Vast troves of sensitive UK police data, including criminal records and victim statements, reside on Microsoft Azure cloud platforms. An official UK security assessment warns these files are vulnerable to compromise by foreign actors and the US government, raising severe data sovereignty concerns across more than 40 police forces. The files include internal emails and sensitive information, with some documents exceeding “officialclassification to raise the possibility they could be classed as
secret” or “top secret” according to a police document seen by the Guardian.
British police forces depend heavily on commercial US cloud infrastructure, despite internal warnings that sensitive records could be exposed to US government insiders. A Guardian investigation reveals that more than 40 forces across the UK store criminal histories, victim statements, and internal correspondence on Microsoft Azure, with some files carrying classifications that push toward secret or top-secret thresholds. Microsoft Azure is one of the main commercial offerings of the US tech company, used by businesses and governments globally and resting on a web of IT infrastructure including datacentres, networking gear, and fibre optic cables that spans more than 100 countries.
The 2017 Meeting That Set the Cloud Standard
The current reliance on foreign-hosted cloud networks traces back to a pivotal decision made in a 2017 meeting chaired by Ian Dyson, then the police commissioner of the City of London. Dyson also served as the senior information risk owner, or SIRO, for all of Britain, making it his job to set the norms for how British police could safely handle their data. That gathering evaluated 15 distinct risks associated with transferring police information onto Microsoft’s global cloud ecosystem, which underpins productivity software like Office 365 alongside cloud infrastructure such as Azure. The risks and resulting police decisions were set out in a summary document seen by the Guardian and signed off by Dyson.
Officers at the meeting acknowledged stark realities regarding the transfer. Reviewing the record, officials accepted that US government insiders
would be able to see the data, that it could be transmitted worldwide, and that the extent of this transmission would remain unknown.
This migration followed the Cabinet Office’s introduction of the “cloud first” policy in 2013, which became a government-wide effort to push almost all departments to migrate their data onto the public cloud offerings of tech companies, often based in the US, requiring departments that resisted to jump through burdensome administrative hoops.
Persistent Vulnerabilities and Threat Actor Risks
Specialists reviewing the security documents confirm that the dangers identified in 2017 remain active. Almost every UK police department now relies on Microsoft Azure, while the UK government spends at least £1.9bn on Microsoft software each year.
“There’s no evidence that this has been properly understood,” said one source who has held senior roles in UK policing. The data is “some of the most sensitive that exists”, he added. “You’re talking about information that, if it gets into the wrong hands, or if the information is incorrect, [means] people can get hurt or may die.”
Anonymous source with former senior roles in UK policing, via The Guardian
Five specialists who reviewed the Guardian’s findings confirmed that the risks identified in the 2017 document persist today.
The initial 2017 risk assessment explicitly warned that Microsoft’s software carries vulnerabilities which will be exploited by cybercriminals and other threat actors in due course. Furthermore, the document highlighted that police forces cannot be certain where their data will be processed or stored, noting that the hyper-scale and global nature of the Microsoft cloud means police data and related metadata could be transmitted and stored worldwide by Microsoft, with the extent remaining unknown. The document specifically identified the potential risk from what it described as US government insiders,
warning of a risk of compromise of sensitive data shared by, or taken from, Microsoft by the US government being released by US government insider attackers.
Conflicting Assurances on Data Sovereignty
When questioned about potential security gaps, police officials appeared to wave aside these risks, maintaining that Britain’s contracts with Microsoft meant US authorities could not view data without express permission and that the data stored on Microsoft remained in the UK.
Those official assertions appeared to contradict public disclosures from Microsoft, which said in a disclosure to Police Scotland in 2023 that data can go outside the UK and that it cannot guarantee data sovereignty.
Microsoft defended its framework by noting it does not provide any government with direct or unfettered access to customer data, adding that it had not provided UK data in response to a US government request. It stated that, like all US-based tech companies, it responded to US government requests made through valid legal processes.
Disputed Mitigations and Expert Skepticism
Security assessments recommended that police servers must be repaired promptly, kept up to date, and have antivirus software to mitigate cyberattack risks, alongside applying Microsoft’s “out-of-the-box” native encryption for data security.
However, several experts, including cloud computing specialists and Microsoft engineers, criticized these mitigations as inadequate. These experts argued that Microsoft’s internal encryption doesn’t prevent its employees from accessing UK police data or stop the US government from obtaining British policing files.
