Full level The Full level gathers info necessary to identify and to help fix problems, following the approval process described below. This level also includes info from the Basic, Enhanced, and Security levels. Additionally, at this level, devices opted in to the Windows Insider Program will send events that can show Microsoft how pre-release binaries and features are performing. All devices in the Windows Insider Program are automatically set to this level. If a device experiences problems that are difficult to identify or repeat using Microsoft’s internal testing, additional info becomes necessary. This info can include any user content that might have triggered the problem and is gathered from a small sample of devices that have both opted into the Full telemetry level and have exhibited the problem. However, before more info is gathered, Microsoft’s privacy governance team, including privacy and other subject matter experts, must approve the diagnostics request made by a Microsoft engineer. If the request is approved, Microsoft engineers can use the following capabilities to get the information: * Ability to run a limited, pre-approved list of Microsoft certified diagnostic tools, such as msinfo32.exe, powercfg.exe, and dxdiag.exe. * Ability to get registry keys. * Ability to gather user content, such as documents, if they might have been the trigger for the issue.

At the Full setting, you grant Microsoft permission to collect extra data [...] The formal documentation makes it clear that this sort of investigation can snag personal documents: [...] Ability to gather user content, such as documents, [...]

At the Full setting, you grant Microsoft permission to collect extra data when your device "experiences problems that are difficult to identify or repeat using Microsoft's internal testing. The formal documentation makes it clear that this sort of investigation can snag personal documents: [...] Ability to gather user content, such as documents, if they might have been the trigger for the issue.

The default level is Full for Windows 10 Home and Pro and Enhanced for Enterprise edition. (On a device that is running an Insider preview edition, this value is set to Full and can only be changed by installing a released version.) If you are concerned enough about privacy to have read this far, you probably want to set the telemetry level to Basic.

The default level for Windows 10 Home and Pro is “Full” and “Enhanced” for Enterprise editions.

Full level The Full level gathers data necessary to identify and to help fix problems, following the approval process described below. This level also includes data from the Basic, Enhanced, and Security levels. This is the default level for Windows 10 Pro.

In 2015 and 2016, Apple Inc. received and objected to or challenged at least 11 orders issued by United States district courts under the All Writs Act of 1789. Most of these seek to compel Apple "to use its existing capabilities to extract data like contacts, photos and calls from locked iPhones [...]

But what is less well-known is that, if you are like most users and login to Windows 10 using your Microsoft account, your computer automatically uploaded a copy of your recovery key — which can be used to unlock your encrypted disk — to Microsoft’s servers, probably without your knowledge and without an option to opt out.

“When a device goes into recovery mode, and the user doesn’t have access to the recovery key, the data on the drive will become permanently inaccessible. Based on the possibility of this outcome and a broad survey of customer feedback we choose to automatically backup the user recovery key,” a Microsoft spokesperson told me. “The recovery key requires physical access to the user device and is not useful without it.”

Microsoft has collaborated closely with US intelligence services to allow users' communications to be intercepted, including helping the National Security Agency to circumvent the company's own encryption, according to top-secret documents obtained by the Guardian.

In July last year, nine months after Microsoft bought Skype, the NSA boasted that a new capability had tripled the amount of Skype video calls being collected through Prism;

What are speech, inking, and typing services? When you interact with your Windows device by speaking, writing (handwriting), or typing, Microsoft collects speech, inking, and typing information—including information about your Calendar and People (also known as contacts)— [...]

Microsoft pretty much admits it has a keylogger in its {{Archive_link |url=https://web.archive.org/web/20150801001352/http://windows.microsoft.com/en-us/windows-10/speech-inking-typing-privacy-faq |text=Microsoft: Windows 10 speech, inking, typing, and privacy FAQ }}: “When you interact with your Windows device by speaking, writing (handwriting), or typing, Microsoft collects speech, inking, and typing information—including information about your Calendar and People (also known as contacts)…”

Can I clear the speech, inking, and typing data Microsoft has collected about me? Yes, you can clear your speech, inking, and typing data from your device and from the cloud. * [...] * To clear data stored on the cloud, go to Start, then Settings > Privacy > Speech, inking, & typing, and then select the Go to Bing and manage personal info for all your devices link.

