Kyle Kucharski/ZDNET
Follow ZDNET: Add us as a preferred source on Google.

**ZDNET’s Expanded Key Takeaways**
Microsoft’s BitLocker is a robust encryption system that secures the contents of an entire hard drive, transforming every piece of stored data into unreadable code unless a proper decryption key is provided. Its chief mission is to safeguard your private files from unauthorized access, particularly in scenarios where your device becomes lost or stolen. However, what seems like an impenetrable wall of defense may, under certain legal circumstances, contain a carefully regulated doorway. Microsoft has publicly confirmed that, when served with a lawful and properly executed legal order, it will provide the BitLocker recovery key to law enforcement. This disclosure can occur only if the recovery key has been stored in Microsoft’s cloud infrastructure rather than being kept exclusively on the user’s local devices. According to reports first brought to light by Forbes, one such incident recently took place—potentially marking a milestone case for Microsoft’s compliance practices regarding encryption and legal inquiries.

To illustrate this in a real-world context, consider an investigation conducted by FBI agents stationed in Guam. Authorities there were working on unraveling a fraud operation concerning misuse of COVID unemployment assistance funds. The suspects involved had protected crucial evidence on their computers using BitLocker’s encryption. In order to access those encrypted files and gather proof of wrongdoing, investigators sought Microsoft’s assistance. After reviewing the request and determining it complied with applicable law, Microsoft released the relevant recovery keys, thereby providing investigators with entry into the secured drives.

**The Cloud Backup Conundrum**
Microsoft regularly advises its users to back up BitLocker recovery keys to the cloud as a safeguard against technical mishaps or unexpected device changes. This practice is recommended because if your PC’s motherboard fails, the operating system is reinstalled, or anomalous activity is detected, access to your system could become locked without that recovery key. By storing it in the cloud, users can conveniently sign in to their Microsoft account and retrieve the key whenever needed. Yet, this same convenience introduces a subtle risk: any key stored remotely also falls under Microsoft’s legal obligations to disclose data upon valid government requests.

In a statement made to ZDNET, a Microsoft representative explained that users always retain the freedom to determine where and how their encryption keys are stored—either locally, which remains entirely inaccessible to Microsoft, or in the company’s secure cloud environment. Many individuals opt for cloud storage precisely for the convenience of recovery, especially when troubleshooting locked devices or forgotten credentials. Microsoft acknowledges, however, that while cloud-based key escrow simplifies account recovery, it also entails the inherent risk of third-party access under lawful compulsion. Consequently, the company encourages users to weigh both security and practicality before deciding on their preferred key management strategy.

Each year, Microsoft reportedly receives around twenty formal requests from law enforcement agencies for BitLocker decryption keys. Nonetheless, the majority of such requests cannot be fulfilled, simply because most users never upload their recovery keys to the cloud. As Forbes highlighted, the Guam incident represents the first confirmed case of Microsoft supplying recovery keys under lawful demand. This case stands in sharp contrast to a separate 2013 event, when the FBI allegedly requested Microsoft to build a permanent backdoor into BitLocker—a proposal the company firmly declined, citing its commitment to user security.

**A Debate of Privacy, Policy, and Power**
The issue of when and how encryption keys can be disclosed to law enforcement has ignited a complex, ongoing debate. On one hand, society benefits when authorities have the tools they need to investigate crimes, dismantle fraud networks, and prevent harm. On the other, citizens expect—and are entitled to—protection from excessive surveillance and unwarranted intrusion into their digital lives. The tension lies in maintaining both safety and privacy without letting one erode the other.

Fundamental questions thus arise: By what criteria does Microsoft decide whether to comply with such orders? Can users fully trust a company to serve as both the custodian of their encryption keys and the arbiter of lawful access? These doubts resonate in an age of expanding governmental powers and increasing public sensitivity to privacy violations.

