Surrender as a service: Microsoft unlocks BitLocker for feds
- Reference: 1769200867
- News link: https://www.theregister.co.uk/2026/01/23/surrender_as_a_service_microsoft/
- Source link:
The government [1]case [PDF], which claims defendants in Guam fraudulently collected pandemic unemployment benefits, represents the first publicly known instance of Microsoft providing BitLocker keys, according to [2]Forbes .
[3]BitLocker is a Windows security system that can encrypt data on storage devices. It supports two modes: [4]Device Encryption , a mode designed to simplify security, and [5]BitLocker Drive Encryption , an advanced mode.
[6]
For either mode, Microsoft "typically" backs up BitLocker keys to its servers when the service gets set up from an active Microsoft account. "If you use a Microsoft account, the BitLocker recovery key is typically attached to it, and you can access the recovery key online," the company [7]explains in its documentation.
[8]
[9]
The situation is similar for managed devices. "If you're using a device that's managed by your work or school, the BitLocker recovery key is typically backed up and managed by your organization's IT department," the company says.
Microsoft provides the option [10]to store keys elsewhere . Instead of selecting "Save to your Microsoft Account," customers can "Save to a USB flash drive," "Save to a file," or "Print the recovery key."
[11]
But customers are encouraged to entrust keys to Microsoft because as long as they have access to the account online, they can recover the keys, effectively making Redmond their digital doorman. However, in such circumstances, customers no longer have total control over access to their data.
Apple offers a similar device encryption service called [12]FileVault , complemented by its [13]iCloud service . The iCloud service also offers an easy mode called "Standard data protection" and "Advanced Data Protection for iCloud."
With Standard data protection, Apple holds the encryption keys for iCloud data, with some exceptions (e.g. Passwords and Keychain). With Advanced Data Protection, the company has the keys only to iCloud Mail, Contacts, and Calendar.
[14]Microsoft 365 outage drags on for nearly 10 hours during bad night for North American infra
[15]Microsoft shifting to cloud management software brings possibility of it peeking into your estate
[16]AI conference's papers contaminated by AI hallucinations
[17]Cursor used agents to write a browser, proving AI can write shoddy code at scale
Both Apple and Microsoft, like other companies, comply with government information demands they determine to be lawful. But they can't provide keys they don't control.
Apple says as much in its [18]guidelines [PDF] for law enforcement: "All iCloud content data stored by Apple is additionally encrypted at the location of the server. For data Apple can decrypt, Apple retains the encryption keys in its US data centers. Apple does not receive or retain encryption keys for [a] customer's end-to-end encrypted data."
[19]
That's not the case with BitLocker, where Microsoft may have access to encryption keys for a customer's end-to-end encrypted data if the customer allowed that during setup.
Microsoft [20]explains that it does not provide governments with its own encryption keys. But it does not make that commitment with regard to its customers.
"We do not provide any government with our encryption keys or the ability to break our encryption," the company says in its law enforcement guidance. "In most cases, our default is for Microsoft to securely store our customers' encryption keys. Even our largest enterprise customers usually prefer we keep their keys to prevent accidental loss or theft. However, in many circumstances we also offer the option for consumers or enterprises to keep their own keys, in which case Microsoft does not maintain copies."
It's a clear message to activist organizations and law firms that Microsoft is not building their products for you.
According to Microsoft's most recent [21]Government Requests for Customer Data Report , covering July 2024 through December 2024, the company received a total of 128 requests from law enforcement organizations around the world, 77 of which came from US authorities. Only four of the requests during that period, three in Brazil and one in Canada, led to the disclosure of content.
Microsoft did not immediately respond to a request for comment. The company told Forbes that it receives around 20 requests for BitLocker keys per year and that it cannot provide those keys if customers have not entrusted them to Microsoft for cloud storage.
