{"id":775090,"date":"2026-09-18T21:06:10","date_gmt":"2026-09-18T21:06:10","guid":{"rendered":"https:\/\/www.newsbeep.com\/uk\/775090\/"},"modified":"2026-09-18T21:06:10","modified_gmt":"2026-09-18T21:06:10","slug":"sensitive-uk-police-data-vulnerable-to-compromise-by-us-government-and-foreign-actors-police","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/uk\/775090\/","title":{"rendered":"Sensitive UK police data vulnerable to \u2018compromise\u2019 by US government and foreign actors | Police"},"content":{"rendered":"

Vast troves of highly sensitive police data are lying on Microsoft<\/a> cloud platforms which an o\ufb03cial UK security assessment deemed to be vulnerable to \u201ccompromise\u201d by foreign actors and the US government, a Guardian investigation can reveal.<\/p>\n

The files include criminal records, victim statements, internal emails and sensitive information held by more than 40 police forces across the UK.<\/p>\n

Some files exceed \u201co\ufb03cial\u201d classification, according to a police document seen by the Guardian, raising the possibility the information could be classed as \u201csecret\u201d or \u201ctop secret\u201d.<\/p>\n

The cloud platform is Microsoft Azure, one of the main commercial offerings of the US tech company. It is used by businesses and governments globally and rests on a web of IT infrastructure \u2013 datacentres, networking gear, fibre optic cables \u2013 that spans more than 100 countries.<\/p>\n

In recent years, doubts have surfaced about how cloud platforms store data and whether they are truly secure.<\/p>\n

British police decided to put some of their most sensitive data on the Microsoft platform in a 2017 meeting, a record of which was examined by the Guardian.<\/p>\n

In doing so, officers accepted that \u201cUS government insiders\u201d would be able to see the data, and that it could be \u201ctransmitted worldwide\u201d, with \u201cthe extent of this \u2026 unknown\u201d.<\/p>\n

According to five specialists who reviewed the Guardian\u2019s findings, the risks identified in that document persist today. Almost every UK police force now depends on<\/a> Microsoft Azure, and the UK government spends at least \u00a31.9bn on Microsoft software each year.<\/p>\n

\u201cThere\u2019s no evidence that this has been properly understood,\u201d said one source who has held senior roles in UK policing. The data is \u201csome of the most sensitive that exists\u201d, he added. \u201cYou\u2019re talking about information that, if it gets into the wrong hands, or if the information is incorrect, [means] people can get hurt or may die.\u201d<\/p>\n

When the Guardian approached the police about the possibility that sensitive information was not secure, they appeared to wave aside these risks, saying Britain\u2019s contracts with Microsoft meant US authorities could not view data without express permission and that the data it stored on Microsoft remained in the UK.<\/p>\n

These statements appeared to contradict public admissions by Microsoft, which said in a disclosure to Police<\/a> Scotland in 2023 that data \u201ccan go outside the UK\u201d and that it \u201ccannot guarantee data sovereignty\u201d.<\/p>\n

Microsoft said it \u201cdoes not provide any government with direct or unfettered access to customer data\u201d, and that it had not provided UK data in response to a US government request. It added that, like all US-based tech companies, it responded to US government requests made through valid legal processes.<\/p>\n

The threat of \u2018US government insider attackers\u2019<\/p>\n

In 2017, a senior police o\ufb03cer, Ian Dyson, chaired a meeting in which stakeholders considered 15 risks the UK would face if police forces decided to transfer their data to Microsoft\u2019s global cloud.<\/p>\n

Ian Dyson, pictured in 2016. Photograph: Jamie Smith<\/p>\n

That meeting considered both the police\u2019s use of Microsoft\u2019s software, such as Office 365, and the reliance on the cloud that underpins these services, Azure. Those risks, and the resulting police decisions, were set out in a summary document seen by the Guardian and signed off by Dyson.<\/p>\n

This was four years after the advent of a policy called \u201ccloud first\u201d. Introduced by the Cabinet Office in 2013, it became a government-wide effort to push almost all departments to migrate their data on to the \u201cpublic cloud\u201d \u2013 commercial offerings by tech companies, often based in the US. Departments that did not want to do this had to jump through burdensome administrative hoops.<\/p>\n

Dyson was the police commissioner of the City of London at the time, but he held another title: senior information risk owner for all of Britain, or the SIRO. It was his job to set the norms for how British police could safely handle their data.<\/p>\n

