When Microsoft named its new Windows feature Recall, the company intended the word to refer to a kind of perfect, AI-enabled memory for your device. Today, the other, unintended definition of “recall”—a company’s admission that a product is too dangerous or defective to be left on the market in its current form—seems more appropriate.
On Friday, Microsoft announced that it would be making multiple dramatic changes to its rollout of its Recall feature, making it an opt-in feature in the Copilot+ compatible versions of Windows where it had previously been turned on by default, and introducing new security measures designed to better keep data encrypted and require authentication to access Recall’s stored information.
“We are updating the set-up experience of Copilot+ PCs to give people a clearer choice to opt-in to saving snapshots using Recall,” reads a blog post from Pavan Davuluri, Microsoft’s corporate vice president for Windows and devices. “If you don’t proactively choose to turn it on, it will be off by default.”
The modifications occur as the security and privacy sectors increasingly criticize Recall, which automatically captures screenshots of the user’s activity every five seconds for AI analysis. Critics label this feature as preinstalled spyware on new Windows computers that poses significant security risks.
In earlier versions of Recall, screenshots capturing all user activities, including sensitive information such as bank logins and passwords, would be automatically stored on the local device by default. Despite this data not being uploaded to the cloud, cybersecurity experts have expressed concerns. They suggest that once a hacker gains even short-term access to the device, they could potentially have a prolonged insight into the victim’s digital activities.
“It makes your security very fragile,” stated Dave Aitel, a former NSA hacker and the founder of Immunity, in an interview with WIRED. He noted that any hacker briefly infiltrating a computer could potentially access extensive historical data, which is undesirable.
Responding to these concerns, Microsoft’s Davuluri announced that Recall would transition to an opt-in service. Furthermore, Microsoft plans to implement more robust safeguards for the data collected by Recall and enhance monitoring of the feature’s activation. This includes requiring users to verify their identity through the Microsoft Hello authentication system—utilizing a PIN or a biometric check—before enabling Recall or accessing its data. Davuluri affirmed that the stored data would remain encrypted until authenticated by the user.
All of that is a “great improvement,” says Jake Williams, another former NSA hacker who now serves as VP of R&D at the cybersecurity consultancy Hunter Strategy, where he says he’s been asked by some of the firm’s clients to test Recall’s security before they add Microsoft devices that use it to their networks. But Williams still sees serious risks in Recall, even in its latest form.
By Matt Burgess
By Matt Burgess
By Megan Farokhmanesh
By Joseph Cox
Many users will turn on Recall, he points out, partly due to Microsoft’s high-profile marketing of the feature. And when they do, they’ll still face plenty of unresolved privacy problems, from domestic abusers that often demand partners give up their PINs to subpoenas or lawsuits that compel them to turn over their historical data. “Satya Nadella has been out there talking about how this is a game changer and the solution to all problems,” Williams says, referring to Microsoft’s CEO. “If customers turn it on, there’s still a huge threat of legal discovery. I can’t imagine a corporate legal team that’s ready to accept the risk of all of a user’s actions being turned over in discovery.”
For Microsoft, the Recall rollback comes in the midst of an embarrassing string of cybersecurity incidents and breaches—including a leak of terabytes of its customers’ data and a shocking penetration of government email accounts enabled by a cascading series of Microsoft security slipups—that have grown so problematic as to become a sticking point given its uniquely close relationship with the US government.
Those scandals have escalated to the degree that Microsoft’s Nadella issued a memo just last month declaring that Microsoft would make security its first priority in any business decision. “If you’re faced with the trade-off between security and another priority, your answer is clear: Do security,” Nadella’s memo read (emphasis his). “In some cases, this will mean prioritizing security above other things we do, such as releasing new features or providing ongoing support for legacy systems.”
Despite today’s announcement, Microsoft’s launch of Recall epitomizes a familiar pattern observed in Redmond’s operations: introduce a new feature, face significant criticism over security vulnerabilities, and then hastily endeavor to mitigate these issues.
