DOJ Uses Windows Device Identifier to Arrest Alleged Scattered Spider Member

Overview

• Federal prosecutors say they arrested 19-year-old Peter Stokes on charges tied to Scattered Spider after linking a suspect machine to alleged intrusions using a persistent Windows device identifier.
• A court order forced Microsoft to provide the identifier and related telemetry, which prosecutors cited alongside Snapchat posts to connect the device activity to the accused.
• A 39-page judgment and law enforcement reporting describe agents intercepting Stokes at an airport and seizing two hard drives that investigators say contained additional evidence.
• Privacy advocates have pointed out that the Global Device Identifier is sparsely documented, may persist across reinstalls, and can defeat network anonymity tools like VPNs, prompting concern over user consent.
• The case highlights how built-in OS telemetry can produce strong forensic leads in cybercrime probes and could prompt calls for clearer disclosure, tighter limits on device identifiers, or revised court rules on compelled data production.