere to some sort of mutually agreed code of conduct. One might observe that a company that gives the impression of neither knowing what data it has nor why it acquired it will have a bit of difficulty passing the tests. ®

New hybrid storage solutions

More from The Register

next story
JINGS! Microsoft Bing called Scots indyref RIGHT!
Redmond sporran metrics get one in the ten ring
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Found inside ISIS terror chap's laptop: CELINE DION tunes
REPORT: Stash of terrorist material found in Syria Dell box
OECD lashes out at tax avoiding globocorps' location-flipping antics
You hear that, Amazon, Google, Microsoft et al?
Show us your Five-Eyes SECRETS says Privacy International
Refusal to disclose GCHQ canteen menus and prices triggers Euro Human Rights Court action
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.