When you use the Microsoft cloud-based speech recognition service, Microsoft collects and uses your voice recordings to create a text transcription of the spoken words in the voice data.

You can use device-based speech recognition without sending your voice data to Microsoft.

Inking and typing Recognition. You also can choose to help Microsoft improve inking and typing recognition by sending inking and typing diagnostic data. If you choose to do so, Microsoft will collect samples of the content you type or write to improve features such as handwriting recognition, autocompletion, next word prediction, and spelling correction in the many languages used by Windows customers. When Microsoft collects inking and typing diagnostic data, it is divided into small samples and processed to remove unique identifiers, sequencing information, and other data (such as email addresses and numeric values) which could be used to reconstruct the original content or associate the input to you. It also includes associated performance data, such as changes you manually make to text, as well as words you've added to the dictionary. [https://go.microsoft.com/fwlink/p/?LinkId=614828 Learn more about improving inking and typing in Windows 10].

According to tecChannel, the information sent to Microsoft includes details of all the software installed in a machine, not only Microsoft applications.

Summing up these 45 pages, one can say that Microsoft basically grants itself very broad rights to collect everything you do, say and write with and on your devices in order to sell more targeted advertising or to sell your data to third parties. The company appears to be granting itself the right to share your data either with your consent “or as necessary”.

By default, when signing into Windows with a Microsoft account, Windows syncs some of your settings and data with Microsoft servers, for example “web browser history, favorites, and websites you have open” as well as “saved app, website, mobile hotspot, and Wi-Fi network names and passwords”. Users can however deactivate this transfer to the Microsoft servers by changing their settings.

“We will access, disclose and preserve personal data, including your content (such as the content of your emails, other private communications or files in private folders), when we have a good faith belief that doing so is necessary to”, for example, “protect their customers” or “enforce the terms governing the use of the services”.

Windows 10 sends an unprecedented amount of usage data back to Microsoft,

The Chair of the National Data Protection Commission (CNIL) issues formal notice on Microsoft Corporation to stop collecting excessive data and tracking browsing by users without their consent. She is also demanding that Microsoft take satisfactory measures to ensure the security and confidentiality of user data.

Regulator says Microsoft doesn't offer enough information to enable informed consent.

Although Microsoft has made privacy assurances, they acknowledge that personally identifiable information]could be contained in the memory and application data compiled in the 100-200 KB "minidumps" that Windows Error Reporting compiles and sends back to Microsoft. They insist that in case personal data is sent to Microsoft, it won't be used to identify users, according to Microsoft's privacy policy. [https://privacy.microsoft.com/en-US/microsoft-error-reporting-privacy-statement Microsoft Privacy Statement for Error Reporting] [https://web.archive.org/web/20140204003023/http://support.microsoft.com/kb/283768/ Description of the end user privacy policy in application error reporting when you are using Office] But in reporting issues to Microsoft, users need to trust Microsoft's partners as well. About 450 partners have been granted access to the error reporting database to see records related to their device drivers and apps. https://rcpmag.com/articles/2002/10/03/microsoft-error-reporting-drives-bug-fixing-efforts.aspx

In December 2013, an independent lab found that WER automatically sends information to Microsoft when a new USB device is plugged to the PC. https://web.archive.org/web/20200312211152/https://www.forcepoint.com/blog/x-labs/are-your-windows-error-reports-leaking-data

