When you log into Windows with a Microsoft account, your recovery key is often automatically uploaded to Microsoft’s servers as a backup in case you forget your password. Legally, this means Microsoft owns the key and must surrender it under the U.S. CLOUD Act.

Experts like Matt Green of Johns Hopkins University warn that, unlike Apple or Google, Microsoft does not encrypt these keys in a way that makes them unreadable even to the company itself. The result is a fundamental breach of data sovereignty

When you log into Windows with a Microsoft account, your recovery key is often automatically uploaded to Microsoft’s servers as a backup in case you forget your password. Legally, this means Microsoft owns the key and must surrender it under the U.S. CLOUD Act.

I find that really quite shocking, but I guess I shouldn't be surprised.

Given the legal and technical risks, the advice for business travelers is clear: do not carry data.

The US really is a hostile surveillance state.

The best tip: don’t travel to the U.S.A. “But my business…” Tip number two: stop doing business with the U.S.A.

I don't use Windows, except in a VM as absolutely necessary. Problem solved.

On a laptop it is relatively simple to maintain encrypted stealth "drives" within a logged in and decrypted system. Is there a way to "unlock" a phone that depending on the password given will present a true versus secretly sanitized version? For example if you login with password 1234 you get a sanitized version and if you log in with password xyz789 you get the full access. All of it done without a tell that the "full access" version exists.