This week Microsoft announced Copilot+, which is designed to leverage neural processing units in modern PCs to execute certain tasks. Of course, this is centred around Microsoft’s artificial intelligence aspirations and its Copilot play.

One of the big talking points for the big tech firm was Recall. This feature will track everything you do on your PC for three months, capturing screenshots, and much more.

“Recall utilizes Windows Copilot Runtime to help you find anything you’ve seen on your PC. Search using any clues you remember or use the timeline to scroll through your past activity, including apps, documents, and websites. Once you’ve found what you’re looking for, you can quickly jump back to the content seen in the snapshot by selecting the relaunch button below the screenshot. The UserActivity API is what allows apps to provide deep links, so you can pick up where you left off,” explains Microsoft.

One of the more important functions of Recall is something called User Activity which is a way for tasks to be passed to different devices. User Activity for instance allows you to start typing an email on one device and finish it on another or at a different time.

As you might imagine, all of this data needs to be stored somewhere and Microsoft says users will need at least 256GB of free space for this feature to work. This is why so many of the Copilot+ PCs announced thus far are fitted with at least 1TB of storage.

If storing all of this data in an easy to access manner is concerning to you, you aren’t allow. Consensus on the internet so far has been that Recall is bound to be a nightmare.

“Given Microsoft’s awesome past track record of getting hacked and leak of user data, this looks total disaster,” one Reddit user said.

“Imagine a surveillance-enabled OS, encoded with spyware worse than a keylogger. That’s what Recall will do for Windows 11. Even worse, it’s being marketed as a forward-thinking technology feature. Absolute madness,” commented another Redditor.

While Microsoft says that no data will be shared and all data captured by Recall won’t leave a user’s PC that’s only really addressing part of the problem. What if my laptop gets stolen? What happens if my laptop is compromised by malware?

As it so happens, even without Recall, if any of the above happens, criminals can still find similar information so long as they know where to look.

According field chief technology officer at Sophos Aaron Bugal, Recall is just an evolution of another Windows feature called Timeline. Where Recall differs is in that it uses artificial intelligence so that if you’re looking for a website you visited last week and all you can remember about is that it had birds on it, you could plug that prompt into Recall and search through matching results.

While the execution is new, the data gathering isn’t.

“However, this metadata has long been captured by your computing devices since the day you first logged on to it. Log files, cookies, browsing history, application access, recent documents, indexing services… all of these point in time and product logging-artefact generating flows exist already,” says Bugal.

“Information stealers have long preyed on loosely secured systems and this captured logging data to exfiltrate and parse in an effort to look for an angle to exploit you,” the field CTO told Hypertext.

There have also been concerns voiced around whether security solutions are up to the task of protecting this data, on that front Bugal says that security solutions should run just fun on an ARM system.

“Apple have moved away from Intel, and uses a custom ARM64 CPU (their M class SoC) with wide ranging support of ARM64 on numerous Linux distributions. Amazon’s own Gravitron2 CPU which powers many workloads in their cloud are power efficient and performant. Many operating systems and resulting application packages have included native support for ARM64 based architectures, of which Snapdragon SoC includes support of. So if a data-dependent ‘AI-Indexing service’ (Recall) requires this CPU architecture to run, then security software will also be supported,” says Bugal.

We’ll only know how secure Recall is if it fails and we hope that Microsoft is doing everything it can to ensure it doesn’t fail.

With that having been said, we expect businesses will turn Recall off as soon as possible just because capturing screenshots of everything an employee does is a bad idea even if laptops are kept under lock and key.

Of course, for now Recall is restricted to laptops running the Snapdragon X platform so it’s quite easy to avoid the software.