Microsoft has complied with a US federal warrant to hand over encryption keys that unlocked data stored on three laptops, generating a backlash from privacy advocates.
The move, part of an FBI investigation into suspected COVID unemployment assistance fraud in Guam, comes at a time when European countries are increasingly skeptical about storing their data with US providers.
The company has previously pushed back against government proposals for access and backdoors, yet this case is reportedly the first known instance in which it has provided any encryption key to law enforcement.
How Microsoft’s Key Storage Policy Works
Microsoft’s approach to encryption key management offers customers flexibility, but that flexibility comes with significant trade-offs.
The company allows customers to choose where their BitLocker recovery keys are stored: locally, on their own infrastructure where Microsoft cannot access them, or in Microsoft’s cloud, where the company can assist with key recovery.
Charles Chamberlayne, a Microsoft spokesperson, explained that the cloud storage option exists for customer convenience.
“We recognize that some customers prefer Microsoft’s cloud storage so we can help recover their encryption key if needed. While key recovery offers convenience, it also carries a risk of unwanted access,”
Chamberlayne said.
The company emphasized that it complies only with valid legal orders and that customers who prioritize security can opt to manage their own keys locally. This means Microsoft would have nothing to hand over, even if presented with a warrant.
However, the company confirmed it will provide BitLocker available recovery keys when presented with valid legal orders.
Senator Ron Wyden of Oregon criticized the announcement, calling it “irresponsible” for companies to “secretly turn over users’ encryption keys.”
Data Control Amid Digital Sovereignty Concerns
This revelation comes at a precarious moment for Microsoft’s international business, particularly in Europe, where digital sovereignty movements have gained momentum. Cooling relations between the US and European nations have prompted governments to reconsider their dependence on American technology providers.
Authorities in Denmark and Germany have already announced plans to migrate away from Microsoft’s productivity suite, citing both escalating costs and sovereignty concerns. The knowledge that Microsoft will comply with US law enforcement requests for access stands to fuel these worries.