In their assessment, officers came to startling conclusions about what would happen if they put police data on Azure. Firstly, they considered it would be vulnerable to hackers: Microsoft\u2019s software \u201ccarries vulnerabilities which will be exploited by cybercriminals and other threat actors in due course\u201d.<\/p>\n

Separately, it added: \u201cPolice forces cannot be certain where their data will be processed or stored.<\/p>\n

\u201cThe hyper-scale and global nature of the Microsoft cloud means that police data, and metadata relating to police data could be transmitted and stored worldwide by Microsoft, and the extent of this will be unknown.\u201d<\/p>\n

The document specifically identified the potential risk from what it described as \u201cUS government insiders\u201d. It said: \u201cThere is a risk of compromise of sensitive data shared by, or taken from, Microsoft by the US government being released by US government insider attackers.\u201d<\/p>\n

The document explained that the data intended for migration was sensitive. In fact, \u201ca significant volume\u201d of it exceeded the classification \u201co\ufb03cial\u201d. In the UK, this suggests it was either \u201co\ufb03cial sensitive\u201d, \u201csecret\u201d, or \u201ctop secret\u201d.<\/p>\n

The assessment also suggested Microsoft\u2019s platform was unable to guarantee this data would be secure. \u201cThis places sensitive data, inadequately protected in an environment which then becomes a significantly more attractive target for attackers,\u201d it said.<\/p>\n

double quotation markWe really don\u2019t know if the data has been breached or notFormer senior policing source<\/p>\n

As well as risks, the report also listed mitigations. On the problem of cyber-attacks, it mandated that police servers should be repaired promptly, kept up to date and have antivirus software.<\/p>\n

To address the risk of \u201cUS government insiders\u201d and the concern that Microsoft might store UK policing data \u201cworldwide\u201d it suggested \u201capplying Microsoft\u2019s \u2018out-of-the-box\u2019 native encryption\u201d and leaving the final decision about using Microsoft up to individual police chiefs.<\/p>\n

Several experts interviewed by the Guardian, including cloud computing specialists and engineers working for Microsoft, suggested these mitigations were inadequate. Microsoft\u2019s internal encryption does not prevent its employees accessing UK police data; nor would it stop the US government obtaining British policing files.<\/p>\n

The National Police Chief\u2019s Council (NPCC) said access to data stored on the cloud is limited to those with a genuine need to access it and that this is subject to strict controls. Despite that claim, a Microsoft engineer who reviewed the Guardian\u2019s findings said the information \u201ccould be viewed by hundreds of people around the world, some of them not vetted, many of them not directly employed by Microsoft\u201d.<\/p>\n

Despite the risks identified by the assessment, every police force in the UK put its data, wholly or in part, on Microsoft\u2019s cloud. Some began migrating their information in 2017. A few forces, such as Police Scotland, are still finalising their adoption of the technology.<\/p>\n

The files cover the \u201cfull gamut of data: intelligence, body-worn video, digital evidence and case files, as well as the non-law enforcement data any organisation has\u201d, said the source who held senior roles in UK policing.<\/p>\n

\u2018We do not expect any sharing \u2026 without permission\u2019<\/p>\n

The UK government spends billions each year on services o\ufb00ered by three US tech companies: Amazon, Google and Microsoft.<\/p>\n

Up to 60% of its IT infrastructure is hosted on cloud platforms<\/a>. Britain\u2019s intelligence data is hosted on Amazon\u2019s cloud services, as is its customs data. The Ministry of Defence uses Azure. There is \u201ca deep dependency on US hyperscalers\u201d, said Dave Michels, a researcher with the Cloud Legal Project, at Queen Mary University of London.<\/p>\n

This is the result of 13 years of decisions like Dyson\u2019s. It is unclear if the potential consequences are broadly understood.<\/p>\n

When the Guardian approached the NPCC over the document signed by Dyson, it said: \u201cUK policing as standard requires the use of UK-only datacentres,\u201d but added that \u201con occasion\u201d Microsoft employees could access the data \u201cto provide support\u201d.<\/p>\n

Asked whether the US government could access the data, a police spokesperson said they could not comment on the phrase \u201cUS government insiders\u201d, because \u201cterminology \u2026 changes continuously\u201d and the document was \u201coutdated\u201d.<\/p>\n

\u201cIn line with the contract signed with Microsoft, we do not expect any sharing with the US government without the express permission of the UK government,\u201d they added.<\/p>\n

Microsoft said: \u201cThe suggestion that use of Microsoft cloud services means customer data is inherently insecure or automatically exposed to foreign governments is inaccurate.\u201d It said it had \u201cnever provided UK government data in response to any US or global authority request\u201d.<\/p>\n

