Microsoft’s Recall: A Dire Threat to User Privacy or ‘Social Media 2.0’?

If you were to survey the extensive abilities of AI, finding a function that made you feel uncomfortable, anxious, or unsafe wouldn’t take long. It now seems that the Windows Recall feature can be added to the ever-expanding list.

Announced ahead of Microsoft’s annual Build Developer Conference, this search tool will document your digital activity by taking screenshots every few seconds and storing them locally on your Windows 11 PC. The idea is that Recall can perform a comprehensive visual search of your entire history to locate exactly what you need.

Microsoft has stated that users will be able to “access virtually what [they] have seen or done on [their] PC in a way that feels like having photographic memory.”

Who wouldn’t want a photographic memory? For many, however, the prospect of Microsoft constantly watching its customers feels a bit too Orwellian.

Although the tech giant released a statement asserting that Recall data cannot be “accessed by Microsoft or anyone who does not have device access,” several cybersecurity specialists are not convinced that this AI doesn’t threaten privacy and security.

Table of Contents Table of Contents

1. Key Takeaways
2. It’s Watching You: How Does Recall Threaten Privacy?
3. Hackers and Thieves
4. The Bottom Line
5. FAQs
6. References

Show Full Guide

Table of Contents

1. Key Takeaways
2. It’s Watching You: How Does Recall Threaten Privacy?
3. Hackers and Thieves
Show Full Guide
4. The Bottom Line
5. FAQs
6. References

It’s Watching You: How Does Recall Threaten Privacy?

Microsoft assures they have “built privacy into Recall’s design” and according to the company’s website, customers “can limit which snapshots Recall collects.” Aside from this, they have emphasized that access to any data is strictly limited to the owner.

These promises appear ineffective at quelling the anxieties of being constantly watched and recorded.

Dr Kris Shrishak, an adviser on AI and privacy, told the BBC:

“The mere fact that screenshots will be taken during use of the device could have a chilling effect on people.”

According to Shrishak, this uneasiness will likely impact how people use their machines, causing them to avoid the more mundane but sensitive tasks. All in all, Recall “could be a privacy nightmare,” she said.

That’s not how Microsoft CEO Satya Nadella sees things. In an interview with the Wall Street Journal, he championed Recall’s ability to search “over all your history” and “recreate moments from your past.” Nadella seems oblivious to the creepiness of this capability and how it could be seen as a serious invasion of privacy.

When asked about Microsoft’s new innovation, Calli Schroeder, senior counsel and global privacy counsel at the Electronic Privacy Information Center, stated:

“Constant screenshots of user actions for Recall and other AI programs is a form of surveillance.”

We already live in a world where companies monitor their workers to increase productivity, and an entire nation keeps tabs on its citizens through facial recognition.

Matthias Pfau, co-founder of Tuta, a secure email service, outlines that “AI allows for more detailed profiling and tracking of individuals’ activities, movements, and behaviors than was ever possible before.”

In the article for Forbes Technology Council, he writes that “AI-based surveillance technology can, for instance, be used for marketing purposes and targeted advertising” and that this “comprehensive surveillance” can lead to individuals feeling “scrutinized.”

It’s not unreasonable to suppose that Recall could be used for such purposes. What if Microsoft reconsiders how it handles your data in the future?

Social media is full of distrust toward Microsoft’s promises.

For example, AI expert Gary Marcus has encapsulated what most people think: “I don’t want my computer to spy on everything I ever do.”

The real question is if Microsoft will derive insights *locally* about you & your activities from AI Recall, and send those derived insights up to the cloud. They could do that for all AI Recall users while leaving their screenshots on their computers ??
pic.twitter.com/DICb5Zr9kn

— Bilawal Sidhu (@bilawalsidhu) May 23, 2024

Hackers and Thieves

While the issue of privacy is important, other malevolent possibilities are producing similar distress in the world of cybersecurity.

Mark Beare from Malwarebytes believes that AI such as Recall is ushering in a “social media 2.0 like world,” where personal data is uploaded without much concern for how that data will be used or exploited in the future.

The lead security engineer at Check Point, Muhammad Yahya Patel, said:

“It is a one-shot attack for criminals, like a grab and go, but with Recall they will essentially have everything in a single location…Imagine the goldmine of information that will be stored on a machine, and what threat actors can do with it.”

Charlie Milton, a vice president at cyber security firm Censornet, expands on this narrative by imagining how a hacker could use Recall to understand their victim’s behavior.

He concludes that the tech would give “malicious actors a really good understanding of user behavior and recent user behavior in order for them to influence you.”

Microsoft is likely wondering what all the fuss is about. Because everything is stored locally, a hacker would have to physically access a device before they could retrieve Recall’s screengrabs.

Cybersecurity expert Kevin Beaumont has pushed back on this point, suggesting there is no guarantee that the current security measures are effective against other threats, such as malware.

Beaumont expresses serious concerns about the technology: “In essence, a keylogger is being baked into Windows as a feature.”

While theft, privacy, and other security issues are concerning, Microsoft has stated that Recall is an optional experience.

The implication is quite plain: if you’re worried, just turn it off.

But this seems like a doubtful marketing trick. Who wants to buy a product if they don’t feel they can use the main feature?

If, as Microsft insists, “Recall is a key part of what makes Copilot+ PCs special,” then they should probably stop presenting non-use as such a ready option and rather focus on the privacy and security concerns that are causing such a stir.

Of course, Microsoft is also trying hard to defend itself. They continue to promote Recall’s ability to “open [any] snapshot in the original application in which it was created” and have boasted that after it’s refined during its preview phase, “it will open the actual source document, website, or email in a screenshot.”

For example, this could assist the online shopper who, for example, can’t remember where they originally spotted that “brown leather bag.”

And not everyone’s such a staunch critic. Some popular tech influencers are choosing to trust Microsoft and abate concerns around personal data ending up in the cloud.

The Bottom Line

Recording data without securing data is a big problem, and in its current configuration, Recall is cause for concern.

This has not escaped the attention of the Information Commissioner’s Office (ICO), which has warned that tech companies must not go public with their creations before they “rigorously assess and mitigate risks to peoples’ rights and freedoms.”

It’s not clear that Recall meets these expectations, so the ICO is “making inquiries with Microsoft to understand the safeguards in place to protect user privacy.”

Only time will tell whether Microsoft will make the required changes to get their latest innovation off the ground.

FAQs