Microsoft reaffirms privacy

http://arstechnica.com/information-technology/2015/09/microsoft-reaffirms-privacy-commitment-but-windows-will-keep-collecting-data/

The privacy implications of Windows 10 and its data collection have been
a talking point since the operating system was released. And today,
Microsoft published a response of sorts.

For the most part, the new blog post reiterates the company's (lengthy)
privacy policy. Terry Myerson, leader of the Windows and Devices Group,
describes three classes of data and describes Microsoft's approach to each.

First is the safety and reliability telemetry data, information about
system and application crashes. Myerson says that this information
should be anonymous; most of it has no personal information at all, and
to the extent that personal information might be included (disclosed in,
for example, file and directory names or fragments of memory included in
crash reports), Microsoft tries to scrub all data that it receives.

The post also loosely describes why this information is useful: a third
party graphics driver was recently found to be causing crashes. The
telemetry data let Microsoft know that the crash was occurring and which
driver was at fault, and it gave some hints as to what the bug was.
Within 24 hours of finding the bug, a fix was rolled out to members of
the Windows Insider program. Another 24 hours later and the fix was
rolled out to all affected Windows users.

One of the major complaints about this telemetry data is that, unlike
prior versions of the operating system where it was optional, most
Windows users can't opt out in Windows 10. The Enterprise version allows
crash telemetry to be disabled entirely. The mainstream Home and Pro
versions, however, do not. Myerson's post is a little unclear on this
point. He writes, "Our enterprise feature updates later this year will
enable enterprise customers the option to disable this telemetry, but we
strongly recommend against this."

We asked Microsoft what exactly this means, and the company said simply
that the option to disable telemetry in the Enterprise edition will
continue to exist. The ability to disable is not actually part of the
feature update coming later in the year.

The second category is personalization data, the things Windows—and
especially Cortana—knows regarding what your handwriting looks like,
what your voice sounds like, which sports teams you follow, and so on.
Nothing is changing here. Microsoft says that users are in control, but
our own testing suggests that the situation is murkier. Even when set to
use the most private settings, there is unexpected communication between
Windows 10 and Microsoft. We continue to advocate settings that are both
clearer and stricter in their effect.


Enlarge / We found that some identifying data gets sent to Microsoft
when you open the Start menu even when you opt out of using Cortana,
Bing search, and related features.
Finally, Microsoft says that it doesn't use any personal data from
e-mails or files to drive advertising. Left unspoken is the possibility
that information from, for example, Cortana or store purchases or Bing
searches all be used to target ads. This is clearly a jab at Google—it
brings to mind the company's (thankfully abandoned) Scroogled campaign,
which focused on Google's use of e-mail contents to target Gmail
advertising. There's nothing new here and nothing that's likely to
convince those concerned about Windows 10's privacy. Two classes of data
are excluded—communications (including e-mail and Skype) and file
contents—but everything else appears to be fair game for ad targeting.
So while Cortana can't use your e-mail to tailor ads to your interests,
it appears that she could use the appointments in your calendar to do
so, for example.

In other words, the Windows 10 privacy situation is what Microsoft has
always said it was. It collects a bunch of data, and while that data
collection is generally justifiable—though not every Windows users will
want every data-driven feature—opt-outs aren't always available, and
it's not always clear how that data is actually used.

Nonetheless, there is a little progress. Windows has contained parental
control features since Windows Vista. Accounts designated as being child
accounts can be restricted and monitored in various ways, barring access
to certain programs or certain kinds of website, for example. One
feature that caused some complaints is that parents can receive weekly
reports on their children's Internet activity. In response to this kind
of feedback, including the feedback in the built-in app, Microsoft will
be changing the parental monitoring feature to use "default settings
designed to be more appropriate for teenagers, compared to younger
children," and it is "working on ways to further enhance the
notifications that kids and parents get about activity reporting in
Windows."

Myerson's concluding paragraphs are also notable, as they appear to
elevate privacy concerns to have a comparable significance to security
issues. He writes, "Like security, we are committed to following up on
all reported issues, continuously probe our software with leading edge
techniques, and proactively update supported devices with necessary
updates." There's also a process for reporting privacy issues. If this
means that, for example, Microsoft will stop sending unique IDs and
hardware data of the kind our testing demonstrated, then this approach
to privacy will certainly represent progress. But as things stand right
now, the Windows 10 privacy situation is substantially unaltered, and
the lack of clear guidance and transparency that has concerned people
since day one will continue to cause concern.

--
A.M