Microsoft Windows 98 And Office 97 Software Serial Numbers Exposed

Online Newsletter, April, 1999

Just when you were concerned about Intel's Pentium III serial number exposing your ID - now Microsoft has admitted that the same holds true for its Windows 98 and Office 97 software products. In fact, the information provided to Microsoft is more invasive than that of Intel's product, allowing Microsoft to create a database of personal information about computer users. Unlike Intel's Pentium III, the Microsoft serial number is tied to an individual's name, numbers on the hardware, and to documents that are created.

The discovery was made by a computer programmer, Robert M. Smith, who is president of Phar Lap Software, Inc., a software tools development company. Microsoft responded the next day by issuing a letter to its customers.

In the letter, dated March 10, 1999, Microsoft admits that both Windows 98 and its Office 97 do indeed employ the use of serial numbers, and offers to explain how the information was only intended for development and technical support of these Microsoft products.

Microsoft indicated it is taking four specific actions for the Windows 98 Registration Wizard:

''1. Updating Microsoft.com immediately to stop receipt of hardware ID from product registration, thereby eliminating new occurrences of hardware ID.

2. Modifying the Windows 98 Registration Wizard feature in a subsequent service release of Windows 98 to ensure hardware identification data is never created, let alone sent, as part of the registration process.

3. Providing a software tool for download that users can use to delete hardware registration from the Windows registry.

4. Purging hardware ID information that was gathered without the customer having chosen to provide Microsoft with this information. We are confident today that the hardware information is not being stored in our marketing databases, and we are investigating whether it is being stored in other databases within Microsoft.''

For Office 97, Microsoft denied ''... that information gathered in the Windows registry is somewhat related or could be related to documents created in Office 97 (i.e. Word, Excel, PowerPoint, Access). The unique number inserted into Office 97 documents was designed to help third parties build tools to work with and reference Office 97 documents. There is no way to identify the author of an Office 97 document by examining the unique number generated for that document without intimate knowledge of the original PC network configuration - information that is available only to the owner of that machine.''

Two resources to correct Office 97 will be provided as free downloads by Microsoft in early April:

Office 97 Unique Identifier Patch - This patch, once applied, will prevent the insertion of a unique identifier number into all new Office 97 documents.

Office 97 Unique Identifier Removal Tool - This is a utility that can be used to remove the unique identifier from previously created Office 97 documents. Customers who are concerned about the presence of the unique identifier number can run the utility against any Office 97 document.

The free download Web site is at: http://officeupdate.microsoft.com

The forthcoming release of Office 2000 will not include the ability to insert the unique identifier in documents.