Did Microsoft provide encryption keys to law enforcement?

Yes, Microsoft confirmed providing BitLocker recovery keys to investigators in a case involving alleged fraud in Guam.

Can encrypted data be accessed by third parties?

The incident involving Microsoft's BitLocker keys suggests that encrypted data may not always be inaccessible, especially if the provider holds the decryption keys.

How can users ensure their data is truly private?

Users must actively manage and control their encryption keys, preferably by storing them offline or using services with client-side encryption, to maintain true data sovereignty.

Home / Technology / Microsoft's Keys Unlock Your Private Data

Microsoft's Keys Unlock Your Private Data

5 Feb

•

Summary

Microsoft provided BitLocker recovery keys to law enforcement.
Encryption doesn't guarantee data inaccessibility.
Users must control their encryption keys for true privacy.

Microsoft's Keys Unlock Your Private Data

A federal investigation in Guam has brought to light that Microsoft provided BitLocker recovery keys to law enforcement. This allowed investigators to access encrypted data on laptops allegedly linked to COVID-19 unemployment fraud. The incident underscores that encryption does not always ensure data inaccessibility. Microsoft stated it complies with such requests when users store keys in the cloud, receiving approximately 20 requests annually.

Experts argue that the issue lies not with encryption itself, but with key control. When a provider holds both encrypted data and decryption keys, user control is diminished. Companies like Apple and Google offer alternative approaches, limiting their own access to customer data. Microsoft acknowledges the convenience of cloud key storage but warns of potential unwanted access, asserting customers should decide on key management.

This case reignites the debate between lawful access and systemic risk. Centralized systems holding customer data are prone to failure and become targets. True personal data sovereignty, experts contend, requires systems where compelled access is technically impossible. Users must be intentional about where their encryption keys are stored, preferring offline methods or services offering client-side encryption for maximum privacy.