UK police data on Microsoft cloud deemed vulnerable to US, foreign compromise

An official UK security assessment has found that vast troves of highly sensitive police data stored on Microsoft's cloud platform are vulnerable to 'compromise' by foreign actors and the US government, a Guardian investigation can reveal. The files include criminal records, victim statements, internal emails, and sensitive information held by more than 40 police forces across the UK. The assessment, which has not been made public, raises serious questions about the security of critical national infrastructure when it is hosted by foreign-owned tech giants.

Microsoft is one of the largest providers of cloud services to governments worldwide, including the UK's public sector. Its Azure platform and Office 365 suite are widely used by police forces for email, document storage, and case management. But the assessment suggests that the very architecture that makes these services convenient - global data centers, remote access, and automated backups - also creates exposure points that hostile actors could exploit.

The specific concern about the US government stems from the CLOUD Act of 2018, which allows American law enforcement agencies to compel US-based companies like Microsoft to produce data stored on their servers, even if that data is physically located outside the United States. For UK police, this means that sensitive operational information could potentially be accessed by US authorities without UK oversight, a scenario that the security assessment deems a 'compromise' risk.

This is not the first time that the UK's reliance on US cloud providers has raised eyebrows. In 2015, the UK government signed a data-sharing agreement with the US that some critics argued weakened British data protection. More recently, the UK's own data protection regulator has warned about the risks of transferring personal data to countries with weaker safeguards. But this assessment goes further, suggesting that even within the UK's own borders, the data is not fully secure.

For police chiefs and government CIOs, the findings are a wake-up call. The convenience of hyperscale cloud providers comes with a hidden cost: a loss of control over where data resides and who can legally compel its disclosure. While Microsoft has repeatedly stated its commitment to protecting customer data and has challenged US government requests in court, the assessment suggests that the legal and technical safeguards are not sufficient to eliminate the risk entirely.

The stakes are high. If police data were to be compromised, it could undermine ongoing investigations, endanger witnesses, and erode public trust in law enforcement. It could also expose the UK to espionage, as foreign actors might target the data for intelligence purposes. The assessment's findings will likely accelerate the UK government's push for 'sovereign cloud' solutions - domestic alternatives that keep data within UK jurisdiction and under UK law.

For now, the UK police forces continue to use Microsoft's cloud, but the assessment adds urgency to a broader debate about digital sovereignty. As more public sector bodies migrate to cloud services, the question is no longer just about cost and efficiency, but about who ultimately holds the keys to the kingdom. The answer will shape the future of national security in the digital age.