US government might have access to sensitive UK police data
What's the story
An investigation by The Guardian has revealed that sensitive police data in the UK is stored on Microsoft cloud platforms. An official UK security assessment, a police document seen by Guardian and chaired by police officer Ian Dyson, flagged these platforms as being at risk of "compromise" by foreign actors and even the US government. The information stored includes criminal records, victim statements, internal emails, and other sensitive data from over 40 police forces across the UK.
Scrutiny
What is Microsoft Azure?
The cloud platform in question is Microsoft Azure, a major commercial product of the US tech giant.
It is used by businesses and governments around the world and relies on a network of IT infrastructure across over 100 countries.
The potential risks posed by cloud platforms have been a topic of debate in recent years, with concerns about data storage practices and security measures.
Data transfer decision
Decision to store data on Microsoft cloud taken in 2017
In a meeting in 2017, British police decided to transfer some of their most sensitive data to the Microsoft platform.
The decision was made with the understanding that "US government insiders" could access this information and that it could be "transmitted worldwide," with the full extent of this risk being unknown.
Today, nearly every UK police force uses Microsoft Azure, costing the UK government at least £1.9 billion annually for Microsoft software.
Data vulnerability
Police officials downplay risks
A source who has held senior roles in UK policing expressed concern over lack of understanding about these risks.
They said, "The data is some of the most sensitive that exists," and warned that if this information falls into the wrong hands or is incorrect, it could result in harm or even death.
When questioned about these vulnerabilities, police officials downplayed them by citing Britain's contracts with Microsoft, which they claimed prevented US authorities from accessing data without explicit permission.
Company response
Microsoft's response to allegations
Microsoft has maintained that it "does not provide any government with direct or unfettered access to customer data," and that it hasn't provided UK data in response to a US government request.
The company also said, like all US-based tech companies, it responds to valid legal requests from the US government.
However, five experts who reviewed The Guardian's findings said the risks identified in 2017 still exist today.
Security assessment
'Microsoft's software carries vulnerabilities which will be exploited by cybercriminals'
The 2017 security assessment, chaired by Dyson, flagged 15 risks that UK police forces would face if they transferred their data to Microsoft's global cloud.
The document warned that Microsoft's software "carries vulnerabilities which will be exploited by cybercriminals and other threat actors in due course."
It also noted the risk from "US government insiders," saying there is a risk of sensitive data shared or taken from Microsoft being released by such attackers.
Measures
Experts criticize mitigation measures as inadequate
The assessment recommended that police servers must be repaired promptly, kept up to date, and have antivirus software to mitigate cyberattack risks.
It also suggested applying Microsoft's "out-of-the-box" native encryption for data security.
However, several experts, including cloud computing specialists and Microsoft engineers, criticized these mitigations as inadequate.
They argued that Microsoft's internal encryption doesn't prevent its employees from accessing UK police data or stop the US government from obtaining British policing files.