I appreciate the fact that you sent over a very good paper.
After reading it, I am still not sure I see how this is particularly alarming information. I can see how it would help a forensic investigator who has physical access to the device.
The most personal aspect seems to be the list of installed and removed programs, which I would agree is stepping across boundaries of privacy.
The paper notes that this whole studied telemetry package is part of the telemetry service you can opt out of.
The rest seems to be device identifiers and connected devices. They mention that the device identifiers could lead to having part of an encryption key but that part of the paper seemed really vague. My takeaway from that section was that maybe it could lead an investigator to knowing which specific piece of hardware to use in order to decrypt something, but they’d likely need physical access to that hardware.
I get the impression is that the intent here is for an IT department or Windows developers to be able to respond to cyberattacks and deal with malware and the like. The paper you linked made that aspect pretty clear.
The printer thing is a good example, but again, just too unrelated to this particular subject. At least, in my opinion.
The typical response if someone comes knocking is ‘I don’t know what you’re talking about’. And really, how would they prove it unless you left a stack of printouts next to the door?
Now they could prove it was your printer (and that has happened multiple times in prosecutions!), even if you printed it years ago.
I think there are a lot of things that are potentially problematic where we depend on having a functioning society with real legal protections and due process.
Nobody can come in my house without a judicial warrant. And, hopefully, someday there are better privacy laws in the US that mean that Microsoft must handle its collected data more responsibly.
If your society has succumbed to serious oppression, does evidence really matter anyway? If the cartel is knocking on your door, do they need evidence to do what they want to do?
Evidence itself is just evidence. It can condemn you and it can exonerate you. If it can be proved that something came from my printer, that means my lawyer can also prove something didn't come from my printer.
I am by no means saying that I would personally willingly sign up for telemetry, or that I think it's better to have than not. I'm just not in alarm over it because I think that response is disproportional.
After reading it, I am still not sure I see how this is particularly alarming information. I can see how it would help a forensic investigator who has physical access to the device.
The most personal aspect seems to be the list of installed and removed programs, which I would agree is stepping across boundaries of privacy.
The paper notes that this whole studied telemetry package is part of the telemetry service you can opt out of.
The rest seems to be device identifiers and connected devices. They mention that the device identifiers could lead to having part of an encryption key but that part of the paper seemed really vague. My takeaway from that section was that maybe it could lead an investigator to knowing which specific piece of hardware to use in order to decrypt something, but they’d likely need physical access to that hardware.
I get the impression is that the intent here is for an IT department or Windows developers to be able to respond to cyberattacks and deal with malware and the like. The paper you linked made that aspect pretty clear.
The printer thing is a good example, but again, just too unrelated to this particular subject. At least, in my opinion.