If you’ve been following tech news recently, you might have heard about Microsoft’s announcement yesterday that it has recalled one of its latest AI products, Microsoft Recall. Copilot Recall was being previewed in the new version of Windows 11, 2H24 if you’re interested, and was due for general release later in 2024. Microsoft normally targets the full release in September/October but pre-production versions were available to Windows Insider and Preview members.
What is Microsoft Recall?
If you are wondering what Recall is, it is effectively an inbuilt recorder of all activity undertaken by a user on the PC, taken as a series of snapshots, supported by logs, that records the activity in a local database on the PC that can be searched and recovered by the user or a certified administrator with rights to access it. It is not application-specific, all activity across all applications is recorded. The only known exception was an InPrivate browsing session in Microsoft Edge, which they say is not captured. As far as we were aware, all other activity in all other browsers was to be recorded. Recall is fully searchable, and displays a timeline bar on the top edge of the screen which you can use to revert to any point in time since it was enabled. Recall snapshots and associated data are held locally on the PC in a SQLite database, and they state you will need one of the CoPilot+ compatible PCs with dedicated Neural Processing Units, although early testing suggested that it can work on older style hardware but we are not yet aware of what limitations this brings.
What exactly happened?
Initially, Microsoft stated it would be enabled by default, with the ability to disable it through settings or policy if the PC is centrally managed. Following the initial outcry over its potential security risks, they changed this to being disabled by default and also added several security features to secure and access it, including mandating Windows Hello to access it and separate database encryption in addition to the standard BitLocker capability in Windows. They also stated that the data in the Recall database will not be tagged and analysed as training data for AI systems.
However, yesterday Microsoft issued a public statement acknowledging the security issues explaining their decision to recall the product to initiate a thorough review of the product’s security framework.
Researchers have shown how easy it could be to extract and search through Recall snapshots on a compromised system. Even though it could be argued that the compromised system is a significant part of the problem, Recall itself could give an attacker access to an unprecedented wealth of information that would typically be out of reach. Essentially, a goldmine for hackers.
So, could Microsoft Recall still be a good thing?
Well as always, it depends on who you ask. If the security risks are addressed, from a user and user support perspective it should provide better capability to recover and manage PCs and save users from the regular ‘what was that file called’ and/or ‘who sent me the diagram attached to an email’ searches that currently consume a fair amount of most users working time. It could also help user productivity, but as an individual user app, as with most of the other CoPilots we have seen thus far, it doesn’t help organisational productivity and information sharing. From an administration, risk and security perspective it could potentially bring a whole new world of pain, particularly if any issues remain over security and access.
Microsoft did the right thing recalling it because if it had remained in its current form it would have been a major risk and a security nightmare with almost certainly implications for GDPR and other data protection legislation. By snapshotting passwords and other authentication mechanisms, if a bad actor, including from inside an organisation, gained access to the Recall database, a whole new level of identity and credential theft, plus data security breaches, would arise and need to be addressed.
The race for AI-powered personal assistants
For me, potentially the most interesting element of Microsoft Recall is where it goes from here. My personal view is that Recall is the first stage of Microsoft introducing personal AI assistants linked to a vast array of subscription services. Whilst they have stated the Recall data will not be used to ‘train AI models’, what if it was only used to train your own personal AI assistant, powered by Windows (of course)? If your PC has recorded everything you do digitally through it, imagine what that could lead to in helping you run and manage your work and personal life. It knows what your meeting preferences are, what you prefer to do in your leisure time, your food likes and dislikes, and so on, plus, and possibly most pertinently, how much money is in your bank account. If it is then linked to services through APIs that will allow it to act and book them on your behalf, it could help manage your life, whilst you pay a ‘suitable’ tax set by Microsoft. You will also need new, more capable, and expensive hardware to run it – oh look, the CoPilot + PC! Please note there will be similar offerings from Google, Meta and Amazon in due course, and Apple have just announced their starting point for this strategy with their recently announced integrations of Apple Intelligence and OpenAI’s technology into Siri on your iPhone/Pad/Mac.
I’ll leave it up to you to decide whether that is immensely appealing or one of the scariest things you have heard…….
