Victory or dependence?
UU and SURF prompt Microsoft to make global adaptation in Windows disk encryption
What started as a student whose laptop was inaccessible ended with a global modification in Windows. Utrecht University (UU) and SURF succeeded in persuading Microsoft to make a fundamental change in BitLocker disk encryption. But what does this mean in the long run for the autonomy of the education and research sector?
Utrecht University (UU) and SURF led Microsoft to make a fundamental change to Windows security worldwide. The trigger was an unwanted operation of BitLocker, the disk encryption in Windows that automatically encrypts data on a device or disk to protect it from unauthorised access. In 2023, BitLocker was activated at UU. For students who used the university's Microsoft licence on their private laptops, BitLocker was also automatically turned on, without UU's opting in. When the students wanted to use their encrypted PCs again, they had to bring them to the university. Because, as the licensee, it had the digital key to restore access.
A student puts its finger on the sore spot
In summer 2023, a UU student contacted the IT service desk for this problem. The university concluded that it was fundamentally wrong for private laptops to be blocked by an institution's security. After all, it has no control over students' private data. Moreover, the situation causes a lot of annoyance and inconvenience as long as the data lock is in operation.
Jonas Folkers
UU was not alone in identifying the problem. This emerged from conversations by Jonas Folkers, privacy officer at UU, with other educational organisations. He sought contact with SURF to raise the issue as a collective with Microsoft.
"We framed it as a privacy issue," he explains. That way, the issue could be presented to Microsoft's legal department as a demand for change, rather than as a feature request to the service department. "We argued that this case relied on unlawful processing of personal data. Microsoft was not acting on behalf of the education organisation and made it ultimately responsible for applying encryption without consent, unasked."
Microsoft adjusts Windows
Microsoft acknowledged the problem and first came up with a quick fix. This consisted of a program to which students could log in with their UU authentication. This then allowed them to download the recovery code, and store it in a place they could access themselves. Folkers says this solution was not deployed. "We didn't want to teach our students that they have to enter login credentials into a programme delivered via e-mail. That goes against information security best practices."
"Colleagues from other institutions recognised the problem. As a result, it felt very natural to escalate to SURF."
Microsoft finally fixed the problem last October in the 24H2 version of Windows. When a student uses a local Microsoft account and then connects the laptop to a school or organisation, BitLocker is no longer automatically enabled. Students can enable BitLocker themselves, but in that case Microsoft stores the recovery code in the personal account, i.e. no longer with the educational organisation.
According to Folkers, this success would never have been achieved if he had raised the issue with Microsoft as a representative of a single educational organisation. "Colleagues from other institutions recognised the problem. As a result, it felt very natural to escalate to SURF. I did have an entry point to Microsoft myself through our customer relations manager, but then, I think, the complaint would have been taken less seriously and it would have taken longer to find a solution."
Global impact and industry-wide dilemma
The update does not only apply to the Netherlands. With Windows update 24H2, users of the education version benefit from this improvement worldwide. However, the situation raises questions. Are education organisations doing the right thing to potentially further strengthen the position of a vendor with great market power by proposing such product improvements? And how does this relate to the industry's long-term desire to invest precisely in developing a market for alternative providers?
"In terms of time and money, it is more effective, especially for the short term, to invest in a Microsoft-like product," Folkers argues. "I absolutely understand the dilemma that we are basically giving free advice to US parties, perhaps stifling the flowering of European alternatives." He does stress, however, that educational institutions cannot afford dropouts or delays. Moreover, switching can be very difficult technically and organisationally. "We do almost all our work with Microsoft products: mail, SharePoint, Teams," he says.
Marlon Domingus
Plea for a hybrid approach
Working with alternative providers also entails a risk. "You do want to be able to trust that such a provider will still exist in ten years' time," is how Marlon Domingus identifies one of the concerns among educational organisations. Domingus is a philosopher, data protection officer (FG) of Erasmus University Rotterdam and chair of the SURF Taskforce Beyond Privacy Shield, but speaks here solely in a personal note.
According to Domingus, a hybrid approach to the dilemma could also be considered: "The solution does not lie in a black-and-white choice between Big Tech or a European alternative, but in becoming strategically mature as a sector: making better agreements with existing suppliers as well as making controlled investments in new alternatives."
"We used to just have local mail servers and support. We got rid of all those at one point because we wanted to be unburdened. But now we are still in worry."
He sees opportunities in setting up sandbox environments, for example under the SURF banner. "By this I do not mean that everything is possible and legislation no longer applies. I'm thinking more of a testbed." This would allow us to gain experience with the services of new providers in the limited context of research, for example, without immediately taking all the risks.
The education sector has its own responsibility
Domingus also reminds education organisations of their own responsibility for the emerging situation. "We used to just have local mail servers and support. We got rid of all those at some point because we wanted to be unburdened . But now we are still in worry."
Invest more in governance; complain less without taking action yourself. That would do educational organisations credit, Domingus believes.
Text: Thijs Doorenbosch
'Victory or dependence? UU and SURF move Microsoft to global adaptation in disk encryption Windows' is an article from SURF Magazine.
Back to SURF Magazine
Questions following this article? Mail to magazine@surf.nl.