UK police data vulnerable to compromise on Microsoft Azure cloud

Sensitive records held by more than 40 UK police forces are stored on Microsoft Azure cloud platforms that an official security assessment found vulnerable to compromise by foreign actors and the US government.

The files comprise criminal records, victim statements, internal emails, and material exceeding official classification, potentially encompassing secret or top-secret records. A 2017 meeting record shows that when British police decided to deploy the system, officers accepted that US government personnel could see data and that it might be transmitted worldwide. Experts warn these risks persist, with the UK government spending at least £1.9 billion annually on Microsoft software.

Police maintain that commercial contracts ensure records remain stored in the UK and prevent US access without permission. However, this contradicts a 2023 disclosure by Microsoft to Police Scotland stating that data can leave the country and that data sovereignty cannot be guaranteed. 

Training Announcement: The BCS Practitioner Certificate in Information Risk Management (PCIRM) is an advanced-level programme for data specialists who actively monitor and minimise the risk of cyberattacks, information security incidents, and data protection violations. Find out more.