Windows 8.1’s encryption feature, which was designed to make it more difficult for criminals to access data, has apparently failed to scare the FBI. In a recent interview with The Verge, an FBI spokesperson said that the encryption feature “has not hindered our investigations.” The spokesperson went on to say that the FBI has “other investigative tools” that it can use to access data. It’s unclear what those other tools are, but they likely involve hacking into computers and extracting data without the user’s consent. Windows 8.1’s encryption feature is designed to make it more difficult for criminals to access data. However, the FBI says that it has other investigative tools that it can use instead. This suggests that the encryption feature isn’t really doing anything to protect users’ data from being accessed by law enforcement officials. ..
The FBI isn’t happy about the latest versions of iOS and Android using encryption by default. FBI director James Comey has been blasting both Apple and Google. Microsoft is never mentioned — but Windows 8.1 uses encryption by default, too.
The FBI doesn’t seem worried about Windows 8.1’s default “device encryption” feature. Microsoft’s encryption works a bit differently — Microsoft holds the keys and could hand them over to the FBI.
Why the FBI is Blasting Apple and Google
FBI directory James Comey has said Apple and Google are creating “a black hole for law enforcement.” Encryption “threatens to lead us all to a very dark place,” according to the FBI.
The latest versions of Apple’s iOS and Google’s Android automatically encrypt a smartphone or tablet’s storage by default. Previously, this was just an option most users wouldn’t enable. Because of the way encryption works, only a person who knows the key can decrypt it and access the unencrypted files. If Apple or Google received a warrant — or some sort of secret “national security letter” — they wouldn’t be able to decrypt the files even if they wanted to. They don’t have the encryption key. (A national security letter is a secret order that may contain a “nondisclosure” requirement, preventing the person who received the national security letter from ever talking about it for the rest of their life under threat of criminal prosecution.)
This is the main issue for the FBI — encryption that prevents thieves from accessing your data after they steal your device is fine. However, the FBI wants to have a way to force Apple or Google to provide access to the encrypted data. In other words, they want Apple and Google to have a key they can use to gain access to the encrypted data.
Windows 8.1’s Device Encryption Gives Microsoft a Key
RELATED: Windows 8.1 Will Start Encrypting Hard Drives By Default: Everything You Need to Know
New Windows 8.1 devices ship with something called “device encryption” enabled by default. This is different from the BitLocker encryption feature, which is only available in more expensive Professional editions of Windows and not enabled by default.
If you have a supported device, the device’s storage comes pre-encrypted — but it uses an empty encryption key. When you sign in with a Microsoft account, the encryption is activated and a recovery key is uploaded to Microsoft’s servers. (If you sign in on a domain, the recovery key is uploaded to Active Directory Domain Services, so your business or school has it instead of Microsoft.) If you use a local account, there’s no way to enable the device encryption.
In other words, device encryption can only be used if you upload a recovery key to Microsoft’s servers (or to your organization’s domain server). If a thief stole your device, they wouldn’t be able to gain access. However, if law enforcement were to send a warrant (or a secret national security letter) to Microsoft, Microsoft would be forced to give the government your recovery key.
This is exactly what the FBI wants from Apple and Google — they want them to hold a recovery key they can disclose. Apple and Google are digging in, but Microsoft already gave the FBI what they wanted.
Microsoft May Have Other Reasons, But…
RELATED: How to Set Up BitLocker Encryption on Windows
Now, this isn’t all about providing a backdoor for the FBI. Average Windows users who forget their password will be able to get a recovery key from their Microsoft account by going through a password reset process. They’d just have to visit Microsoft’s Recovery Key page and sign in with the same Microsoft account — using an account recovery procedure if they can’t remember the password. Typically, encryption can’t be bypassed — if a user forgot their password, they’d lose access to all the files on their computer. Microsoft seems to consider this unacceptable.
But this is all a bit weird. There’s no way to enable device encryption without uploading a recovery key somewhere — not even a hidden power user option. This is very unusual for encryption — Android and iOS certainly don’t do it this way. BitLocker offers to back up your recovery key to your Microsoft account, but this part isn’t mandatory. It’s one of many different ways to create a backup of your recovery key — unlike with the default device encryption.
Even ignoring law enforcement access, this makes the encryption weaker. Someone could go through the password reset process in your Microsoft account to gain access to your encrypted files. We’ve previously seen people abuse password reset procedures with social-engineering tricks to gain access to other people’s accounts. It’s just less secure.
Law Enforcement Can Get Everything, Anyway
If the FBI wants to get access to text messages and phone calls, they can get it from the cellular carriers. If the FBI wants to get access to emails, social media posts, and files stored in cloud storage, they can get it by contacting the associated web services — yes, even Google and Apple would have to respond and hand over users’ data.
The US and other countries even have massive secret databases containing logs of who’s called who. They’re even trying to monitor all the traffic on the web and shove it into a database so it can be queried later.
Whatever sensitive data is protected via encryption is probably available elsewhere. Even with iOS and Android, devices are set to upload data to Apple’s iCloud and Google various services. That uploaded data could be gotten from their servers with a warrant or national security letter.
Pass a Law If It’s So Important
There’s a way for the FBI to actually get these backdoors — the government would just have to pass a low mandating backdoors for law enforcement. Currently, implementing encryption with no backdoors for law enforcement is completely legal in the US. The FBI actually gave up on pushing for such a law:
If it’s so dangerous to allow encryption without a backdoor, why did the FBI give up on it? Probably because they know they’d lose. But, if the FBI’s current rhetoric is anything to go by, we could see such a law start to take form again.
Overall, device encryption is still a useful feature in Windows. Encrypting files but allowing the FBI to gain access is still an improvement over not encrypting those files. The encryption at least prevents thieves from gaining access. Let’s not mince words: Device encryption is good. It’s better than the complete lack of default encryption Windows used to offer, even with this concern.
However, Microsoft’s means of allowing law enforcement to access encrypted files is something that’s flown under the radar. It’s particularly relevant when we see Apple and Google digging in and refusing to enable this covert access. Apple and Google can’t provide law enforcement with access to your encrypted data, but Microsoft can.
Image Credit: Dave Newman on Flickr, Mark Fischer on Flickr
