Microsoft Gave FBI a Set of BitLocker Encryption Keys To Unlock Suspects' Laptops (techcrunch.com) 87
An anonymous reader quotes a report from TechCrunch: Microsoft provided the FBI with the recovery keys to unlock encrypted data on the hard drives of three laptops as part of a federal investigation, Forbes reported on Friday. Many modern Windows computers rely on full-disk encryption, called BitLocker, which is enabled by default. This type of technology should prevent anyone except the device owner from accessing the data if the computer is locked and powered off.
But, by default, BitLocker recovery keys are uploaded to Microsoft's cloud, allowing the tech giant -- and by extension law enforcement -- to access them and use them to decrypt drives encrypted with BitLocker, as with the case reported by Forbes. The case involved several people suspected of fraud related to the Pandemic Unemployment Assistance program in Guam, a U.S. island in the Pacific. Local news outlet Pacific Daily News covered the case last year, reporting that a warrant had been served to Microsoft in relation to the suspects' hard drives.
Kandit News, another local Guam news outlet, also reported in October that the FBI requested the warrant six months after seizing the three laptops encrypted with BitLocker. [...] Microsoft told Forbes that the company sometimes provides BitLocker recovery keys to authorities, having received an average of 20 such requests per year.
But, by default, BitLocker recovery keys are uploaded to Microsoft's cloud, allowing the tech giant -- and by extension law enforcement -- to access them and use them to decrypt drives encrypted with BitLocker, as with the case reported by Forbes. The case involved several people suspected of fraud related to the Pandemic Unemployment Assistance program in Guam, a U.S. island in the Pacific. Local news outlet Pacific Daily News covered the case last year, reporting that a warrant had been served to Microsoft in relation to the suspects' hard drives.
Kandit News, another local Guam news outlet, also reported in October that the FBI requested the warrant six months after seizing the three laptops encrypted with BitLocker. [...] Microsoft told Forbes that the company sometimes provides BitLocker recovery keys to authorities, having received an average of 20 such requests per year.
Clickbait title (Score:5, Informative)
And yeah of course Microsoft gave them the keys they would have had a warrant.
At least I hope they had a warrant. It's 2025 and that's not a guarantee anymore.
draining the swamp (Score:4, Funny)
Warrants are a form of wasteful bureaucracy that our strong, intelligent government is removing.
Re:Clickbait title (Score:5, Insightful)
However, I *can* say that it has saved my ass before. This is because anything that makes a change to your SecureBoot environment (like, from linux for example- which is what happened to me) will render Windows unbootable without a recovery key, and if you didn't bother to save it, you're in for a bad time.
Re: (Score:2)
If you
don't trust them to fully delete [the old keys]
then why exactly would you trust the setup wizard not to send your new key to MS?
Re: (Score:2)
because most "delete me" type requests already have a carve out for backups. And deleting just might break in that someone may forget to wipe all the places it's been stored.
So even outside of malfeasance, it's more likely the "don't send" is safer than counting on a delete.
Re: (Score:2)
Re: (Score:2)
This is because anything that makes a change to your SecureBoot environment (like, from linux for example- which is what happened to me) will render Windows unbootable without a recovery key, and if you didn't bother to save it, you're in for a bad time.
That happened to me with a super cheap laptop I bought temporarily while I was waiting for a proper replacement to arrive. I set up windows and just went ahead and created a throwaway microsoft account to get through the install. I was going to set it up to dual boot Linux, though I didn't have a lot of use for the windows partition. I ran into exactly the problem you mentioned after the Linux install. At that point it turned out that, although I had recorded the password I set up for the Windows account, I
You can still install without MS account (Score:1)
Install, patch, configure, setup Bitlocker. Take a screenshot of the recovery code and store it on an encrypted flash drive.
After all that is done, then install Office, Visual Studio, and the other apps that will require an MS account. I recall a pr
Re: (Score:2)
Just to clarify, dmb was not advocating setting up a windows account.
Re: (Score:2)
Eh, sometimes you get forced to use something or other that you have to run Windows for rather than struggle to work around it. So you dual boot and have a windows partition that you never boot into (and you shouldn't if you can avoid it because it seems like it constantly messes up the bootloader in one way or another, forcing you to fix it). Also, to be clear, dmb was talking about how to set it up without a windows account, which I do know how to do, I just didn't bother because the laptop was a piece of
Re: (Score:2)
Sure, but I didn't bother because I just wanted to get the stupid setup out of the way, but still thought I would hold on to windows for dual-boot. Then it bricked (for a definition of "bricked" defined as I just sighed deeply and couldn't be bothered to deal with the stupidity of it all after a relatively brief attempt since it was a cheap piece of junk anyway) itself. The thing was the laptop equivalent of the loaner car you get from the garage while waiting for them to repair your car. It just wasn't wor
Re: Clickbait title (Score:1)
I don't even create an MS account, and simply put the key file on my proton storage.
