Microsoft Shared BitLocker Keys With FBI, Raising Privacy Fears

"Microsoft is under scrutiny after it emerged that the company shared encryption keys with US law enforcement, an uncommon move that has alarmed privacy experts and reignited the debate over who truly controls encrypted data. According to Forbes staffer Thomas Brewster, Microsoft provided the FBI with BitLocker recovery keys that allowed investigators to unlock data on three encrypted laptops. The request came through a valid search warrant issued in a federal investigation in Guam into alleged fraud in the island's COVID-19 unemployment assistance program."

"Microsoft confirmed the practice to Forbes. "While key recovery offers convenience, it also carries a risk of unwanted access, so Microsoft believes customers are in the best position to decide... how to manage their keys," Microsoft spokesperson Charles Chamberlayne said. Chamberlayne added that Microsoft receives around 20 requests for BitLocker keys each year, though many cannot be fulfilled because users did not upload their keys to the cloud."

"The laptops were protected by BitLocker, Microsoft's full-disk encryption software that is enabled by default on many modern Windows PCs. While BitLocker is designed to keep data safe from unauthorized access, the case shows that protection depends heavily on where the recovery key is stored. BitLocker users can store recovery keys locally on a USB drive or another device, but Microsoft also encourages users to back them up to its cloud for convenience. That option makes it easier to regain access if a password is forgotten, but it also means Microsoft can access the keys if served with a legal order."

Microsoft provided BitLocker recovery keys to the FBI under a warrant in a federal investigation in Guam into alleged COVID-19 unemployment-assistance fraud, allowing access to three encrypted laptops. The laptops ran BitLocker full-disk encryption enabled by default on many Windows PCs, but effective protection depends on where recovery keys are stored. Users can keep keys locally or back them up to Microsoft's cloud; cloud backups enable Microsoft to comply with legal orders for key disclosure. Microsoft says key recovery offers convenience but carries risk, that customers should decide how to manage their keys, and that it receives about 20 BitLocker key requests yearly.

Read at TechRepublic