Key facts
- Sensitive UK police data, including criminal records and victim statements, is stored on Microsoft Azure cloud platforms.
- A 2017 UK security assessment deemed the data vulnerable to compromise by foreign actors and the US government.
- The data may exceed "official" classification, potentially reaching "secret" or "top secret" levels.
- Police accepted in 2017 that "US government insiders" could see the data, which could be "transmitted worldwide" to an unknown extent.
- Nearly all UK police forces now depend on Microsoft Azure, with some migrating data in 2017.
- Microsoft stated that data "can go outside the UK" and it "cannot guarantee data sovereignty."
Highly sensitive UK police data, including criminal records and victim statements, is stored on Microsoft's Azure cloud platforms, making it vulnerable to compromise by foreign actors and the US government, according to a Guardian investigation. A 2017 assessment identified significant risks, including potential access by "US government insiders" and data transmission worldwide to an unknown extent, with some files potentially classified as "secret" or "top secret".
Despite these concerns, nearly all UK police forces have migrated their data to Microsoft's cloud since 2017, driven by a government "cloud first" policy introduced in 2013. The UK government spends at least £1.9 billion annually on Microsoft software, with up to 60% of its IT infrastructure hosted on cloud platforms. Experts have suggested that the mitigations offered by Microsoft, such as native encryption, are insufficient to prevent access by Microsoft employees or the US government.
Microsoft has stated that it does not provide governments with direct access to customer data and has not provided UK data in response to a US government request. However, the company disclosed to Police Scotland in 2023 that data "can go outside the UK" and that it "cannot guarantee data sovereignty." Police statements to the Guardian suggested that US authorities could not view data without express permission and that data remained in the UK, which appeared to contradict Microsoft's admissions.