Re: (Score:2)
Re: (Score:1)
Is this a surprise? (Score:2)
I know MS has my keys. They're attached to the accounts. Every day, I get closer to switching to linux desktop.
Re:Is this a surprise? (Score:4, Informative)
If you're paranoid, you can remove them, disable bitlocker, re-enabled it and this time choose not to send MS your keys.
Re: Is this a surprise? (Score:2, Interesting)
Paranoid would be assuming they have the keys whether you give permission or not. Assuming they don't is stupid since Windows is spyware and Microsoft is part of PRISM.
Re: (Score:2)
Paranoid would be assuming they have the keys whether you give permission or not.
You're not wrong. If you're that paranoid- you should not use Windows, period.
Assuming they don't is stupid since Windows is spyware and Microsoft is part of PRISM.
This is tinfoil hat, territory.
If they retain the keys after you opt-out, no membership to any executive program will save them from the litigation they will face.
So no, I very much doubt they're retaining them if you specifically opt-out.
Re: (Score:2)
Re: (Score:2)
Again, this is easy to determine. You can legally wireshark your own network and look at the traffic. If MS were doing this, they would already be caught and it would be public.
Re: (Score:3)
Windows connects back to MS frequently during regular usage.
Wireshark, sadly not being enabled by Shor's Algorithm, is powerless to decrypt even mundane TLS.
So no- that's not going to help you sleep for one minute if you're that level of paranoid.
Re: (Score:2)
Assuming they don't is obvious since keys on accounts are user manageable, and Microsoft having keys they claim they don't would end their cloud business overnight.
Why does Slashdot not believe the moon landing is fake and that the FBI didn't bomb the world trade centre, but as soon as Microsoft is mentioned every nutbag conspiracy theory comes out of the woodworks, despite there having been zero historical evidence to form a basis for the conspiracy. PRISM did not magically mean companies broke their own e
Re: (Score:1)
PRISM did not magically mean companies broke their own encryption or secretly hoovered up a trove of keys. It meant that they provided NSA access when requested (warrantless).
Never forget Qwest [wikipedia.org].
Maybe instead of switching from Windows to Linux you people should switch from houses to rooms with pillows for walls.
Maybe instead of pretending Windows is good because you have a hard-on for Bill Gates (who could resist him after the teen beat shoot?) you can just admit you've been backing bullshit.
Re: Is this a surprise? (Score:4)
If you can't form an argument without a personal attack, you are obviously losing the argument.
Just an FYI
Re: Is this a surprise? (Score:1)
Re: (Score:2)
Easy enough to determine. Wireshark while you are doing it and look for the traffic. They would already have been called out.
Re: (Score:2)
There is plenty of chatter to hide the data in.
Re: (Score:2)
Re: (Score:2)
I've never used the Authenticator, but the recovery keys for your Bitlocker is device specific, and easily deleted.
Re: (Score:2)
Can you?
I tried to delete the passwords which Microsoft Authenticator uploaded from my phone, because I am not using it. They don't let me.
Did they not let you because it's already gone? Microsoft Authenticator's password manager is gone, it's now a function of Edge and managed through Edge. Delete it from Edge and it deletes it from the MS account, since Edge sync is the only place passwords are kept.
Secondly this has nothing to do with Bitlocker, the keys of which are managed under your device management section of your account, and every key as a delete button next to it.
Re: (Score:2)
Wish I had mod points.
Re: (Score:2)
Re: (Score:2)
and delete them from your MS account.
Yeah, right. I can also unformat my hard drive.
Nothing is ever deleted... (Score:2)
So nuke it, disable bitlocker, then re-enable it with a new key that isn't shared. Well, it's probably still shared. Microsoft can't be trusted.
Re: (Score:2)
There are alternatives to BitLocker and/or whole drive encryption (or partial drive encryption). VeraCrypt is one. Although I haven't checked up with that software for quite a while now.
Re: (Score:2)
Setup Wireshark and then do all that, you will have your answer. Do you think they can somehow hide their traffic on your network?
It's not hard, So not hard that we would have heard about it.
