Microsoft handed the government encryption keys for customer data
The FBI came to Microsoft last year with a warrant, asking it to turn over keys to unlock encrypted data stored on three laptops as part of an investigation into potential fraud involving the COVID unemployment assistance program in Guam — and Microsoft complied.
Typically, companies are reluctant to hand over encryption keys to authorities. Most famously, Apple refused to give the FBI access to a phone used by the San Bernardino shooters in 2016. The FBI eventually found a third party to hack the phone, but ultimately withdrew its case. Most major tech companies, including Google and Facebook, have supported Apple in its battle against the FBI. Even Microsoft supported Tim Cook’s position, although less forcefully than others.
In this case, however, it seems that Microsoft has decided to comply with the government’s demands and has confirmed Forbes that it “provides BitLocker recovery keys if it receives a valid legal order.” Microsoft spokesperson Charles Chamberlayne said The edge that Microsoft is legally required to produce the keys stored on its servers.
Chamberlayne explained: “Customers can choose to store their encryption keys locally, in a location inaccessible to Microsoft, or in the Microsoft cloud. We recognize that some customers prefer Microsoft cloud storage so that we can help them recover their encryption key if necessary. While key recovery is convenient, it also carries the risk of unwanted access.”
Sen. Ron Wyden of Oregon responded by saying Forbes that it was “irresponsible” for companies to “secretly hand over users’ encryption keys.”
What worries privacy advocates like the ACLU is the precedent this sets and the potential for abuse. The current administration and ICE have shown little respect for data security or the rule of law. And beyond U.S. borders, Jennifer Granick, surveillance and cybersecurity advisor at the ACLU, said: Forbes that “foreign governments with questionable human rights records” can also expect Microsoft to hand over the keys to customer data.
