How to encrypt your PC’s disk without giving the keys to Microsoft

In early 2025, reports surfaced that the FBI had issued a warrant to Microsoft, seeking BitLocker encryption recovery keys for several laptops believed to contain evidence related to fraud in Guam's COVID-19 unemployment assistance program. Microsoft complied with this request, raising significant privacy concerns. BitLocker has been a part of Windows for nearly two decades, providing full-disk encryption primarily to Pro edition users who activated it manually. However, with the advent of Windows 8, Microsoft began automatically encrypting local disks on all Windows 11 Home and Pro PCs linked to a Microsoft account. This automatic process also uploads recovery keys to Microsoft's servers, enabling users to recover their data if issues arise or if hardware upgrades disrupt BitLocker. While this feature offers convenience, it also permits Microsoft access to unlock users' disks. A representative from Microsoft indicated that the company receives approximately 20 similar requests from government entities each year, although many fail due to users not saving their recovery keys in Microsoft's cloud. Tech companies, including Microsoft, have largely resisted installing universal encryption backdoors for law enforcement. Some, like Apple, assert that they employ additional encryption layers to safeguard device encryption keys from access by the company itself. Nonetheless, relying on cloud storage for recovery keys presents potential privacy and security risks, especially as government scrutiny on journalists and political figures intensifies.