Highly sensitive UK police data, including criminal records and victim statements, may be vulnerable to compromise by foreign actors and the US government due to its storage on Microsoft cloud platforms. An official UK security assessment, reviewed by investigators, identified these risks, which persist despite assurances from authorities and Microsoft. The data in question is held by over 40 police forces across the UK and includes information that could be classified as “secret” or “top secret.” The reliance on Microsoft Azure, a US-based cloud service, raises significant concerns about data sovereignty and potential access by external entities.
Concerns Over Sensitive Data Storage on Microsoft Azure
A pivotal decision made in 2017 saw UK police opt to store some of their most sensitive information on Microsoft Azure. Records from a meeting at the time reveal that officers acknowledged the potential for “US government insiders” to access this data, with the possibility of it being “transmitted worldwide” to an “unknown extent.” Five specialists who have reviewed these findings believe these risks remain relevant today. This situation is particularly concerning given that nearly every UK police force now utilizes Microsoft Azure, and the UK government’s annual expenditure on Microsoft software amounts to at least £1.9 billion.
One source, who has held senior positions within UK policing, emphasized the extreme sensitivity of the data, stating, “You’re talking about information that, if it gets into the wrong hands, or if the information is incorrect, [means] people can get hurt or may die.” Despite these grave concerns, police responses to inquiries about data security have often downplayed the risks. They have pointed to contracts with Microsoft that purportedly prevent US authorities from viewing data without explicit permission and maintain that data stored on Microsoft remains within the UK. However, these statements appear to contradict public disclosures made by Microsoft itself.
Microsoft’s Position and Contradictory Statements
In a 2023 disclosure to Police Scotland, Microsoft stated that data “can go outside the UK” and that it “cannot guarantee data sovereignty.” This directly challenges the assurances provided by UK police forces. Microsoft has publicly stated that it “does not provide any government with direct or unfettered access to customer data” and has not supplied UK data in response to US government requests. Nevertheless, the company acknowledges that, like other US-based technology firms, it must comply with valid legal processes for US government requests.
The core of the issue lies in the inherent nature of cloud computing and the legal frameworks governing US technology companies. Microsoft Azure operates on a global infrastructure, with data centers spanning over 100 countries. While Microsoft offers assurances about data access and security, experts suggest that the underlying architecture and US legal obligations present persistent vulnerabilities.
Historical Context: The “Cloud First” Policy
The migration of sensitive police data to cloud platforms is partly a consequence of the UK government’s “cloud first” policy, introduced in 2013. This policy strongly encouraged, and often necessitated, government departments to move their data onto commercial cloud offerings, predominantly from US tech companies. This directive created a significant dependency on providers like Microsoft, Amazon, and Google. The decision-making process in 2017, chaired by Ian Dyson, who was then the Senior Information Risk Owner (SIRO) for British police, explicitly considered 15 risks associated with migrating data to Microsoft’s cloud.
The assessment document, signed off by Dyson, highlighted several critical vulnerabilities. It noted that Microsoft’s software “carries vulnerabilities which will be exploited by cybercriminals and other threat actors in due course.” Furthermore, it raised concerns about data location uncertainty, stating, “Police forces cannot be certain where their data will be processed or stored.” The global nature of the Microsoft cloud meant that police data and its metadata could be transmitted and stored worldwide, with the full extent remaining unknown.
Specific Risks Identified in 2017 Assessment
- Vulnerability to Cybercriminals: Microsoft’s software was identified as having inherent weaknesses that could be exploited.
- Data Location Uncertainty: Police forces could not be sure where their sensitive data was being processed or stored globally.
- US Government Insider Threat: A specific risk was identified concerning the potential compromise of sensitive data by “US government insider attackers.”
- Data Classification Exceeding “Official”: A significant volume of the data was classified as exceeding “official” levels, potentially reaching “secret” or “top secret” status, requiring robust protection.
The assessment also pointed out that Microsoft’s platform might not adequately guarantee the security of this highly sensitive data, making it a more attractive target for attackers.
Inadequate Mitigations and Expert Opinions
The 2017 assessment proposed several mitigation strategies. For cyber-attack risks, it recommended prompt server repairs, up-to-date software, and antivirus protection. To address the threat from “US government insiders” and the global storage issue, it suggested using Microsoft’s native encryption and leaving the final decision to individual police chiefs. However, several cloud computing specialists and former Microsoft engineers interviewed believe these measures are insufficient.
Internal encryption, they argue, does not prevent Microsoft employees from accessing UK police data, nor would it necessarily stop the US government from obtaining such files. A Microsoft engineer who reviewed the findings suggested that information “could be viewed by hundreds of people around the world, some of them not vetted, many of them not directly employed by Microsoft.” Despite these expert opinions, every UK police force has proceeded with migrating all or part of its data to Microsoft’s cloud, with some beginning in 2017 and others, like Police Scotland, still completing the transition.
Broader Implications and Legal Frameworks
The UK’s reliance on US tech giants like Microsoft, Amazon, and Google for cloud services is extensive, with up to 60% of its IT infrastructure hosted on these platforms. This deep dependency, a result of years of policy decisions, raises questions about the understanding of potential consequences. Dave Michels, a researcher at Queen Mary University of London’s Cloud Legal Project, noted the “deep dependency on US hyperscalers.” When questioned about the 2017 document, the National Police Chiefs’ Council (NPCC) stated that UK policing typically requires the use of UK-only data centers but acknowledged that Microsoft employees might access data for support. They deflected specific questions about “US government insiders,” deeming the document “outdated.”
Microsoft maintains that the notion of its cloud services inherently exposing customer data to foreign governments is “inaccurate.” However, legal experts and engineers suggest this view may not fully capture the risks. Michels explained that Microsoft’s cloud is a global network, and data can be stored across multiple countries. While Microsoft has offered greater assurances about data location, particularly within Europe, the global nature of system maintenance, involving engineers from over 100 countries, presents a broader access challenge. Some engineers, including those from subcontractors in potentially adversarial nations, could access sensitive data as part of customer support.
The Impact of US Law on Data Sovereignty
A significant concern is the extraterritorial reach of US law, such as the Cloud Act. This legislation allows US authorities to access data held by US cloud companies, even if that data is stored abroad, without requiring a warrant and potentially without notifying the customer. While Microsoft, Amazon, and Google have stated they would contest such requests, legal experts like Douwe Korff, a professor of international law, point out that there is “nothing that is legally binding” to prevent them from sharing data from other governments if compelled by US authorities.
Microsoft’s contractual commitments are also subject to legal frameworks. While the company stated it would be bound by UK law prohibiting data handover, the enforceability and scope of such protections against US legal demands remain a point of contention. Mark Butcher, a cloud expert advising the government, observed that while security departments are aware of the risks, many senior leaders rely on reassurances from Microsoft, suggesting a potential gap in understanding the full implications.
Uncertainty Over Data Breaches
A former senior policing source expressed concern that the current logging and information systems within cloud environments might not adequately detect a data breach. “We really don’t know if the data has been breached or not,” the source stated, suggesting that a significant breach might be necessary to prompt a change in the current data storage policies. This uncertainty underscores the ongoing debate about the security and sovereignty of sensitive UK police data stored on international cloud platforms.
