# UK police data exposed on US cloud servers > Sensitive files from 40+ police forces stored on Microsoft Azure face potential access by US government and hackers, according to official security assessment. - Title: UK police data exposed on US cloud servers · the Guardian - Summary: Sensitive files from 40+ police forces stored on Microsoft Azure face potential access by US government and hackers, according to official security… - Keywords: uk police, microsoft azure, cloud computing, data security, us government access, sensitive data, cybersecurity, data breach risk, cloud first policy, ian dyson, national police chief's council, data protection - Source: the Guardian — https://theguardian.com/uk-news/2026/sep/18/sensitive-uk-police-data-vulnerable-to-compromise-by-us-government-and-foreign-actors - Published: 2026-09-18T17:00:23+00:00 - Read time: 3 min - Topics: uk police, microsoft azure, cloud computing, data security, us government access, sensitive data, cybersecurity, data breach risk, cloud first policy, ian dyson, national police chief's council, data protection ## Sensitive police files on US cloud More than 40 UK police forces store criminal records, victim statements and internal emails on Microsoft Azure, a US cloud platform. Some files exceed official classification, potentially reaching secret or top secret level. ## Official assessment flagged major risks A 2017 security assessment by senior police officer Ian Dyson identified that data could be vulnerable to compromise by US government insiders and hostile hackers on the Microsoft platform. ## Police accepted US government access In the 2017 meeting, officers explicitly acknowledged that US government insiders would be able to see the data and it could be transmitted worldwide, with the extent unknown. > US government insiders would be able to see the data, and that it could be "transmitted worldwide", with "the extent of this … unknown". ## Cloud first policy drove the decision The 2013 Cabinet Office cloud first policy pushed all government departments to migrate data to commercial US-based cloud platforms, with burdensome penalties for those who refused. ## Risks persist despite mitigations The 2017 assessment suggested encryption and individual police chief approval as safeguards, but experts say these do not prevent US government access or employee viewing of UK police data. ## All UK forces adopted the platform Despite identified risks, every UK police force migrated its data wholly or partly to Microsoft Azure starting in 2017, with some forces still completing the transition. ## Data covers full range of policing Files include intelligence, body-worn video, digital evidence, case files and non-law enforcement data held by police organisations across the country. ## Police claim contractual protection The National Police Chief's Council says UK contracts with Microsoft prevent US government access without express permission and that data remains in UK datacentres. > In line with the contract signed with Microsoft, we do not expect any sharing with the US government without the express permission of the UK government. ## Microsoft contradicts police claims Microsoft told Police Scotland in 2023 that data can go outside the UK and it cannot guarantee data sovereignty, contradicting police statements about data remaining in Britain. ## Data spreads across multiple countries Microsoft's cloud is a global network with datacentres on every continent. Pieces of single files are stored across multiple countries, from Sweden to Ethiopia. ## Thousands of engineers have access Engineers from more than 100 countries maintain Microsoft systems, some directly employed and others working for subcontractors in countries potentially hostile to the UK including China and Kazakhstan. ## Support access is widespread A Microsoft engineer said UK police data could be viewed by hundreds of people around the world, many not vetted and many not directly employed by Microsoft. > could be viewed by hundreds of people around the world, some of them not vetted, many of them not directly employed by Microsoft ## US law overrides contracts The US Cloud Act allows US authorities to access any data held by US cloud companies, including data held abroad, without a warrant and with secrecy requirements. ## Contractual promises are unenforceable Legal experts say contractual commitments from cloud providers are worthless against US government demands, as nothing legally binds them to refuse sharing data under foreign law. > If you're relying on a contractual commitment from a cloud provider not to hand over data when forced to under foreign law, that is not worth much more than the piece of paper it's written on. ## Microsoft says it never complied Microsoft stated it has never provided UK government data in response to any US or global authority request and is bound by contractual commitments. ## Security experts expected breach by now Senior security officials anticipated a major data breach would occur by now to force change, but logging systems may not reveal if data has already been compromised. > All the security guys I worked with when this policy came in expected a big breach by now, and we know it will take that to change the police's position. ## Deep UK dependence on US tech The UK government spends at least 1.9 billion pounds yearly on Microsoft software. Up to 60 percent of government IT infrastructure is hosted on US cloud platforms. ## Intelligence and customs data also at risk Britain's intelligence data and customs data are hosted on Amazon's cloud services, while the Ministry of Defence uses Azure, creating widespread dependence on US hyperscalers. ## Senior leaders trust US companies Government security departments are aware of risks but senior leaders view dependence on US tech companies as acceptable, trusting them not to share data with US authorities. > Government security departments are painfully aware of all the risks. But the way that most senior leaders talk about it is: 'Well, we've been reassured by Microsoft that it would never happen.' ## Key takeaway UK police knowingly stored highly sensitive data on a US cloud platform despite identifying serious security risks, and those risks remain unresolved today.