\n<\/p>\n
Microsoft provided the FBI with the recovery keys to unlock encrypted data on the hard drives of three laptops as part of a federal investigation, Forbes reported on Friday.<\/p>\n
Many modern Windows computers rely on full-disk encryption, called BitLocker, which is enabled by default. This type of technology should prevent anyone except the device owner from accessing the data if the computer is locked and powered off.\u00a0<\/p>\n
But, by default, BitLocker recovery keys are uploaded to Microsoft\u2019s cloud, allowing the tech giant \u2014 and by extension law enforcement \u2014 to access them and use them to decrypt drives encrypted with BitLocker, as with the case reported by Forbes.<\/p>\n
The case involved several people suspected of fraud related to the Pandemic Unemployment Assistance program in Guam, a U.S. island in the Pacific. Local news outlet Pacific Daily News covered the case last year, reporting that a warrant had been served to Microsoft in relation to the suspects\u2019 hard drives. Kandit News, another local Guam news outlet, also reported in October that the FBI requested the warrant six months after seizing the three laptops encrypted with BitLocker.\u00a0<\/p>\n
A spokesperson for Microsoft did not immediately respond to a request for comment by TechCrunch. Microsoft told Forbes that the company sometimes provides BitLocker recovery keys to authorities, having received an average of 20 such requests per year.\u00a0<\/p>\n
Apart from the privacy risks of handing recovery keys to a company, Johns Hopkins professor and cryptography expert Matthew Green raised the potential scenario where malicious hackers compromise Microsoft\u2019s cloud infrastructure \u2014 something that has happened several times in recent years \u2014 and get access to these recovery keys. The hackers would still need physical access to the hard drives to use the stolen recovery keys.<\/p>\n
\u201cIt\u2019s 2026 and these concerns have been known for years,\u201d Green wrote in a post on Bluesky. \u201cMicrosoft\u2019s inability to secure critical customer keys is starting to make it an outlier from the rest of the industry.\u201d<\/p>\n