Microsoft Provided Government Access to Customer Data Encryption Keys

Last year, the FBI approached Microsoft with a warrant, requesting access to encryption keys for three laptops as part of an investigation into potential fraud related to the COVID unemployment assistance program in Guam. Microsoft complied with this request.

In general, tech companies are often reluctant to provide encryption keys to law enforcement. A notable example is Apple, which famously resisted the FBI’s demand for access to a phone used by the San Bernardino shooters in 2016. The FBI eventually found a third party to bypass the phone’s security but later dropped the case. Many major tech firms, including Google and Facebook, supported Apple during this conflict, and Microsoft also backed Tim Cook’s stance, albeit with less intensity than some others.

In this case, however, Microsoft has chosen to comply with government requests, confirming that it “does provide BitLocker recovery keys if it receives a valid legal order.” A Microsoft spokesperson stated that the company is legally obligated to produce the keys stored on its servers.

The spokesperson further explained that customers have the option to store their encryption keys locally, in a location inaccessible to Microsoft, or in Microsoft’s cloud. While cloud storage can facilitate key recovery, it also poses a risk of unauthorized access.

Senator Ron Wyden of Oregon criticized this approach, calling it “irresponsible” for companies to “secretly turn over users’ encryption keys.” Privacy advocates, including those from the ACLU, are concerned about the implications of this decision and the potential for misuse. They point out that the current administration and ICE have shown little regard for data security or legal standards. Additionally, Jennifer Granick, a surveillance and cybersecurity counsel at the ACLU, warned that “foreign governments with questionable human rights records” might also expect Microsoft to surrender keys to customer data.