A teenager, identified as Peter Stokes, has found himself at the center of a legal storm after allegedly using a VPN to mask his online activities while hacking a U.S. jewelry retailer. However, the technological veil he attempted to employ was pierced by Microsoft’s tracking capabilities. Recent court documents reveal that Microsoft provided the FBI with critical data linked to a tracking mechanism known as the Global Device Identifier (GDID).
Key Insights
The GDID is an automatically assigned number tied to every Windows installation, designed to persist even through standard updates. This unique identifier enabled authorities to connect Stokes’ computer to specific websites and third-party services, despite his VPN usage.
Stokes was apprehended in Helsinki in April 2026 while attempting to board a flight to Japan, carrying two two-terabyte hard drives. He now faces federal charges in Chicago, including conspiracy, computer intrusion, and fraud.
This case brings the GDID into the spotlight, a term that may be unfamiliar to many. Its implications extend beyond the realm of cybersecurity, raising questions about privacy and data tracking.
Understanding the Global Device ID (GDID)
The GDID serves as a unique identifier for Windows installations, remaining consistent across typical updates. According to the criminal complaint, Microsoft’s records indicated that Stokes’ GDID accessed specific pages on ngrok, a developer tunneling tool, at precise timestamps. This data was instrumental in reconstructing his activities and linking them to the hack.
Notably, the GDID appears to persist across updates and lacks a straightforward opt-out mechanism. This allows Microsoft to potentially connect a Windows installation to activities on third-party services, extending beyond its own ecosystem.
In essence, Microsoft may maintain a record of the websites visited by a Windows PC, independent of traditional browser history and cookie tracking. While it is technically possible to reset the GDID by reinstalling Windows, this case serves as a reminder of the intricate web of digital tracking that exists, even for those who may not engage in illicit activities.
