Microsoft gave FBI a set of BitLocker encryption keys to unlock suspects' laptops: Reports

A report from Forbes confirms that Microsoft provided the FBI with BitLocker recovery keys to unlock encrypted data on three laptops seized as part of a federal fraud investigation. The case, which involves suspects accused of fraud related to the Pandemic Unemployment Assistance program in Guam, highlights a fundamental tension in modern computing: the convenience of cloud-managed encryption keys versus the privacy and security risks they introduce.

BitLocker is Microsoft's full-disk encryption technology, enabled by default on many modern Windows devices. When activated, it encrypts the entire drive, making data inaccessible without the correct key or recovery key. For years, Microsoft has offered a feature that automatically backs up BitLocker recovery keys to a user's Microsoft account in the cloud. This is intended as a safety net—if a user forgets their password or encounters a system error, they can retrieve the key from their account to regain access.

However, this convenience comes with a critical trade-off. By storing these keys in Microsoft's cloud, the company retains the technical capability to decrypt drives encrypted with BitLocker. As the Forbes report details, this capability was exercised in the Guam case. According to Microsoft, the company receives an average of 20 such requests from law enforcement annually.

The legal mechanism is straightforward. Law enforcement, in this case the FBI, serves Microsoft with a warrant. Microsoft then provides the requested recovery keys, which can be used to unlock the drives. The laptops in question were seized in 2023, and the warrant was served to Microsoft six months later, according to local reporting from Kandit News.

This scenario is not hypothetical. It represents a built-in backdoor, albeit one that requires a court order. The implications are significant for user privacy. While the process is legal and follows due process, it means that data protected by BitLocker is not immune to compelled decryption by the company that manages the keys.

The security implications extend beyond government requests. Matthew Green, a professor of cryptography at Johns Hopkins University, has long criticized this model. He points to the risk of a broader compromise of Microsoft's cloud infrastructure. "It’s 2026 and these concerns have been known for years," Green wrote in a post on Bluesky. "Microsoft’s inability to secure critical customer keys is starting to make it an outlier from the rest of the industry."

Green's concern is valid. Microsoft's cloud services have been targeted by sophisticated attackers in the past. If a malicious actor were to gain access to the database containing BitLocker recovery keys, they could theoretically unlock any drive whose key was stored there, provided they also had physical access to the drive itself. This creates a high-value target for cybercriminals and nation-state actors.

The practice also places Microsoft in a unique position compared to other encryption providers. Many security-focused applications and operating systems offer end-to-end encryption where the user alone holds the key, with no cloud backup option. Apple's FileVault, for example, can store recovery keys locally or in iCloud, but the user has explicit control over this choice. BitLocker's default behavior, however, is to back up the key to the Microsoft account unless the user actively opts out during setup.

This default setting is a design choice aimed at reducing user lockouts and support costs. For the average consumer, losing access to their entire hard drive due to a forgotten password is a catastrophic event. The cloud backup mitigates this risk. For journalists, activists, lawyers, and others with heightened privacy needs, however, this default presents a serious vulnerability.

The solution for privacy-conscious users is to manage their own keys. During the BitLocker setup process, users can choose to save the recovery key to a file, print it, or store it in an Active Directory domain. For individual users, saving the key to a USB drive or printing it and storing it in a secure location is the recommended practice. This ensures that the key is never uploaded to Microsoft's servers, eliminating the risk of compelled disclosure or cloud compromise.

The recent report serves as a reminder that the security of encrypted data is not just about the strength of the encryption algorithm. The management of the keys is equally, if not more, important. For millions of Windows users, the default configuration means their data's security is partially entrusted to Microsoft's cloud and its ability to resist both legal and illegal demands for access.

As encryption becomes more ubiquitous, the debate over key escrow and cloud backups will continue. The Microsoft case demonstrates that convenience and security are often in direct opposition, and the choices made by platform providers have profound consequences for user privacy.