Microsoft provided the FBI with recovery keys to unlock encrypted data on the hard drives of three laptops as part of a federal investigation, Forbes reported on Friday.
Many modern Windows computers rely on full-disk encryption, called BitLocker, ie enabled by default. This type of technology should prevent anyone but the owner of the device from accessing data if the computer is locked and turned off.
However, by default, BitLocker recovery keys are uploaded to Microsoft’s cloud, allowing the tech giant – and by extension law enforcement – to access and use them to decrypt BitLocker-encrypted drives, as was the case reported by Forbes.
The case involved several people suspected of fraud related to the Pandemic Unemployment Assistance program in Guam, a US island in the Pacific. Local news outlet Pacific Daily News closed small last year, a report that warrants has been implemented for Microsoft in relation to the suspect hard drive. Kandit News, another local Guam news outlet, also reported in October the FBI requested a six-month warrant after seizing three laptops encrypted with BitLocker.
A Microsoft spokesperson did not immediately respond to a request for comment by TechCrunch. Microsoft told Forbes that the company sometimes provides BitLocker recovery keys to authorities, with an average of 20 such requests per year.
Apart from the privacy risks of handing over recovery keys to companies, Johns Hopkins professor and cryptographer Matthew Green raising potential scenarios where malicious hackers compromise Microsoft’s cloud infrastructure – something that has happened many times in recent years – and gained access to that recovery key. Hackers still need physical access to the hard drive to use the stolen recovery key
“It’s 2026 and this concern has been known for years,” Green wrote in a post on Bluesky. “Microsoft’s inability to secure critical customer keys is starting to distance itself from the rest of the industry.”
Techcrunch event
San Francisco
|
13-15 October 2026