PC Probe: What’s Windows collecting now?
Microsoft’s decision to come clean over data harvesting raises more questions than answers.
The Windows 10 Creators Update has landed, but many are still wondering how “creative” Microsoft is being with the way it handles users’ data. At launch, Windows 10 was widely criticised over the telemetry Microsoft collects to monitor performance on end user machines and improve resilience. Telemetry reports are nothing new, but were opt-in prior to Windows 10 giving Microsoft access to such records.
Once it became obligatory, critics complained there was no clarity over how much personal data, on top of system data, Windows 10 sent to Redmond, and no way to opt out.
Windows 10 gave users some choice on what they shared with Microsoft, but critics argued the default settings and information on start-up were vague. In addition, the default “Express” setup glossed over the implications of the settings.
With the Creators Update, Microsoft has finally addressed some of the concerns of privacy campaigners – not least by listing in excruciating detail what material will be harvested. “We’re thrilled Microsoft has decided to be so transparent with the details,” the Electronic Frontier Foundation told PC Pro in a statement. However, the organisation stopped short of praising the changes, saying it would take its experts “several weeks” to plough through the intricacies of the telemetry.
Privacy levels
As well as providing more detail on what it collects, Microsoft has introduced new privacy tools, although none of the options provide a total lockdown and non-enterprise customers get less choice about how they guard their data.
Consumers can choose “Basic” or “Full” telemetry, which would allow Microsoft to access all the data categories listed left ( see “What telemetry collects”), although there is now a privacy options settings page that can be adjusted.
“There are only five settings under the Windows GUI and they are extremely general,” said Jim Harrison, director of sales for O&O Software, which provides privacy products, including ShutUp10 that restricts Windows 10 telemetry data. “They cover Location, Diagnostics, Relevant Ads, Speech Recognition and Tailored experiences, with diagnostic data.”
Harrison claimed more detailed fine tuning is possible with add-ons, even if the tools are not available within Windows itself. “We list all the settings available (now approaching 100 in total) so you see just how general the five settings within Windows are,” he said. “The tools explain the settings in detail, and give the average consumer the power to control them and set them to ‘Secure’ levels.”
Only enterprise customers, who may need to guarantee data privacy to their own clients, would be able to use the “Secure” telemetry setting that turns off data collection for all but the most important security update information.
With the Creators Update, Microsoft has finally addressed some of the concerns of privacy campaigners
The full monty
Harrison said customers should be wary of handing Windows 10 permission to suck up all their telemetry. “The data collected in the ‘Full’ setting is the most worrying,” he
said, adding that the contents of documents and sensitive data could be transmitted in crash dumps. According to Harrison, if a Microsoft engineer wants access to a certain system or user, a governance team must approve the request, but the engineer can use multiple capabilities to get the information. “They would have the ability to run a limited, pre-approved list of Microsoft certified diagnostic tools, such as MSINFO32.EXE, POWERCFG.
EXE, and DXDIAG.EXE,” he said. “And Microsoft would have the ability to get registry keys. All crash dump types, including heap dumps and full dumps.”
Microsoft denies that it’s doing anything untoward. “Microsoft uses a number of privacy-protecting practices to ensure that only the necessary and relevant data are collected to analyse any needed device adjustments,” the company told PC Pro. “These practices include limiting access to diagnostic data including crash dumps, reviewing and approving the types of data that can be collected, avoiding unnecessary collection of user-generated content and conducting privacy reviews of our diagnostics and troubleshooting processes.”
Opting out – not an option
Microsoft also claims it needs the telemetry data to run its update service, and the company has said that giving users the ability to turn off Basic telemetry would weaken their security because they wouldn’t receive the latest patches.
Privacy advocates aren’t buying that. “This is a false choice that is entirely of Microsoft’s own creation,” said the Electronic Frontier Foundation’s analyst Amul Kalia.
“There’s no good reason why the types of data Microsoft collects at each telemetry level couldn’t be adjusted, so that even at the lowest level of telemetry collection users could still benefit from Windows Update and secure their machines from vulnerabilities, without having to send back things such as app usage data or unique IDs like an IMEI number.”
Lack of consent
Despite Microsoft’s improvements, there is concern among watchdogs that there’s no option to turn off telemetry entirely. European privacy groups – including the Working Party of 29 information commissioners from European states – don’t believe Microsoft’s changes go far enough.
The group claims the wording of the notifications isn’t clear and that the details about what is being collected aren’t specific enough. “Even considering the changes to Windows 10, the Working Party remains concerned about the level of protection of users’ personal data,” it said.
“Microsoft should clearly explain what kinds of personal data are processed for what purposes. Without such information, consent cannot be informed, and therefore, not valid.”