Microsoft Reminds Users That 'Your' Encrypted Data Was Always 'Our' Encrypted Data All Along

In what cybersecurity researchers are describing as "the most devastating reminder since your phone asked if you wanted to share your location with a flashlight app," Microsoft has confirmed that it handed over BitLocker encryption recovery keys to the FBI last year, finally clarifying for millions of Windows users that the possessive pronoun in "your encrypted data" was always more of a suggestion than a technical reality.

The revelation, first reported by Forbes, marks the first publicly known case of Microsoft providing law enforcement with the keys to BitLocker—the encryption software that comes enabled by default on many Windows PCs and has long been marketed as a way to protect users' data "in case it's lost or stolen." The company's marketing materials have not yet been updated to add "or subpoenaed."

"While key recovery offers convenience, it also carries a risk of unwanted access," a Microsoft spokesperson told reporters, using the same tone typically reserved for explaining that the complimentary hotel breakfast does not include the $47 omelet. "Microsoft believes customers are in the best position to decide how to manage their keys."

The specific case involved a federal investigation into pandemic unemployment fraud in Guam, where the FBI obtained recovery keys for three laptops seized during a raid. Microsoft reportedly complied within days—a response time that users who have waited on hold with Microsoft support for seven hours to recover their own accounts are calling "interesting."

Matthew Green, a cryptography expert at Johns Hopkins, took to Bluesky to express concern over how easy the process appeared to be. "Once upon a time you could assume (mostly) that any Federal law enforcement agency doing this would be operating within the bounds of the law," Green wrote. "Nowadays, who knows. I sure wouldn't want to be a journalist relying on BitLocker."

He also warned that "anyone who compromises their cloud infrastructure (and customer service infrastructure, or can forge a plausible LE request) can potentially access that data"—a sentence that will surely comfort the 1.4 billion people currently using Windows devices.

Microsoft disclosed that it receives approximately 20 requests for BitLocker recovery keys each year, but cannot comply when keys aren't backed up to the cloud—a revelation that has prompted thousands of users to suddenly remember that Microsoft "strongly encouraged" them to back up their keys during Windows setup, positioned right after the "Skip" button that was inexplicably grayed out.

Industry analysts note that the news shouldn't surprise anyone who has read Microsoft's terms of service, a document that Microsoft's own readability analysis tools estimate would take approximately 76 minutes to complete and which 99.97% of users have agreed to without opening.

"The encryption was working perfectly," explained Dr. Helena Vance, a cryptography researcher at Johns Hopkins. "It just wasn't working for the person who thought they owned it. Classic escrow model confusion. Users assumed 'encrypted' meant 'encrypted from everyone.' It actually meant 'encrypted from everyone except the people who wrote the encryption software, anyone they decide to share the keys with, and anyone who can convince them to share the keys.'"

The Electronic Frontier Foundation released a statement calling the situation "a stark reminder that cloud-based key backup is not the same as user-controlled encryption," adding that users who wish to maintain actual control over their encrypted data should "use open-source encryption tools, manage their own keys locally, and accept that they will receive zero customer support when they inevitably forget their password in 2027."

Microsoft's stock price remained unchanged on the news, as investors appeared to correctly anticipate that the revelation would have approximately zero impact on consumer behavior, a prediction based on the historical precedent of every previous technology privacy scandal since 2004.

At press time, Microsoft had announced plans to rename BitLocker to "BitLocker*" with a footnote reading "subject to lawful access requests," though company representatives stressed this was "purely a transparency measure" and "definitely not something our lawyers suggested after reviewing this article."