Backlash Prompts Microsoft to Tighten Security on ‘Recall’ Screenshot Feature

A sign at a Microsoft store in New York City on July 26, 2023. (Samira Bouaou/The Epoch Times)

Microsoft has announced that it is updating a controversial new function it plans to implement with stronger privacy measures after experts raised concerns about its potential for compromising user data.

On May 20, Microsoft introduced its Copilot+ line of PCs running Windows 11 featuring the “most advanced AI models.” One of the functions in Copilot+, called Recall, creates an explorable visual timeline that allows a user to easily find things from apps, websites, images, and documents. The function works by constantly taking screenshots of the user’s activity, storing the images locally, and using on-device AI to study it in order to respond contextually to user queries. Snapshots are taken every five seconds.

Recall, only available on Copilot+ PCs, is set to go live in preview mode on June 18. The feature attracted widespread backlash, with many security experts concerned about its threat to privacy and data safety.

“Windows Recall poses privacy risks,” Milli Sen, the founder of Paradigm, a firm that helps companies experiment with generative AI, said in a June 6 X post. “It captures and stores all screen activity including encrypted apps and could be accessed by anyone using the same device. Privacy was the biggest concern from Recall and now it turns out to be true.”

Cybersecurity expert Kevin Beaumont warned in a June 1 blog post that, thanks to Recall, “stealing everything you’ve ever typed or viewed on your own Windows PC is now possible with two lines of code.”

Following the backlash, Microsoft said Friday that they are updating the function.

First, Recall, which was originally going to be enabled by default, will now be disabled by default on all Copilot+ PCs.

Secondly, turning on Windows Hello—a feature that allows users to sign in using facial recognition, fingerprint, or PIN rather than a password—will now be necessary to enable Recall.

“These options help make it easier and safer to sign into your PC because your PIN is only associated with one device, and it’s backed up for recovery with your Microsoft account,” the company states.

Third, Microsoft is boosting data protection through the Windows Hello Enhanced Sign-in Security so that Recall snapshots can only be decrypted and accessed after user authentication. The search index database will also be encrypted.

Mr. Beaumont pointed out in an X post that while there were “good elements” in Microsoft’s new updated privacy and security promises, “there are obviously going to be devils in the details—potentially big ones.”

“Obviously all eyes are on how this is actually implemented, eg they said the database was encrypted previously. I would suggest security researchers deep dive in the coming weeks.”

He asked Microsoft to commit that the company will not try to force users enable the Recall function in the future. In addition, Recall must be turned off by default in Microsoft’s Group Policy and Intune services for enterprise organizations, Mr. Beaumont stated.

The Epoch Times has reached out to Microsoft for comment.

Security Concerns

Microsoft claims that Recall screenshots are stored locally on the device and that the images won’t be used to train its artificial intelligence. In addition, it said Recall snapshots won’t be sent to Microsoft or other companies and applications.

“Recall doesn’t share snapshots with other users who are signed into the same device, and per-user encryption ensures even administrators cannot view other users’ snapshots,” said the company.

In his blog, Mr. Beaumont notes that even though Recall snapshots are stored on user devices and will now be encrypted, the images can still be accessed by hackers and malware.

Even if a person were to delete their emails, WhatsApp messages, and other things from their PC, the Recall snapshots of these apps will remain in the device database indefinitely, the blog post stated.

The Recall feature comes as Microsoft’s security practices were recently blamed by a federal review board for a Chinese hacking incident last year.

From May to June 2023, a hacking group allegedly linked to China called Storm-0558 accessed the Microsoft Exchange Online mailboxes of 22 organizations and more than 500 people worldwide.

The intrusion compromised U.S. national security interests as hacked email accounts included those run by Commerce Secretary Gina Raimondo and U.S. Ambassador to the People’s Republic of China Nicholas Burns.

In a March 2024 report, the Cyber Safety Review Board (CSRB) pointed out that the hacking incident was “preventable” and should never have happened.

“The Board also concludes that Microsoft’s security culture was inadequate and requires an overhaul, particularly in light of the company’s centrality in the technology ecosystem and the level of trust customers place in the company to protect their data and operations,” the report said.

The CSRB noted that Microsoft needs to demonstrate the “highest standards of security, accountability, and transparency” given that its products support national security and act as the foundation of the American economy.

Meanwhile, Microsoft vice chairman and president Brad Smith is all set to testify before the House Homeland Security Committee on June 13 on the firm’s “security shortcomings.” During the hearing, lawmakers will look at how the company plans to strengthen its security measures.