§02 · Filed under maintenance

Now the word. Microsoft does not hide the GDID and does not describe it as surveillance. Identifiers like it, the reporting says, are "typically used for diagnostic and crash reporting, feature-usage analysis, and detecting abuse patterns such as one machine repeatedly claiming free trials or licences."reported Every clause of that is a maintenance task. Diagnostics keep the product working. Crash reports fix bugs. Feature-usage analysis tells the maker what people actually use. Abuse detection stops one computer from claiming a free trial a thousand times. Microsoft also notes a defensive security use: pairing a known device identifier with a login means "a login from an unfamiliar device paired with a known identifier" can flag stolen credentials.reported None of that is false, and none of it is sinister on its face.

But read the same identifier from the other side. A code that is unique per machine, that persists across every network, and that the software attaches to what it reports, is, by construction, a way to recognise one machine wherever it appears. Recognising one machine wherever it appears is the definition of a tracking beacon. The maintenance description and the beacon description are not two different objects. They are the same object, said two different ways, and only one of the two ways is ever said out loud. That is the move in this case, and it is the same move as The Eccentric: the wash is not concealment, it is categorization. The GDID is filed under housekeeping, and so the question a beacon would raise, should a shipped consumer product carry a permanent identity that can be handed to the state, is never asked, because on the books there is no beacon, only diagnostics.

The maintenance record what it is called	The tracking beacon what it also is
A diagnostic code for crash reports and feature-usage analysis.	A permanent identity for the machine, unchangeable unless the operating system is wiped.
Detects abuse: one machine claiming free trials again and again.	Detects a person: one machine appearing across Snapchat, Apple and Facebook logins.
Helps flag a login from an unfamiliar device.	Ties that device to a name, a city and a date, across borders.
Runs quietly in the background; you never see it.	You are never asked to accept it, and no user opt-out is documented.
Shared with Microsoft's own security teams.	Shared with the FBI on a court order, after a criminal referral.
Both columns describe the same identifier. Nothing on the left is false. The launder is that only the left column is ever said out loud, so a permanent tracking beacon ships on every machine under the name of routine maintenance, and no one is asked.

Read the two columns and keep them together, because they are one object. On the left is Microsoft's own account of the Global Device Identifier: diagnostics, crash reporting, feature-usage, abuse detection, a defensive security signal. On the right is what the identical code does in the Stokes filing: a persistent, cross-platform fingerprint that the FBI used to reassemble one person. The right column is not an accusation against the left. It is a translation of it. Uses per iTnews (Microsoft's stated purposes) and the reporting of the unsealed complaint (the FBI's use), July 2026.