Microsoft’s embarrassing Recall

Last week, I revealed that Microsoft’s Windows engineers were scrambling to secure its controversial AI-powered Recall feature in time for its planned debut on June 18th. Hours later, Microsoft announced that the feature that screenshots nearly everything you do on new Qualcomm-powered laptops is being recalled.

Copilot Plus PCs shipped earlier this week without Recall, and Microsoft has modified the setup process to remove it from Windows 11 — it’s now a feature that’s “coming soon” to these devices. Recall is still prominently featured in Microsoft’s marketing materials, which suggests the company is confident it will return very soon.

After developing Recall largely in secret away from the usual Windows Insider public testing, Microsoft is now relying upon that community of thousands to help test the new AI feature on new Copilot Plus devices. Recall will also be an opt-in feature with additional security improvements to address concerns from researchers.

Microsoft first announced its changes to Recall on June 7th, less than two weeks before it was due to ship on new devices. That rush to fix Recall’s security issues always felt like a big ask, especially having to encrypt the database in time and implement Windows Hello authentication, too. I understand Microsoft had been working on some of these changes before the Recall concerns were raised by security researchers, but OEMs already had the final Windows bits shipping on devices, so that further complicated the situation.

The surprise decision to not ship Recall at launch came on Thursday, June 13th, just five days before Copilot Plus PCs were about to ship. Sources tell me OEMs were informed of the delay ahead of a public acknowledgment from Microsoft. But security researcher Kevin Beaumont got wind of the Recall announcement, forcing Microsoft to edit a previous blog post in response to press queries.

I had planned to write about my time using Recall over the past couple of weeks, but given the feature has now been delayed, I’ll wait to see what changes before I write up my final impressions. In my limited testing with an early version of Recall, I did notice that the feature failed to filter out URLs correctly from its capture method. If I added the entire YouTube URL (https://www.youtube.com) into the filter list, Recall wouldn’t correctly filter out snapshots for YouTube, but if I added just youtube.com to the list, then it worked correctly. Full disclaimer: I was using the early version of Recall enabled on a Surface Pro X device, so I’m not sure if Microsoft may have patched this bug already. Either way, combined with Recall storing data in a database in plain text, it was clear some changes needed to be made to Recall before its launch.

Part of the Recall fallout is there are no reviews of the new Surface Laptop or Surface Pro devices or many of the laptops from Microsoft’s OEM partners. Microsoft has tightly controlled the entire launch of Copilot Plus PCs, so it was surprising to see some reviews of Asus’ Vivobook S15 earlier this week. Most laptop makers, including Microsoft, only started seeding review devices on June 18th because of the Recall mess.

I’m still stunned that Microsoft managed to fumble the launch of Recall so badly. I reported last week that the feature was developed before Microsoft’s big security overhaul began late last year and that Microsoft subsequently identified some of the security issues with Recall and started to develop and test changes to the experience in recent months.

The timing of the decision to delay Recall couldn’t have come at a worse time for Microsoft, though. Vice chair and president Brad Smith testified before the House Homeland Security Committee last week, on the same day that Recall was delayed. Microsoft has been saying that security is now its biggest priority, and Smith made it clear it’s even more important than the company’s work on AI.

Asked to explain Microsoft’s “secure-by-design” process during the hearing, Smith admitted that the company often made the mistake of “relying almost too much on the security experts and didn’t do enough to ask everybody to make security part of their job.” He then linked Recall to this and the secure-by-design approach.

“I think it’s a great lesson, we’re trying to apply it as a lesson learned,” said Smith. “If somebody’s creating the Recall feature, they need to think about the security aspects of the Recall feature. It hasn’t even been launched yet, so we’ve had the time to do this right.”

The irony here is that it was security researchers that really forced Microsoft to speed up its Recall changes, not Microsoft’s secure-by-design approach. If those alarms hadn’t gone off thanks to leaked copies of Recall, the feature would have almost certainly shipped on June 18th as planned. It would have been much harder for Microsoft to then argue it was learning from its mistakes.

The Recall fiasco is just a small part of the hurdles Microsoft has to overcome to win back trust. A series of high-profile security incidents has rocked Microsoft over the past few years, and a scathing report from the Cyber Safety Review Board concluded that “Microsoft’s security culture was inadequate and requires an overhaul.”

Microsoft is now making security a mandatory part of its biannual reviews process for all employees and tying security principles and goals to compensation packages for Microsoft’s senior leadership team. Microsoft’s security overhaul is broad, and it will clearly take some time to see its impact.

Recall’s messy security situation and the reaction to the AI-powered feature also ties into Microsoft’s recent choices with Windows. The malware-like Bing prompts, Start menu ads, and AI push are impacting Windows negatively. It’s tiring to have to swipe away the latest prompt that tries to get me to use Edge or Bing or to disable a notification that urges me to use more Microsoft Store apps. If I’m tired of it as someone who understands how to disable Microsoft’s notifications, I can only imagine how frustrating the Windows experience is for the millions of consumers relying on Microsoft’s OS every day.

I think a lot of this recent ill feeling toward Windows started with Windows 11, when Microsoft left millions of machines behind by implementing strict hardware requirements in the name of security. It’s now nagging Windows 10 users who can’t upgrade to Windows 11 with full-screen prompts to buy a new PC and planning to charge for security updates. With serious security breaches, years of nags and pop-ups, and now this Recall debacle, it’s no wonder so many people are annoyed with Windows.

“We want to move from people needing Windows to choosing Windows, to loving Windows. That is our bold goal,” said Microsoft CEO Satya Nadella nearly a decade ago. Microsoft hasn’t achieved that ambitious goal yet, but it definitely needs to get people closer to loving Windows like it’s the summer of 1995 all over again.

I’m currently reviewing the new Arm-powered Surface Laptop, so I’ll share lots more about my experience with Windows on Arm next week. What do you want to know about it the most, and what should I focus on for Notepad? You can reach me via email at [email protected] to let me know.

If you’ve heard about any secret project Microsoft is working on, you can also reach me confidentially on the Signal messaging app. I’m tomwarren.01 there. I’m also tomwarren on Telegram if you’d prefer to chat there.