Microsoft Can Hand BitLocker Recovery Keys to the FBI

David Bombal’s Short walks the same fact Forbes reported on January 22, 2026: Microsoft gave the FBI BitLocker recovery keys for three laptops in a Guam pandemic-unemployment investigation. Microsoft told Forbes it gets about 20 BitLocker-key requests a year and produces keys it holds when a valid court order arrives. TechCrunch (Jan 23) repeated the same numbers.

This is not a Microsoft hack. BitLocker still encrypts the disk. The issue is key escrow: if the recovery key sits in a Microsoft account (or Entra ID / Active Directory), Microsoft can be compelled to produce that copy. Microsoft’s government-requests page says it does not give governments “our encryption keys or the ability to break our encryption.” A customer recovery key stored in Microsoft’s cloud is a different object.

Type account.microsoft.com yourself. Microsoft’s consumer lookup is aka.ms/myrecoverykey. Work/school keys: aka.ms/aadrecoverykey.

Snapshot

Who is at risk

Anyone whose BitLocker recovery key is backed up to Microsoft. Microsoft’s own recovery overview says storing the password in a Microsoft account is the default recommended method for devices that are not Entra- or Active Directory-joined. Work PCs usually escrow to Entra ID or AD — then IT (and a later court order) can see the same material.

Firms that treat “the laptop is BitLocker’d” as equivalent to “nobody but us can open it” are wrong if the key copy lives at Microsoft.

What to watch for

• Mail that says “Microsoft / FBI needs your BitLocker key” or “unlock your drive here” — type account.microsoft.com yourself
• A new “recovery key backup” prompt you did not start
• Lookalike hosts (imicrosoft.com, fbi.com, ic3.com) in a “court order” PDF
• Assuming OneDrive files are unreadable to Microsoft because the laptop disk is encrypted — OneDrive’s own page describes a distinct Access to Customer Data elevation role

What to do

1. Sign in at aka.ms/myrecoverykey (or aka.ms/aadrecoverykey for work) from a device you already trust. See whether a key copy sits in the cloud.
2. If you want Microsoft not to hold a copy, Microsoft documents USB and print backups in Back up your BitLocker recovery key. Store that copy away from the laptop. Ask IT before you change escrow on a work device.
3. Put a YubiKey on the Microsoft account that can show those keys. That stops a phisher. It does not stop a warrant.
4. Treat OneDrive / Exchange content as Microsoft-held. The company says it discloses customer data only when legally compelled.
5. Report phishing that pretends to be this story at IC3.

MFA: YubiKey and Google Authenticator

Microsoft Account / Entra documents FIDO2 security keys, authenticator-app TOTP, and passkeys. Grade: Strong. A hardware key on that account is the right control for aka.ms/myrecoverykey. It does not keep Microsoft from producing a key it already stores.

OneDrive still lists phone, text, or app as two-step options. Enroll the key; leave SMS as last resort. Apple Account is Strong on YubiKey but has no public Google Authenticator path. Facebook is Strong (key + authenticator; SMS remains). Forbes quoted Apple and Meta as designing systems so they cannot produce this class of disk-encryption recovery key. That is a product difference, not an MFA grade.

Directory: MFA support directory · Category → Email & Identity.

Recommended MFA tools

We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.

Independent cybersecurity audits

We audited reporting, journalism, and company hosts on October 15, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not score BitLocker or the warrant.

Audit links: ic3.gov · fbi.gov · microsoft.com · forbes.com

microsoft.com Website 37% is the weak Microsoft bar. forbes.com Identity 40% / Transport 15% is the spoofed-notice problem on the journalism host.

Website stack note

Passive website-tech probes on October 15, 2026:

Point-in-time only. A marketing homepage is not a BitLocker forensic finding.

Blacklist and lookalike domains

Email blacklist checks (public DoH, October 15, 2026): ic3.gov, fbi.gov, and microsoft.com were clear. forbes.com showed SPFBL hits on shared Mimecast MX — do not read that as “Forbes is blacklisted.” FBI web/CDN SPFBL notes are the same kind of noise.

DNS lookalike scans (BEC profile, registered signals only):

High-interest registered names (investigate; not proof this warrant used them):

microsoft.org, .net, .io, and several other Microsoft TLD swaps redirect to the real brand (likely owned). Type microsoft.com, fbi.gov, and ic3.gov. Continuous monitoring: Cybersquat Domain Monitoring.

Related coverage

• Hotel Wi-Fi DNS hijack of Microsoft 365
• Google redirect trust-proxy phishing
• Beazley Q2 2026 — device-code phishing after MFA
• MFA support directory

Run a free audit at audit.emailmenow.com or contact EmailMeNow for DMARC / MTA-STS and phishing-resistant Microsoft 365 aimed at the 100% ideal.

Sources: David Bombal — Microsoft Gave BitLocker Keys to FBI · Forbes (Jan 22, 2026) · TechCrunch (Jan 23, 2026) · The Verge · Kandit — Tenorio warrant · CourtListener United States v. Tenorio, 1:25-cr-00011 · Microsoft OneDrive safeguards · Find your BitLocker recovery key · Back up your recovery key · BitLocker recovery overview · Government requests for customer data · IC3. Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches October 15, 2026. Domain scores: audit.emailmenow.com only.