Re: (Score:2)
and also print them out on a piece of paper and stick it in a safe or safe deposit box , of that's how you roll. would still be susceptible to subpoena and warrant, but little worry about remote exploit
Re: (Score:2)
Re: (Score:2)
Or, rather than pen/paper, save it on a text file that's saved not on the SSD, but on a removable USB drive. That way, it's completely in your control, but also convenient enough to retrieve should you need to reinstall on another laptop
Well previously i just printed it but pen and paper is ok too.
USB drives have surprisingly short data retention lifetimes. i haven't used them enough to experience bitrot myself, but don't count on them for more than a couple of years for stuff you'll be sorry to lose. so ALSO write it/print it or you may have a bad time.
BitLocker is fake disk encryption (*) (Score:4, Insightful)
Look at LUKS, you control the passphrase, and if you choose, additive keys, and that means if law enforcement needs your drive, they can't side step you. The fact Microsoft can hand over the keys makes BitLocker functionally useless, and, really cuts to the core of the Microsoft security model. It's secure, providing you don't question it, or, examine it, and that's a major issue.
Re:BitLocker is fake disk encryption (*) (Score:4, Insightful)
The fact Microsoft can hand over the keys makes BitLocker functionally useless,
If your only goal is to hide things from the police, who have a warrant. Criminals and ex-wives generally have a hard time getting those warrants.
It's good for what it's good for, which is not everything.
Re: (Score:2)
Re: (Score:2)
well Hopefully the Fifth Amendment keeps the government from keeping you in jail until you unlock your PW manager for then
Re: (Score:2)
Usually you'll do 60 days at County for contempt or some horseshit like that.
Despite Circuit Court opinion that passphrases are fifth-amendment protected.
Hardware and biometrics are not protected.
Sometimes 60 is the best option you'll get, especially if you're a whistleblower against criminal government actions.
Re: (Score:2)
What's in these files?
1. Consensual, legal, adult content, that I locked up when my kids were younger.
It has collections
Re: (Score:2)
You assume that a) the keys will not be leaked by the police and b) that the police will only use them for legitimate law enforcement purposes.
Re: (Score:2)
He is also assuming that
c) a bad actor at Microsoft doesn't disclose the keys without a warrant
d) Microsoft's servers aren't hacked and then the keys are disclosed
And there are probably some other possibilities as well. Just assuming that because you want to protect your data, including from Microsoft, means you are doing something illegal and want to "hide it from the police", is a bad-faith argument.
Re: (Score:2)
> If your only goal is to hide things from the police, who have a warrant.
How comfortable would you be with Chinese developed encryption systems, where the Chinese company held the keys, if you were say American or European?
Now, how comfortable do you think it makes non-americans that an american company holds the encryption keys. Especially with the current US administration and how they treat other countries ...
Re:BitLocker is fake disk encryption (*) (Score:4, Insightful)
Re: (Score:2, Flamebait)
Re: (Score:2)
Sorry but your post is misinformation horseshit. There is no asterisk. There is no assumption. You are explicitly prompted to upload the keys. It's not a default. It's a selection screen with no pre-highlighted option.
Calling Bitlocker fake, even with an asterisk is just a lot of flamebait rubbish at best and outright misinformation at worst.
Re: (Score:2)
Re:BitLocker is fake disk encryption (*) (Score:4, Insightful)
If you believe that Microsoft follows its own policies and the closed-source code is doing what you tell it to do.
It is highly probably it is, but, in the end, we really don't know 100% for certain. It might forward that stuff to 3-letter agencies without your consent or knowledge. And/or it might have some super-secret back door set of keys.
Re: (Score:2)
This isn't a policy, this is the action of the software. You're given three options: upload to account, print, or save to file. The idea that someone is secretly uploading encryption keys without prompt to accounts is just "FBI bombed the world trade centre" level of conspiracy bullshit.
There's zero evidence for any of that, and Microsoft would be untold amount of legal trouble if they did. Please, engage the logical part of your brain, not just the creative one.
Re: (Score:2)
This isn't a policy, this is the action of the software. You're given three options: upload to account, print, or save to file. The idea that someone is secretly uploading encryption keys without prompt to accounts is just "FBI bombed the world trade centre" level of conspiracy bullshit.
There's zero evidence for any of that, and Microsoft would be untold amount of legal trouble if they did. Please, engage the logical part of your brain, not just the creative one.
You are misinformed. If you sign into windows with a Microsoft account it will automatically complete device encryption and send your key to Microsoft without asking.
