Why are users willing to exchange personal data for a familiar service?

If you own a licensed Windows 7 or 8 product, then you've already seen a pop-up window offering you a free (for now) upgrade to Windows 10. You may have even already accepted the offer. It is also possible that the features of the new operating system (OS) are unknown to you.

Over the past few months, the Internet has been full of bloggers' reviews of the aggressive data collection policy that Windows 10 follows. Geolocation, printed text, images from a webcam and microphone recording, telemetry data about user activity, passwords, etc. - all this information is collected by default and is sent to Microsoft servers. According to the company, this is necessary to optimize and personalize the services provided, improve service and advertising purposes. And, despite the fact that the system allows you to personalize privacy, a number of nuances continue to cause a lot of controversy among technical specialists and ordinary users.

Firstly, the maximum collection of personal data and user activity data is activated by default, and in order to change privacy settings , you need to go through more than 10 pages of different settings. However, in its privacy policy, the company reserves the right to “access, disclose or store your personal information, including your personal content (for example, the content of email, other private messages or files that are located in private folders)” in cases where when, among other things, necessary to protect users, enforce the terms of service, protect the rights or property of Microsoft, or comply with applicable laws. The same document also talks about the possibility of advertisers using your data as “trusted third parties”, without explaining who they are and on what basis they are trusted.

Secondly, as the popular online publication Ars Technica found out, despite the personalization of the settings, the services built into the system continue to send data, presumably of a telemetric nature, to the company’s servers even after they are turned off. The material posted on the publication’s website claims that some data available, for example, to the virtual assistant Cortana (analogous to Siri) - the user’s geocoordinates, data from the calendar, mail, SMS correspondence, data about calls and contacts and other meta- and content data - or the OneDrive service, are also available to the Bing search engine even when these services are disabled. Microsoft itself explained the detected traffic by saying that “as part of the provision of Windows 10 services, updates may be made to install new elements of the Bing search engine <...>. No search results outside of the user's chosen privacy settings are sent to Microsoft ." As the authors of the publication note, users have long been taught to pay for convenience with monetized data, but the granted right to refuse such a personalized service should guarantee the privacy of personal and other data.

Thirdly, gamers will be interested in the function of distributing anti-piracy software through Windows 10, which allows them to deactivate unlicensed games and other pirated software on the user’s computer.

Finally, the OS update is still free, and some updates are downloaded automatically , persistently inviting the client, accustomed to the most popular Windows 7 or Windows 8, to switch to the new product. Some are ironic that for this purpose Microsoft even returned the user’s favorite games from the past - Minesweeper and Klondike.

And yet this is not a revolution.

Despite the instinctive rejection of such large-scale data collection, most users will put up with it one way or another - for the sake of convenient functionality. The commercialization of anonymized “big data” without reference to a specific person (although it can be restored if necessary and at the appropriate request of the authorities) is far from new; only their accessible volume and variety are growing. For example, at the same time, a large surge of dissatisfaction was caused by the new privacy policy and data collection functionality of the music service Spotify . But he won’t leave the market either.

User data has long become the most important currency in the technology business, maintaining the illusion that the services provided are free. The odious argument that those who have nothing to hide have nothing to fear is still often used. Either way, the average user's threshold for tolerating the disclosure of personal information has dropped dramatically over the past few years.

It’s a paradox, but even Snowden’s revelations ultimately only proved that the majority of users have not changed their habits and are not ready to give up the convenience of the service for the sake of illusory privacy.

Companies that went through a crisis of confidence in 2013 due to allegations of collaboration with the NSA have already recovered from it and are unlikely to have suffered much damage to their user base. Moreover, the same Microsoft actively participated in lobbying for the right of technology companies to disclose more information about the amount and type of data requested from them by the American authorities. The rapidly emerging standard for reporting data to authorities, following the example of the pioneer Google Transparency Report, emphasizes the responsibility and openness of companies to users. Microsoft turned to this practice just before the revelations. At the same time, it launched a campaign promoting its customer data protection program.

However, much more successful is the overall “campaign” of the technology market and the data business, aimed at reconciling the user with the fact that for a person keeping up with the times, privacy is becoming more and more a relative concept. Technologies for mass collection, processing and use of personal and other user data, as well as privacy policies that explain them, are the new norm, whether we want to put up with it or not.

And the rapidly developing “Internet of Things” and “Internet of Everything” will only help it take root.

However, the use of aggregated user data is part of a much larger picture of the proliferation of security technologies. In February 2015, the White House Summit on Cybersecurity and Consumer Protection took place at Stanford University, where Microsoft announced the introduction of functionality to support FIDO (Fast Identification Online) in future versions of Windows 10. This system, in the creation of which Google, PayPal and Bank also participated of America, provides for the replacement of passwords with biometric identification (fingerprints and iris). First of all, it will be applied to Outlook mail. Thus, the company, in particular, indicated its support for one of the White House priorities in the field of cybersecurity, which is to “develop digitally skilled professionals and eliminate passwords in collaboration with the private sector.” This provision, in turn, is part of the US Presidential BuySecure initiative, launched in 2014 and aimed at ensuring the security of payment instruments.

Such cooperation reflects the course taken by the American authorities to work as closely as possible with private technology companies on cybersecurity - both user and in the field of protecting critical infrastructure and preventing cyberterrorism. With such integration of national security issues, commercial interests of the state and private interests in line with public-private partnerships, the problem of collecting and processing user data takes on a completely different scale.

For those who are not satisfied with all this, there is alternative software. But such users are a relative minority, and their behavior is unlikely to affect the customer base.

The situation with institutional choice is much more complicated. For example, in Russia there are new calls to ban the use of Windows 10 in government bodies to prevent leakage of confidential data. In response to this, the Microsoft press service claims that in Russia the company “provides the opportunity for the state to make sure that the “internal structure” of Microsoft products does not contain “secret doors.” But this does not mean that government agencies thereby gain access to the user’s private data or content. All Microsoft products meet special national state requirements and undergo mandatory information security certification in Russia.” However, Windows 10 has not yet been certified.

It would seem that against this background, the initiative to promote foreign IT products based on free software for government agencies could receive new impetus. However, this is a colossal volume and complexity of work that will take years, especially in the context of the economic crisis in the country. Even with a specific order, the open source project will initially be “tailored” for the local market and is unlikely to receive global distribution, that is, it will not be commercially profitable. As Ivan Begtin, director of the Information Culture NP, notes, “in recent years the state has made clearly insufficient efforts to support free software. And the current situation is precisely a consequence of the fact that when Windows 10 is released, Russian consumers, including corporate ones, will simply have no choice but to delay the transition to this OS, hoping for better things in the future.”

Amid ongoing attempts to agree on the responsible behavior of states in cyberspace, the presence of such functionality in a global software monopoly company opens up a lot of possibilities for speculation and interpretation. But we should not forget that the problem of balancing privacy, security and commercial success is an equation with three unknowns, which has not yet been solved. Despite the fact that this can only be done through joint efforts.

Windows 10: goodbye to privacy