conv.

All stories
SecurityQuiet 5d · day 6

Guardian reveals UK police data stored on Microsoft Azure vulnerable to US access

Official security assessment found sensitive files from 40+ police forces at risk of compromise by US government and foreign actors.

newest coverage 4d agosummary written 5d ago12 pieces42 likes & upvotes2 comments MastodonNewswiresHacker NewsGoogle NewsBluesky

What to know

  • More than 40 UK police forces store highly sensitive data—criminal records, victim statements, classified files—on Microsoft Azure, which a 2017 official assessment found vulnerable to US government access and foreign compromise.
  • Police claim UK contracts prevent US authorities from viewing the data and that it remains in the UK, but Microsoft disclosed to Police Scotland in 2023 that data "can go outside the UK" and it "cannot guarantee data sovereignty".
  • The UK government spends at least £1.9bn on Microsoft software annually, and almost every police force now depends on Azure, despite risks identified nine years ago remaining unresolved.
  • Five specialists confirmed the security risks from the original 2017 assessment persist today, raising concerns that potentially "secret" or "top secret" classified information may be vulnerable.
some voices

Storing sensitive police data on US-based cloud platforms undermines UK digital sovereignty and puts public safety at risk.

  • “Official assessments showing sensitive UK police data on US cloud platforms is vulnerable to US legal access and foreign compromise exposes our eroded digital sovereignty.”

    Fife4Europe · Mastodon ↗

“US government insiders would be able to see the data, and that it could be "transmitted worldwide", with "the extent of this … unknown".”

2017 police decision document, Official UK police record · The Guardian ↗

Ian Dyson Senior UK police officerMicrosoft Cloud service providerUK Police Forces Data custodiansThe Guardian Investigative journalist

Guardian reveals UK police data stored on Microsoft Azure vulnerable to US access
theguardian.com

How it unfolded 1 development · click the chart to see its coverage articlesposts

Peak 6 pieces in two hours at Sep 18, 12 PM; 12 pieces over 6 days (4 articles · 8 posts) Sep 18, 12 PM — 6 pieces · 4 articles · 2 posts — Mastodon 3, Newswires 2, Google News 1Sep 18, 2 PM — 1 piece · 1 post — Hacker News 1Sep 18, 4 PM — 1 piece · 1 post — Bluesky 1Sep 18, 6 PM — quietSep 18, 8 PM — quietSep 18, 10 PM — quietSep 19, 12 AM — 1 piece · 1 post — Mastodon 1Sep 19, 2 AM — 2 pieces · 2 posts — Mastodon 2Sep 19, 4 AM — quietSep 19, 6 AM — quietSep 19, 8 AM — 1 piece · 1 post — Mastodon 1Sep 19, 10 AM — quietSep 19, 12 PM — quietSep 19, 2 PM — quietSep 19, 4 PM — quietSep 19, 6 PM — quietSep 19, 8 PM — quietSep 19, 10 PM — quietSep 20, 12 AM — quietSep 20, 2 AM — quietSep 20, 4 AM — quietSep 20, 6 AM — quietSep 20, 8 AM — quietSep 20, 10 AM — quietSep 20, 12 PM — quietSep 20, 2 PM — quietSep 20, 4 PM — quietSep 20, 6 PM — quietSep 20, 8 PM — quietSep 20, 10 PM — quietSep 21, 12 AM — quietSep 21, 2 AM — quietSep 21, 4 AM — quietSep 21, 6 AM — quietSep 21, 8 AM — quietSep 21, 10 AM — quietSep 21, 12 PM — quietSep 21, 2 PM — quietSep 21, 4 PM — quietSep 21, 6 PM — quietSep 21, 8 PM — quietSep 21, 10 PM — quietSep 22, 12 AM — quietSep 22, 2 AM — quietSep 22, 4 AM — quietSep 22, 6 AM — quietSep 22, 8 AM — quietSep 22, 10 AM — quietSep 22, 12 PM — quietSep 22, 2 PM — quietSep 22, 4 PM — quietSep 22, 6 PM — quietSep 22, 8 PM — quietSep 22, 10 PM — quietYesterday, 12 AM — quietYesterday, 2 AM — quietYesterday, 4 AM — quietYesterday, 6 AM — quietYesterday, 8 AM — quietYesterday, 10 AM — quietYesterday, 12 PM — quietYesterday, 2 PM — quietYesterday, 4 PM — quietYesterday, 6 PM — quietYesterday, 8 PM — quietYesterday, 10 PM — quietToday, 12 AM — quietToday, 2 AM — quiet 1
Sep 19Sep 20Sep 21Sep 22yesterdaynow · 4:44 AM ET
  1. 1

