The point of encrypting data is to prevent unauthorized third parties from viewing it. This is a point of contention between companies like Apple and Google and law enforcement, where both companies essentially give users the keys to decrypt their data. This means that even if law enforcement demanded it from Apple or Google, they couldn’t hand that over if they wanted to. Unfortunately, that’s a different case with Microsoft, where the company recently handed over the encryption keys to BitLocker to the FBI .
Microsoft hands FBI encryption keys for BitLocker
If you’re a Windows user running a relatively modern device, chances are your hard drive might be encrypted using Microsoft’s BitLocker technology. The idea is that all your data is protected as long as the computer is locked and powered off. This is a similar concept to security systems you find on iOS and Android. The contents of the phone are encrypted until the device is unlocked using a PIN, passcode, or a biometric scan.
However, there is a slight difference here. With Microsoft’s BitLocker, the recovery keys are uploaded to Microsoft’s cloud by default. This means that if law enforcement were to come knocking, like the FBI, Microsoft could hand over the encryption keys. This is exactly what happened during a recent FBI investigation in Guam.
Law enforcement officials were trying to recover evidence on laptops related to the island’s Covid unemployment assistance program. It is believed that there was a plot to steal those funds. However, the data on the laptops were protected by BitLocker. But after being presented with a warrant, Microsoft was able to hand over the keys.
So should you keep using BitLocker?
If you’re worried about your data and privacy being at risk, we get it. At a glance, it sounds like Microsoft is able to hand over the encryption keys if presented with a warrant. However, you can rest assured that isn’t always going to be the case.
Like we said, by default, BitLocker’s recovery keys are sent to Microsoft’s cloud. For those unfamiliar, a recovery key is when you need to decrypt data but you forgot the PIN/password to your device. This is a last resort kind of situation. Storing it in the cloud means that you can access it whenever you want. This is versus writing it down on a piece of paper, which could be easily misplaced.
However, the trade-off is that in the event law enforcement requests it, if your recovery key happens to be stored in the cloud, then that’s too bad. If you feel uneasy about Microsoft keeping your recovery key, you can find out how to manage it yourself from this Microsoft support page .
