Sensitive police files on US cloud

More than 40 UK police forces store criminal records, victim statements and internal emails on Microsoft Azure, a US cloud platform. Some files exceed official classification, potentially reaching secret or top secret level.

Official assessment flagged major risks

A 2017 security assessment by senior police officer Ian Dyson identified that data could be vulnerable to compromise by US government insiders and hostile hackers on the Microsoft platform.

Police accepted US government access

In the 2017 meeting, officers explicitly acknowledged that US government insiders would be able to see the data and it could be transmitted worldwide, with the extent unknown.

“US government insiders would be able to see the data, and that it could be "transmitted worldwide", with "the extent of this … unknown".”

Cloud first policy drove the decision

The 2013 Cabinet Office cloud first policy pushed all government departments to migrate data to commercial US-based cloud platforms, with burdensome penalties for those who refused.

Risks persist despite mitigations

The 2017 assessment suggested encryption and individual police chief approval as safeguards, but experts say these do not prevent US government access or employee viewing of UK police data.

All UK forces adopted the platform

Despite identified risks, every UK police force migrated its data wholly or partly to Microsoft Azure starting in 2017, with some forces still completing the transition.

Data covers full range of policing

Files include intelligence, body-worn video, digital evidence, case files and non-law enforcement data held by police organisations across the country.

Police claim contractual protection

The National Police Chief's Council says UK contracts with Microsoft prevent US government access without express permission and that data remains in UK datacentres.

“In line with the contract signed with Microsoft, we do not expect any sharing with the US government without the express permission of the UK government.”

Microsoft contradicts police claims

Microsoft told Police Scotland in 2023 that data can go outside the UK and it cannot guarantee data sovereignty, contradicting police statements about data remaining in Britain.

Data spreads across multiple countries

Microsoft's cloud is a global network with datacentres on every continent. Pieces of single files are stored across multiple countries, from Sweden to Ethiopia.

Thousands of engineers have access

Engineers from more than 100 countries maintain Microsoft systems, some directly employed and others working for subcontractors in countries potentially hostile to the UK including China and Kazakhstan.

Support access is widespread

A Microsoft engineer said UK police data could be viewed by hundreds of people around the world, many not vetted and many not directly employed by Microsoft.

“could be viewed by hundreds of people around the world, some of them not vetted, many of them not directly employed by Microsoft”

US law overrides contracts

The US Cloud Act allows US authorities to access any data held by US cloud companies, including data held abroad, without a warrant and with secrecy requirements.

Contractual promises are unenforceable

Legal experts say contractual commitments from cloud providers are worthless against US government demands, as nothing legally binds them to refuse sharing data under foreign law.

“If you're relying on a contractual commitment from a cloud provider not to hand over data when forced to under foreign law, that is not worth much more than the piece of paper it's written on.”

Microsoft says it never complied

Microsoft stated it has never provided UK government data in response to any US or global authority request and is bound by contractual commitments.

Security experts expected breach by now

Senior security officials anticipated a major data breach would occur by now to force change, but logging systems may not reveal if data has already been compromised.

“All the security guys I worked with when this policy came in expected a big breach by now, and we know it will take that to change the police's position.”

Deep UK dependence on US tech

The UK government spends at least 1.9 billion pounds yearly on Microsoft software. Up to 60 percent of government IT infrastructure is hosted on US cloud platforms.

Intelligence and customs data also at risk

Britain's intelligence data and customs data are hosted on Amazon's cloud services, while the Ministry of Defence uses Azure, creating widespread dependence on US hyperscalers.

Senior leaders trust US companies

Government security departments are aware of risks but senior leaders view dependence on US tech companies as acceptable, trusting them not to share data with US authorities.

“Government security departments are painfully aware of all the risks. But the way that most senior leaders talk about it is: 'Well, we've been reassured by Microsoft that it would never happen.'”