Microsoft says it has never given disk encryption keys to a US government agency, despite backing up recovery keys to cloud since 2013
Lorenzo Franceschi-Bicchierai / Motherboard :
Context & Ripple Effects
Microsoft's denial closes a loop The Intercept opened: in mid-2015 the outlet pressed the company on BitLocker and it declined to answer directly whether backdoors existed, then reported in December that [[a:862508|Windows 10 uploads disk encryption keys to Microsoft by default, with Home users able only to delete the copy while Pro and Enterprise users can opt out]].
The 2016 statement draws a line between voluntary handover and compelled disclosure — a distinction the company itself later collapsed when it [[a:1162070|confirmed it provides BitLocker recovery keys whenever a valid legal order arrives and the keys sit on its servers]].
First-order effects
- Windows 8/10 Home users learn their recovery keys were escrowed to Microsoft accounts without an opt-out, so the 'never gave keys' assurance governs only what happens after escrow.
- Microsoft converts an unanswered security question into a testable policy position, handing journalists like Lorenzo Franceschi-Bicchierai a specific claim to verify.
Second-order effects
- Scrutiny shifts from whether Microsoft holds keys to what legal process can reach them — precisely the question the company answered affirmatively years later.
- Pro and Enterprise editions gain a concrete selling point over Home: only those SKUs let users prevent key upload, tying encryption control to product tier.
Third-order effects
- If cloud key escrow remains the default, the practical strength of consumer disk encryption rests on vendor compliance with lawful orders rather than cryptography, making opt-out availability a pricing feature instead of a security baseline.
The trend: Consumer disk encryption is drifting toward vendor-held key escrow, where lawful-access compliance rather than cryptographic weakness becomes the state's route to encrypted data.