Re: (Score:2)
This is correct. You have no say over the encryption if you initially setup your account with an MS account.
You can still delete your key from MS. Or decrypt and re-encrypt your drive with a new key to get that choice.
Re: (Score:2)
Re: (Score:2)
I hope Microsoft has redundant offsite offline backups for its Cloud data, for disaster recovery.
It would be professional misconduct if they didn't.
That being the case, it's not clear how long it would be from the time you delete your cloud keys until Microsoft cannot respond to a subpoena.
Re: (Score:2)
That is true, nothing happens instantly on intune
Re: (Score:2)
Re: (Score:2)
Microsoft can only hand over the keys that you have saved in your online Microsoft Account. When you're setting up Bitlocker you're given the choice to do that or to save them as a file or to just see the key to write it down. You don't have to upload them to your MS Account and if you do you can still delete them from it.
Prompting depends on edition of windows. Bitlocker (e.g. "Device Encryption") automatically uploads your key without asking for home users.
Re: (Score:2)
Same old rules (Score:2)
Gave is the wrong word in the title. (Score:1)
Re: (Score:2)
The FBI used a subpoena or warrant to obtain the private keys.
I'm quite sure not everyone's encryption keys would be so easy to obtain with a piece of paper
Wait a second! (Score:1)
Wasn't there a story on Slashdot a few years back where Joe Average requested help from Microslop to gain access to their BitLocker keys after being locked out due to an update or hardware change, but was told in no uncertain terms that this was impossible as Microslop does not have access to them even if they were uploaded to the cloud.
Doesn't this now make that story a farce?
Re: (Score:1)
With windows 11, bitlocker is now on by default on new installs. With the default options, the keys are automatically backed up to your microsoft account during the installation process. You still have the option to self manage the encryption keys, but it is not t
Re: (Score:2)
Wasn't there a story on Slashdot a few years back where Joe Average requested help from Microslop to gain access to their BitLocker keys after being locked out due to an update or hardware change, but was told in no uncertain terms that this was impossible as Microslop does not have access to them even if they were uploaded to the cloud.
Doesn't this now make that story a farce?
When bitlocker keys are uploaded they are done so with the explicit purpose of letting the user access their hardware. It's literally what it's there for. Just log into your Microsoft account, click Devices, select your device, select manage bit locker keys, and you can literally read them off the screen. If they are part of your account they are there for you to access from any device historically (my account has bitlocker keys I've not used since 2014 in it).
Bitlocker keys aren't automatically uploaded to
Re: (Score:2)
When bitlocker keys are uploaded they are done so with the explicit purpose of letting the user access their hardware.
You mean access their data.
It's literally what it's there for.
Apparently they are "literally" there for more than just users accessing their data according to TFA.
Just log into your Microsoft account,
This is a nonstarter.
Bitlocker keys aren't automatically uploaded to the cloud, they are manually uploaded by user choice. I suspect the article you're remembering has a user who did *not* cloud sync their bitlocker keys, at which point MS has nothing to hand over.
Incorrect, for home users keys are automatically uploaded.
And how long (Score:2)
before they're for sale on the dark net? A few months? Less?
Warrants (Score:3)
At least I hope they had a warrant.
Over 98 percent of warrants are approved the first time, and the other 2 percent are usually approved after some administrative issue with the warrant is fixed.
Warrants are trivial to procure, and provide no protection to you whatsoever.
If a warrant is issued, and nothing is found, nobody is punished. So they issue them as a matter of procedure since it is better to be safe than sorry. At least in their eyes.
The Imitation Game (Score:1)
Re: (Score:2)
And all non-free operating systems can push updates to users. And the free ones can at least hope that you install them yourself.
Microsoft: Proven since XP that they can install updates on user's PCs without their mechanism (one time they pushed one to fix broken Windows update). Can be targeted at single users.
iOS: Appstore/Services stuff in the background. Can be targeted at single users.
Google: Playstore/Services stuff in the background. Can be targeted at single users.
Redhat/Canonical: Probably harder t
Re: (Score:1)
How many people know MS has the keys (Score:2)
A lot of people use computers as tools to do their work without doing any deep research. They might reasonably expect that an "encrypted" drive didn't provide keys to a 3rd party and use it to store proprietary or otherwise protected information. An attorney pursuing a case against Microsoft might be surprised to learn that they can access all of his notes.
I'm sure the information that MS has the keys is included somewhere in the vast EULAs but I also bet that very few non-technical users are aware of tha
But (Score:1)