Stokes allegedly hid his device behind a virtual private network (VPN) server which he then used to open an account on the ngrok secure tunnelling service.
But doing so did not mask the unique GDID of the Windows installation he used.
Microsoft identified that GDID for investigators after a court order, based on ngrok’s time-stamped access records.
Back then, we used to call those “script kiddies”.