A recently released criminal complaint against Peter Stokes, an alleged member of the Scattered Spider cybercrime group, reveals previously unpublicized details about Windows telemetry.
Microsoft has never exactly had a reputation for being privacy-focused, however the complaint reveals the important part played by Microsoft’s Global Device Identifier (GDID), a persistent identifier tied to a Windows installation, in the case.
GDID enabled investigators to correlate the suspect’s Windows installation with ngrok signup activity and other telemetry. But security experts and lawyers tell CSO that GDID was only one piece of evidence in a broader correlation chain involving provider records, IP history, and other account logs that helped investigators identify Stokes as a suspect in a May 2025 attack on a luxury jewelry retailer.
“Microsoft wasn’t watching ngrok; it was watching the device, and investigators connected the dots,” says Dray Agha, senior manager of security operations at managed detection and response firm Huntress.
Still, the indictment stirred many questions from the broader technology community and privacy advocates regarding Microsoft’s data collection practices around the little-known and scantly documented GDID.
GDID: Link in a chain of evidence or smoking gun?
GDID is a unique identifier that is automatically assigned and linked to a single Windows installation and remains consistent across Windows updates, although reinstalling Windows creates a new GDID. The ID is sent to Microsoft servers as part of telemetry capture for various Microsoft-related services and apps, some of which are bundled within Windows.
According to the indictment, Microsoft records showed that the Windows device linked to Stokes’ GDID visited a signup page for ngrok, a service used to securely expose local development servers to the internet. The records also reportedly showed that the Windows device associated with Stokes’ GDID accessed websites through Tzulo proxy servers and later visited the victim company’s website.
The details of this activity reportedly collected by Microsoft and linked to Stokes’ Windows device raised significant concerns among Windows users and the data privacy community alike.
But as Benson Varghese, a board-certified criminal lawyer at US law firm Varghese Summersett, notes, the criminal complaint is a probable-cause document rather than a technical audit trail.
“The phrase ‘Microsoft records’ may compress several different data sources into one sentence,” Varghese tells CSO. “It does not necessarily mean Windows itself was logging every website visited in every browser, but it does suggest investigators obtained records tied to a persistent device identifier and then linked that identifier to activity involving third-party services.”
Everett Lupton, a criminal attorney at US law firm Slaughter & Lupton, also notes the technically ambiguous nature of the indictment.
“The criminal complaint, however, does not provide enough technical detail to explain exactly how these records were generated or which Microsoft product collected them,” Lupton tells CSO. “It is unclear whether Microsoft captured the full web addresses through Edge, Microsoft Defender SmartScreen, another security service, or another Microsoft product.”
Lupton continues: “It is also possible that Microsoft did not hold a complete browsing history. Investigators could instead have correlated Microsoft device, timestamp, and IP records with separate records obtained from ngrok and Tzulo. This is not clear from the wording of the complaint.”
If the records came from Edge, SmartScreen, Defender, Microsoft account services, crash reporting, or another Microsoft component, the privacy and legal implications raised around GDID change from persistent retention of activity associated with an individual user to those that arise from correlating disparate sources of information.
“If Microsoft merely had timestamps, IP addresses, device identifiers, or security telemetry that prosecutors later correlated with ngrok and Tzulo logs, that is different from Microsoft retaining browsing history,” according to Varghese. “The complaint language is too thin to answer that confidently.”
As far as Huntress’ Agha can tell, investigators “likely correlated subpoenaed access logs from ngrok and Tzulo with standard Windows telemetry.”
“The indictment makes it sound like one neat database, but in reality, investigators stitched disparate data sources together after the fact,” he says.
Privacy has its limits
The case highlights the privacy limitations of privacy-enhancing technologies such as virtual private networks (VPNs) and Tor, which serve to hide the source and destination of internet traffic through the use of proxies and relays.
“Tools like Tor and VPNs mask IP addresses, but persistent identifiers like the GDID are baked into the OS itself,” Agha explains. “If a device routinely ‘phones home’ to Microsoft for updates or syncing while connected to a proxy, it broadcasts its unique ID from that masked IP.”
Agha adds: “This effectively tags the proxy with a known device, stripping away the anonymity the privacy tool was supposed to provide; operational security often stops at the network layer.”
Varghese adds: “This case shows why endpoint telemetry is often more valuable to investigators than network logs. If data was collected before anyone knew the suspect’s name, privacy tools used later may not matter much.”
Catching a Scattered Spider suspect is a clear win for law enforcement but it reveals that every standard Windows user is generating a similarly durable, searchable record long before anyone is a suspect.
“The fact that a persistent device ID can be queried by law enforcement to unmask users raises legitimate, under-discussed questions about Microsoft’s data retention periods, the lack of a clear opt-out for the GDID, and the broader privacy implications for everyday users,” Agha concludes.
Technology companies may be required to provide account and device records when served with valid subpoenas, warrants, or court orders. “However, users may still be surprised that a single persistent identifier can help link activity across different IP addresses and services,” Lupton concludes.
The broader privacy issue is transparency.
“People should be clearly told when persistent device identifiers are being used, what activities may be linked to them, how long the data is retained, and how they can reduce the collection of such information,” according to Lupton. “The fact that these records may help investigate serious crime does not eliminate the need for meaningful privacy protections and proper legal oversight.”
No Responses