"Microsoft is making a tradeoff here between privacy and recoverability," said Erica Portnoy, senior staff technologist at the Electronic Frontier Foundation, in an email to The Register . "At a guess, I'd say that's because they're more focused on the business use case, where loss of data is much worse than Microsoft or governments getting access to that data. But by making that choice, they make their product less suitable for individuals and organizations with higher privacy needs. It's a clear message to activist organizations and law firms that Microsoft is not building their products for you." ®
Get our [22]Tech Resources
[1] https://storage.courtlistener.com/recap/gov.uscourts.gud.18672/gov.uscourts.gud.18672.114.0.pdf
[2] https://www.forbes.com/sites/thomasbrewster/2026/01/22/microsoft-gave-fbi-keys-to-unlock-bitlocker-encrypted-data/
[3] https://support.microsoft.com/en-us/windows/bitlocker-overview-44c0c61c-989d-4a69-8822-b95cd49b1bbf
[4] https://support.microsoft.com/en-us/windows/device-encryption-in-windows-cf7e2b6f-3e70-4882-9532-18633605b7df
[5] https://support.microsoft.com/en-us/windows/bitlocker-drive-encryption-76b92ac9-1040-48d6-9f5f-d14b3c5fa178
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aXP9kXTX7jwD_MtPnvb1tAAAAIM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[7] https://support.microsoft.com/en-us/windows/back-up-your-bitlocker-recovery-key-e63607b4-77fb-4ad3-8022-d6dc428fbd0d
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXP9kXTX7jwD_MtPnvb1tAAAAIM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aXP9kXTX7jwD_MtPnvb1tAAAAIM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://support.microsoft.com/en-us/windows/back-up-your-bitlocker-recovery-key-e63607b4-77fb-4ad3-8022-d6dc428fbd0d
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXP9kXTX7jwD_MtPnvb1tAAAAIM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://support.apple.com/guide/mac-help/protect-data-on-your-mac-with-filevault-mh11785/mac
[13] https://support.apple.com/en-us/102651
[14] https://www.theregister.com/2026/01/23/microsoft_365_outage/
[15] https://www.theregister.com/2026/01/23/microsoft_shifting_to_cloud_management/
[16] https://www.theregister.com/2026/01/22/neurips_papers_contaiminated_ai_hallucinations/
[17] https://www.theregister.com/2026/01/22/cursor_ai_wrote_a_browser/
[18] https://www.apple.com/legal/privacy/law-enforcement-guidelines-us.pdf
[19] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aXP9kXTX7jwD_MtPnvb1tAAAAIM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[20] https://blogs.microsoft.com/datalaw/our-practices/#what-do-you-do-encryption-keys
[21] https://www.microsoft.com/en-us/corporate-responsibility/reports/government-requests/customer-data
[22] https://whitepapers.theregister.com/
How can you not use an MS account in Windows these days?
And how can you be sure MS don't have a copy anyway?
No surprise here.
Sadly, if you want to take full advantage of several storage-features, you have to stick to bitlocker. At least we can still control it does NOT auto-store at MS, and if in doubt: Decrypt, change local policy, encrypt (don't forget to disable TPM option, and enable alphanumeric passwords for the boot drive). And yes, I deliberately ignore Windows Home here - look it up, you can control it there too of course, just not so simple.
Other encryptors have problems with snapshots, storage spaces (if used with encrypted veracrypt/diskcrypt/etc disks) or dynamic disks, deduplication and a few other things. Does not apply to normal users, but admins come across those things, and they cannot be solved.
A bit aside: We have more and more customers which deliberately do not want to save bitlocker recovery key into the local AD, simply 'cause an admin could export them all at once.
Yet another compliance nightmare
So now what?
Can't not encrypt your disk - anyone can read it if they steal your laptop.
Can't use Microsoft's bitlocker - the US government can read it
Can't use an open source encryption system - it's not been audited and certified by Laboratoire Garnier
You're worth it
BackBlaze
Backblaze doesn't publish data requests and warrant information that they receive. However, they say that all data is encrypted, and they _say_ that they don't have the encryption keys.
If you look at the strings in their exe, the private encryption key is transmit'ed to backblaze when it is configured and set up. They say they don't have it, they say that they can't recover your data if you lose your private key, but it's clear that they collect your private key when you create it with their app.
The article *says* that Microshaft is focused on the business users, who are less concerned about privacy, but they *require* home users (and not business users) to create a Macroshaft account, and they default to uploading your secret keys to their infrastructure - which is breached a couple times a year. I honestly feel more protected by AWS.
An extension of the state
Big tech makes decisions everyday that benefit the surveillance state. They are partners (in crime).
Even if a user selects the "option" to not send keys (or whatever), a bug will suddenly appear (or some upgrade error) that "accidentally" unchecks that option for the user. I'm surprised that anyone is surprised. How many billions of dollars do these companies get from our western "democratic" governments that *demand* backdoor access to every digital platform?
Hide
Anyone that anything serious to hide (especially from the government or LEA) shouldn't be using BitLocker. Use VeraCrypt (Windows, Mac, Linux) or LUKS (Linux) instead.