When you log into Windows with a Microsoft account, your recovery key is often automatically uploaded to Microsoft’s servers as a backup in case you forget your password. Legally, this means Microsoft owns the key and must surrender it under the U.S. CLOUD Act.

I find that really quite shocking, but I guess I shouldn’t be surprised.

Given the legal and technical risks, the advice for business travelers is clear: do not carry data.

The US really is a hostile surveillance state.