Two legal experts, as well as several Microsoft engineers who spoke anonymously to the Guardian, suggested these assertions did not give an accurate picture of the potential risks.<\/p>\n

double quotation markThe risk is obvious, even though the providers of the cloud and the government both have an interest in talking it downDouwe Korff, professor of international law<\/p>\n

By default, Microsoft\u2019s cloud was \u201ca global network of datacentres\u201d, said Michels. It had facilities on every continent and this meant, generally, that data stored on it was stored everywhere: pieces of a single file could be held across multiple countries, from Sweden to Ethiopia.<\/p>\n

In recent years, Michels said, Microsoft had begun to offer clients in Europe greater assurances about where their data was stored, including assuring some customers that their data would remain within EU borders. But \u201cthe focus on data location is a bit of a red herring\u201d, he said.<\/p>\n

This was because thousands of engineers from more than 100 countries maintained Microsoft\u2019s systems. Some were directly employed by Microsoft, others worked for subcontractors in countries potentially hostile to the UK, from Israel to Egypt, China and Kazakhstan. \u201cYou\u2019ve seen the list of their sub-processors of people who have access to customer data,\u201d said Michels. \u201cIt\u2019s a long list.\u201d<\/p>\n

Some of the engineers could access data, such as UK police data, directly as part of customer support. Many more could see key features of what the data included.<\/p>\n

A Microsoft datacentre in the Netherlands. Photograph: Ramon van Flymen\/EPA<\/p>\n

Microsoft said it had \u201cstrong guardrails\u201d around data access by engineers.<\/p>\n

Douwe Korff, a professor of international law at London Metropolitan University, said the police statement that \u201cwe do not expect any sharing [of our data] with the US government\u201d was \u201ctypical lawyers\u2019 wriggling\u201d.<\/p>\n

\u201cThe risk is obvious, even though the providers of the cloud and the government both have an interest in talking it down,\u201d he said.<\/p>\n

Michels said: \u201cAs a cloud customer, if you\u2019re relying on a contractual commitment from a cloud provider not to hand over data when forced to under foreign law, that is not worth much more than the piece of paper it\u2019s written on.\u201d<\/p>\n

US law, including the Cloud Act, allows US authorities to access any data held by US cloud companies, including data held abroad. US authorities do not need a warrant to do this, and they can require US companies to not disclose such access to cloud customers.<\/p>\n

Microsoft, Amazon and Google have insisted they would fight such requests, said Korff. But there is \u201cnothing that is legally binding\u201d that would prevent them from sharing other governments\u2019 data if US authorities demanded it.<\/p>\n

In response to a query from the Guardian, Microsoft said it \u201chas never provided UK government data in response to any US or global authority request\u201d. It added in a follow-up that it was bound by its \u201ccontractual commitments\u201d.<\/p>\n

\u201cIf UK law prohibits us from turning over data to another government, that is a binding law that would govern our response to any hypothetical demand,\u201d it said.<\/p>\n

\u2018The security guys expected a big breach by now\u2019<\/p>\n

The Guardian spoke to six people who have closely followed the country\u2019s data storage arrangements over the past decade. Several of them said that senior leaders did not view dependence on US tech companies as a concern, and trusted them not to give data to US authorities.<\/p>\n

\u201cGovernment security departments are painfully aware of all the risks, \u201d said Mark Butcher, a cloud expert who acts as a strategic adviser across government. \u201cBut the way that most senior leaders talk about it is: \u2018Well, we\u2019ve been reassured by Microsoft that it would never happen.\u2019\u201d<\/p>\n

But the source who has held senior policing roles said: \u201cAll the security guys I worked with when this policy came in expected a big breach by now, and we know it will take that to change the police\u2019s position.<\/p>\n

\u201cThe truth is, however, the level of logging and information in the cloud systems would not necessarily tell us if there was a problem. We really don\u2019t know if the data has been breached or not.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"Vast troves of highly sensitive police data are lying on Microsoft cloud platforms which an o\ufb03cial UK security…\n","protected":false},"author":2,"featured_media":775091,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[59,57,58,50,56,54,55],"class_list":["post-775090","post","type-post","status-publish","format-standard","has-post-thumbnail","category-united-kingdom","tag-gb","tag-great-britain","tag-greatbritain","tag-news","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/775090","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=775090"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/775090\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/775091"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=775090"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=775090"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=775090"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}