Experts in cybersecurity note that Microsoft has sought to frame the issue not as the creation of a secret backdoor but as adherence to lawful process. Jason Soroko, senior fellow at Sectigo, clarified in a statement to ZDNET that Microsoft’s documentation emphasizes transparency in handling data demands—it reviews every legal request carefully, discloses information strictly when compelled, and never grants unrestricted access to its encryption infrastructure. Nevertheless, Soroko cautioned that when users permit Microsoft to store their recovery keys, they implicitly accept that a copy resides within a jurisdiction subject to potential legal orders. Thus, the notion of “private encryption” transforms from an exclusively personal safeguard into a shared trust model—one that includes the user, Microsoft, and any lawful authority with valid grounds to obtain that key. Centralizing encryption keys in such repositories also heightens the systemic risk of data breaches if those repositories themselves were ever compromised.

Society therefore faces an uneasy balance. Ideally, law enforcement should possess the means to pursue justice, yet the methods for doing so must remain bounded by rigorous oversight, narrow legal warrants, and strong procedural safeguards that prevent ordinary citizens from being collateral casualties of broad surveillance powers. Soroko underscored that although we can support criminal justice efforts, we must simultaneously advocate for transparent governance structures that preserve fundamental digital rights. Default settings that automatically send keys to the cloud—effectively establishing an escrow without a user’s explicit, informed consent—set potentially dangerous precedents for personal privacy.

**Practical Guidance for BitLocker Users**
Despite these concerns, BitLocker itself remains one of the most powerful and dependable tools available for data protection on Windows systems. Its design philosophy is centered on shielding users from a common threat: unauthorized access to a lost or stolen laptop that is powered off. Soroko emphasized that the true issue lies not in BitLocker’s encryption integrity but in key custody—the decision of where and how the recovery key is retained. If the key is uploaded to a Microsoft account for user convenience, the company consequently holds a copy that—under the right legal conditions—might be surrendered to authorities, as seen in the Guam case.

BitLocker comes preinstalled in versions such as Windows 10 Pro, Windows 11 Pro, Enterprise, and Education. To review your encryption status and make informed choices about key storage, navigate to your system settings. On Windows 11, open **Settings → System → About**, then scroll to the Related section and select BitLocker settings. On Windows 10, the pathway is similar: **Settings → System → About**, followed by Related settings, where you’ll find the BitLocker configuration link.

If BitLocker is currently disabled, it is wise to enable it—especially on portable devices you transport frequently. Should it already be active, review your options for backing up the recovery key. Microsoft’s default prompts may encourage saving it to your Microsoft or Entra ID account, which stores the key in the cloud. To avoid potential legal exposure, instead opt to save the recovery key locally to a file or as a printed document.

**Establishing a Safe and Reliable Storage Method**
When saving your recovery key, best practice dictates using an external medium such as a USB drive or detachable hard disk. Be aware that the key is written as plain text in the saved file. This file—and any corresponding USB stick—should be kept in a secure, private location like a home safe or safe deposit box. For enhanced security, you can encrypt the text file further using specialized compression tools such as 7‑Zip or WinRAR, both of which allow password protection—a feature not natively supported by Windows for key files. If you prefer to print the recovery key, store the physical copy in a protected environment, away from moisture, sunlight, and unauthorized access.

If at any point you stored your BitLocker recovery key in the cloud, it is possible to remove it. Sign in to your Microsoft account, navigate to the section labeled BitLocker recovery keys, locate your specific device, select the three-dot More Options menu, and choose **Delete**. Confirm by checking that you’ve already backed up the key elsewhere, then finalize the deletion.

As Soroko concluded, users seeking encryption that remains entirely under their own control should avoid third-party key escrow systems altogether. Microsoft’s official guidance even outlines the same: save your key to a USB drive, store it as a local file, or print it—but never place the backup alongside the computer it protects. For optimal safety, a redundant approach is recommended: keep one printed copy in a secure household safe or safe deposit box, and a digital, encrypted copy within a trusted password manager. This dual strategy maintains accessibility while minimizing exposure.

Ultimately, BitLocker remains a cornerstone of Microsoft’s security framework, offering meaningful protection against tangible risks such as device theft or data compromise. Still, true privacy depends not solely on encryption technology but also on informed choices about where the keys to that encryption are kept. By understanding these nuances, users can continue to benefit from BitLocker’s strength while maintaining control over who—if anyone—can ever unlock their most personal data.

Sourse: https://www.zdnet.com/article/how-to-keep-pc-bitlocker-encryption-key-safe-from-fbi-microsoft/