    Police and Microsoft respond to vulnerability allegations

    When the Guardian approached police, they dismissed the risks, stating that UK contracts with Microsoft prevent US authorities from viewing data without permission and that data remains in the UK. Microsoft responded that it "does not provide any government with direct or unfettered access to customer data" and has not provided UK data in response to US government requests, though it acknowledged responding to US government requests through valid legal processes.

    “There's no evidence that this has been properly understood. The data is "some of the most sensitive that exists". You're talking about information that, if it gets into the wrong hands, or if the information is incorrect, [means] people can get hurt or may die.”
    — Senior UK policing source, Former senior police officer · source
    • junesim63@mstdn.social

      "As a cloud customer, if you’re relying on a contractual commitment from a cloud provider not to hand over data when forced to under foreign law, that is not worth much more than the piece of paper it’s written on.” The police were warned years ago this would be a security risk. # UKPolicing # Microsoft # Data # DataSecurity Sensitive UK police…

      junesim63@mstdn.socialMastodon5d ago1▲view on Mastodon ↗
    2 more of the top 3 · 5 posts in this stretch
    • informingbritain.com

      "SENSITIVE POLICE DATA HELD ON 'VULNERABLE' CLOUD PLATFORM" @AishaDown.bsky.social for @TheGuardian.com Highly sensitive UK police data is held on Microsoft Azure, a cloud platform a Guardian investigation says is vulnerable to compromise by foreign actors. #TheGuardian #TomorrowsPapersToday

      informingbritain.comBluesky5d ago1▲view on Bluesky ↗
    • SuffolkLITLab@esq.social

      TL;DR: A UK security assessment reveals that sensitive police data stored on Microsoft cloud platforms is at risk of compromise by foreign actors and the US government, including criminal records and internal communications. The findings raise serious concerns about the security of critical information across over 40 UK police forces. https://www…

      SuffolkLITLab@esq.socialMastodon4d agoview on Mastodon ↗
    all of them →
  2. background

    Guardian investigation reveals police data vulnerability to US access and foreign compromise — The Guardian publishes an exclusive investigation finding that sensitive files from more than 40 UK police forces—including criminal records, victim statements, internal emails, and some files exceeding "official" classification—are stored on Microsoft Azure, which an official UK security assessment deemed vulnerable to compromise by foreign actors and the US government. Five specialists reviewing the Guardian's findings confirmed the risks identified in the 2017 document persist today.

  3. background

    Microsoft discloses to Police Scotland that data can leave UK — Microsoft provided Police Scotland with a disclosure stating that data "can go outside the UK" and that it "cannot guarantee data sovereignty", contradicting later police statements about data remaining in the UK.

  4. background

    UK police decide to store sensitive data on Microsoft Azure — In a 2017 meeting chaired by senior officer Ian Dyson, British police stakeholders decided to transfer sensitive data to Microsoft's cloud platform. The decision document examined by the Guardian noted that officers accepted "US government insiders" would be able to see the data and it could be "transmitted worldwide", with "the extent of this … unknown".

Also covered reported alongside — the timeline has no entry for these yet

  1. 2 outlets Sensitive UK police data vulnerable to ‘compromise’ by US government and foreign actors

    first by Guardian Tech, 5d ago · also Guardian

What people are saying 2 voices from 1 site · best of 5 · verbatim