Having Fun at Microsoft's Expense One example of the sheer creativity with which the TAO spies approach their work can be seen in a hacking method they use that exploits the error-proneness of Microsoft's Windows. Every user of the operating system is familiar with the annoying window that occasionally pops up on screen when an internal problem is detected, an automatic message that prompts the user to report the bug to the manufacturer and to restart the program. These crash reports offer TAO specialists a welcome opportunity to spy on computers. When TAO selects a computer somewhere in the world as a target and enters its unique identifiers (an IP address, for example) into the corresponding database, intelligence agents are then automatically notified any time the operating system of that computer crashes and its user receives the prompt to report the problem to Microsoft. An internal presentation suggests it is NSA's powerful [https://www.spiegel.de/international/world/germany-is-a-both-a-partner-to-and-a-target-of-nsa-surveillance-a-916029.html XKeyscore] spying tool that is used to fish these crash reports out of the massive sea of Internet traffic. The automated crash reports are a "neat way" to gain "passive access" to a machine, the presentation continues. Passive access means that, initially, only data the computer sends out into the Internet is captured and saved, but the computer itself is not yet manipulated. Still, even this passive access to error messages provides valuable insights into problems with a targeted person's computer and, thus, information on security holes that might be exploitable for planting malware or spyware on the unwitting victim's computer. Although the method appears to have little importance in practical terms, the NSA's agents still seem to enjoy it because it allows them to have a bit of a laugh at the expense of the Seattle-based software giant. In one internal graphic, they replaced the text of Microsoft's original error message with one of their own reading, "This information may be intercepted by a foreign sigint system to gather detailed information and better exploit your machine." ("Sigint" stands for "signals intelligence.")

Enhanced error reporting, including the memory state of the device when a system or app crash occurs (which may unintentionally contain user content, such as parts of a file you were using when the problem occurred).

For example, an internal paper from the Ministry of Economics from early 2012 states: "Due to the loss of full sovereignty over information technology," the security goals of "confidentiality" and "integrity" are no longer guaranteed. Elsewhere, there are sentences such as, "Significant impacts on the IT security of the federal administration may result." Accordingly, the conclusion is: "The use of 'trusted computing' technology in this form ... is unacceptable for the federal administration and for operators of critical infrastructures."

With regard to the use of TPMs, it can be pointed out in the negotiations, that not only the German government is critical of the use of TPMs that it does not control itself, but also wide sections of German industry, especially in critical infrastructures.

Therefore, Microsoft argues that they themselves need control over UEFI "Secure Boot". in order to securely manage UEFI "Secure Boot" for the owner. From the BSI's point of view the effort for a self-controlled configuration of UEFI "Secure Boot" is currently high, but it is urgently required in particular in areas of application with a high need for protection or in critical infrastructures.

On the one hand, the federal government demands "unrestricted controllability" of computers that keep critical infrastructures running - i.e. nuclear power plants, water, energy and transport networks. On the other hand, the responsible authorities are doing nothing to regain the control already lost to Intel and Microsoft.

From the point of view of the BSI, the use of Windows 8 in combination with a TPM 2.0 is accompanied by a loss of control over the operating system and hardware used. This results in new risks for users, especially for the federal administration and critical infrastructures. In particular, on hardware operated with a TPM 2.0, with Windows 8, unintentional errors by the hardware or operating system manufacturer, but also by the owner of the IT system, can lead to error conditions that prevent further operation of the system. This can lead to the situation that in case of an error, not only the operating system but also the hardware used is permanently unusable. Such a situation would be unacceptable neither for the Federal Administration nor for other users. Furthermore, the newly implemented mechanisms can also be used for acts of sabotage by third parties. These risks must be countered.

For certain user groups, the use of Windows 8 in combination with a TPM can certainly mean a security gain. These include users who, for various reasons, cannot or do not want to worry about the security of their systems, but trust the system manufacturer to provide and maintain a secure solution. This is a legitimate usage scenario, but the manufacturer should provide sufficient transparency about the possible limitations of the provided architecture and possible consequences of its use.

sudo apt update

...
Get:5 tor+https://deb.debian.org/debian buster-backports InRelease [46.7 kB]
Get:6 tor+https://deb.debian.org/debian-security buster/updates InRelease [65.4 kB]
Get:7 tor+https://deb.debian.org/debian buster-updates InRelease [51.9 kB]
Hit:8 tor+https://deb.debian.org/debian buster InRelease
...

sudo apt full-upgrade

Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
  anon-apt-sources-list anon-icon-pack apparmor-profile-dist
  apparmor-profile-torbrowser bootclockrandomization damngpl dist-base-files
  gpg-bash-lib hardened-malloc hardened-malloc-kicksecure-enable helper-scripts
  kicksecure-base-files kicksecure-cli kicksecure-dependencies-cli msgcollector
  msgcollector-gui open-link-confirmation repository-dist sdwdate secbrowser
  security-misc tb-default-browser tb-starter tb-updater timesanitycheck tor
  tor-geoipdb usability-misc vm-config-dist whonix-initializer
30 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 5,957 kB of archives.
After this operation, 732 kB of additional disk space will be used.
Do you want to continue? [Y/n]

Windows 10 Enterprise does allow users to postpone any update indefinitely but it is only available in bulk licensing.

