When Microsoft announced the Recall feature for its new AI PCs concept, the idea was met first with interest that turned into growing horror as the implications of the service became clear.

Just to recap, the Recall service in Microsoft-driven AI PCs monitors user activity, taking screenshots every few seconds and scanning the image, creating searchable text – extracting the data and saving it in a database locally on the PC.

The intent of this feature is to use Microsoft Copilot to be able to quickly and easily find things you were previously working on – everything – including documents, websites, emails, and other work. On the surface this feature seems like a time-saving boon – finding that recipe you saw the other day, or that website with *just* the instructions you needed to perform a task but lost after going to lunch. A personal, searchable timeline with AI assistance to help you connect the dots. Frankly, its an appealing idea.

The fly in the Recall ointment

Then the questions begin to bubble to the surface. Is it capturing passwords? Financial and health data? Will advertisers be able to use that data to sell to customers?

After the outcry, Microsoft stopped and made some changes. They are good changes and done with the customer in mind.

First, Recall is opt-in, so that’s good. You can even remove the feature entirely from the system, that’s also good. Microsoft has hauled out the big guns to protect the data – data is not shared between users on the same machine, the data is kept in an encrypted vector database that uses the PC’s own Trusted Platform Hardware, has anti-brute force and periodic re-authorisation. Plus, it respects ‘privacy mode’ on most Chrome/Chromium based browsers and Firefox

The software actively tries to avoid things like ID numbers, passwords, and credit card numbers. Users can limit how long captured data is kept and exclude certain websites or applications. Microsoft has taken considerable effort to ensure the user has control and has spent considerable technical resources securing Recall from unauthorised access.

Security issues and housekeeping complications

No digital system is entirely secure. That’s not Microsoft’s fault, that’s just reality. Microsoft’s Windows desktop operating system is the most popular OS in the world, by a vast margin. That also means that Microsoft Windows is the biggest target for cyber criminals and the intelligence assets of nation-states.

To further complicate the issue, corporations have every right to turn on Recall on your work AI PC and record everything you are doing. A possible if petty dystopia. But it’s even worse if corporations do turn on Recall – all of those records would be subject to digital discovery. Worse, a legal freeze on corporate data due to a lawsuit could result in companies having to turn off auto-delete and exclusion rules.

A nightmare made real

Tech intelligence firm GlobalData’s Principal Analyst for Enterprise Security and Infrastructure Steven J. Schuchart Jr. says “Microsoft Recall is a nightmare made real for legal and IT departments when it comes to legal discovery. Plus, corporate intellectual property may be in jeopardy as well, if malicious actors manage to turn Recall and retrieve data with compromised credentials.

Microsoft has done a great job with its digital security for Recall, but the biggest threat is always social hacking – the user themselves.”

Time to 'total' Recall

The idea of Recall is idyllic and tempting. Putting AI to work to help users discover forgotten details and rediscover data sounds like an application made in heaven. But like many ideals, the hard realities of criminal, ethical, and legal complications make it unworkable

Enterprises from SMB mom and pop companies, all the way to the corporate heights, should not only turn Recall off but use the option to remove it from the system. The dangers outweigh the possible benefits.

"Forget Recall again" was originally created and published by Verdict, a GlobalData owned brand.

The information on this site has been included in good faith for general informational purposes only. It is not intended to amount to advice on which you should rely, and we give no representation, warranty or guarantee, whether express or implied as to its accuracy or completeness. You must obtain professional or specialist advice before taking, or refraining from, any action on the basis of the content on our site.