UK Police Data Faces Long-Standing Microsoft Cloud Security Concerns
A 2017 UK assessment warned that police data on Microsoft Azure could be accessed by US government insiders, and experts say risks persist.
The Guardian published a 2017 risk assessment signed by then City of London police commissioner Ian Dyson covering 15 risks of migrating UK police data to Microsoft Azure, including vulnerabilities, 'US government insiders' access, and worldwide transmission of data covering criminal records from 40+ police forces. Five experts say the risks remain relevant, and Microsoft told Police Scotland in 2023 it cannot guarantee data sovereignty. The US CLOUD Act allows American authorities to compel disclosure of data held by US companies regardless of storage location. UK police officials claim data stays in the UK, contradicting Microsoft's statements.
- 2017 assessment flagged 15 risks including US government insider access to Azure-hosted police data
- Data includes criminal records and victim statements from more than 40 UK police forces
- Microsoft told Police Scotland it cannot guarantee data stays within UK borders
- US CLOUD Act permits compelled disclosure of data held by US providers abroad
- Experts warn cloud logging might not detect a breach even if one occurred
- Vendors
- Microsoft
- Products
- Microsoft Azure
- Victims
- UK Police
- Organizations
- City of London PoliceThe GuardianPolice Scotland
- Countries
- United KingdomUnited States
From the original article
3 min read at securityaffairs.com
A 2017 UK assessment warned that police data on Microsoft Azure could face foreign access risks. The risks may still exist. A Guardian investigation has surfaced a 2017 document signed off by then City of London police commissioner Ian Dyson, who also held the title of senior information risk owner for the entire country.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.