Microsoft Corp. (MSFT), the world’s largest software company, provides intelligence agencies with information about bugs in its popular software before it publicly releases a fix, according to two people familiar with the process.

Redmond, Washington-based Microsoft (MSFT) and other software or Internet security companies have been aware that this type of early alert allowed the U.S. to exploit vulnerabilities in software sold to foreign governments, according to two U.S. officials. Microsoft doesn't ask and can't be told how the government uses such tip-offs, said the officials, who asked not to be identified because the matter is confidential.

Frank Shaw, a spokesman for Microsoft, said those releases occur in cooperation with multiple agencies and are designed to give government "an early start" on risk assessment and mitigation

[...] Although our preference is to release fixes for publicly undisclosed bugs as soon as they become available, this may be postponed at the request of the reporter or an affected party for up to 7 calendar days from the start of the release process, with an exceptional extension to 14 calendar days if it is agreed that the criticality of the bug requires more time. The only valid reason for deferring the publication of a fix is to accommodate the logistics of QA and large scale rollouts which require release coordination. While embargoed information may be shared with trusted individuals in order to develop a fix, such information will not be published alongside the fix or on any other disclosure channel without the permission of the reporter. This includes but is not limited to the original bug report and followup discussions (if any), exploits, CVE information or the identity of the reporter. In other words our only interest is in getting bugs fixed. All other information submitted to the security list and any followup discussions of the report are treated confidentially even after the embargo has been lifted, in perpetuity. [...] Fixes for sensitive bugs, such as those that might lead to privilege escalations, may need to be coordinated with the private mailing list so that distribution vendors are well prepared to issue a fixed kernel upon public disclosure of the upstream fix. Distros will need some time to test the proposed patch and will generally request at least a few days of embargo, and vendor update publication prefers to happen Tuesday through Thursday. When appropriate, the security team can assist with this coordination, or the reporter can include linux-distros from the start. [...]

Microsoft's [https://www.microsoft.com/en-us/sharedsource/default.aspx Shared Source Initiative] makes source code available to "qualified customers, enterprises, governments, and partners for debugging and reference purposes". There's almost no information on the company's website about their [https://www.microsoft.com/en-us/sharedsource/government-security-program.aspx Government Security Program] (GSP). Just two sentences. But the first of those sentences notes that requests might come from "local, state, provincial, or national governments or agencies". When the GSP was launched back in 2003, however, Microsoft was happy to tell the media that Windows source code was made available to a number of governments and international organistions, including Russia, NATO, the UK, and China. Another report said that Australia, Austria, Finland, Norway, Taiwan, and Turkey were also on the list.

CheesusCrust also disabled every single tracking and telemetry features in the operating system. He then left the machine running Windows 10 overnight in an effort to monitor the connections the OS is attempting to make.

Eight hours later, he found that the idle Windows 10 box had tried over 5,500 connections to 93 different IP addresses, out of which almost 4,000 were made to 51 different IP addresses belonging to Microsoft.

A wide variety of malware types exist, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, rogue software, wiper and scareware.

Microsoft uses draconian law to put Windows, the world's most-used operating system, completely outside the control of its users. Neither Windows users nor independent experts can view the system's source code, make modifications or fixes, or copy the system. This puts Microsoft in a dominant position over its customers, which it takes advantage of to [https://www.fsf.org/windows/upgrade-from-windows#abuses treat them as a product].

There is no security without privacy.

I equate privacy with security because they are very much related in the real world especially for whistleblowers.

“‘The tyranny of the default’ [is] the expression I like to use for: we know most users don’t go in and change things. They just assume that someone smarter than them choose the settings that are best for them, and so they say ‘YES’ a lot when they’re asked questions. What that means is that if it’s enabled by default, it’ll tend to stay on.”