The article describes how Windows telemetry's Global Device Identifier (GDID) enabled FBI tracking of hacker Peter Stokes: Microsoft telemetry logs transmitted both his GDID and visited URLs (via SmartScreen/Defender in Optional/Full mode), which agents correlated with ngrok tunnel usage, travel records, and IP addresses from Google and Apple logs. The source clarifies that GDID collection itself isn't new—it's documented behavior in Windows Home/Pro editions without user-facing disable controls—but this appears to be the first public prosecution case leveraging it. The practical takeaway is blunt: a VPN alone doesn't prevent OS-level identifier leakage; multiple software vendors (Microsoft, Google, Apple, ngrok) can be subpoenaed; and modern fingerprinting via browser features, fonts, and DRM adds layers beyond IP masking. The article notes Stokes routed through VPN + ngrok + teleport.sh but failed to prevent identifier transmission upstream. One open question: which specific telemetry mechanism (Edge URL logging vs. Defender/SmartScreen activity) actually provided the URL evidence the court used?