Microsoft BitLocker encryption keys provided to FBI, raising privacy concerns

As reported by The Register, Microsoft's BitLocker encryption, often perceived as a robust security measure, has come under scrutiny following revelations that the company reportedly provided encryption keys to the FBI, enabling access to users' encrypted laptops.

This incident, linked to a fraud indictment in Guam involving pandemic unemployment benefits, marks the first publicly known instance of Microsoft sharing BitLocker keys. BitLocker, a Windows security feature, encrypts data on storage devices. Microsoft typically backs up these encryption keys to its servers when users set up the service with a Microsoft account, or they are managed by an organization's IT department for managed devices. While users can opt to save keys to a USB drive or file, Microsoft encourages cloud storage for easier recovery, effectively acting as a digital custodian. This practice contrasts with Apple's FileVault, where the company's control over encryption keys is more limited, especially with advanced data protection options.

The situation highlights a critical trade-off between data recoverability and user privacy. Microsoft states it complies with lawful government demands but emphasizes it does not provide its own encryption keys or the ability to break encryption, differentiating between its keys and customer-held keys.

Source: The Register