Extensive collections of sensitive police data are currently stored on Microsoft cloud platforms, a situation flagged by a UK security assessment that identified vulnerabilities to potential compromise by foreign entities, including the US government. This alarming revelation emerged from an investigation by the Guardian.
The compromised files encompass a wide range of sensitive information, including criminal records, victim statements, and internal communications, spanning more than 40 police jurisdictions across the UK. Some of these files are believed to exceed standard classification, suggesting they may contain details considered “secret” or even “top secret.”
At the center of this issue is Microsoft Azure, a leading cloud service utilized widely by businesses and governments around the globe. The infrastructure backing Azure incorporates data centers, networking equipment, and fiber optic cables located across over 100 countries.
Concerns over cloud storage security have been growing in recent years, prompting British police to assign sensitive data to Microsoft during a meeting in 2017, as documented by the Guardian. During this meeting, officers acknowledged that “US government insiders” might gain access to certain data, and the transmission of this information on a global scale could occur with an unknown extent of exposure.
An evaluation conducted by five experts revealed that the risks outlined in the initial document remain relevant today. Presently, nearly every police force in the UK relies on Microsoft Azure, with the UK government allocating at least £1.9 billion annually for Microsoft software.
One source with a background in senior UK policing remarked, “There’s no evidence that this has been properly understood.” He emphasized the sensitivity of the data, stating that if it fell into the wrong hands, it could endanger lives.
In response to inquiries about data security, police officials downplayed the associated risks, asserting that contracts with Microsoft prohibited unauthorized access by US authorities and that stored data remained within the UK. However, this assertion appears to contradict key disclosures by Microsoft, which has acknowledged that data could potentially be stored outside the UK and that it cannot guarantee data sovereignty.
The Challenge of US Government Access
During a 2017 meeting led by senior police officer Ian Dyson, participants delved into 15 risks pertaining to the migration of police data to Microsoft’s global cloud. The meeting covered both the deployment of Microsoft software, including Office 365, and the reliance on Azure.
This assessment came in the wake of a government strategy known as “cloud first,” introduced in 2013, which urged almost all departments to transition their data to commercial cloud offerings primarily provided by US companies. Departments opting out faced extensive bureaucratic hurdles.
Dyson was not just the City of London’s police commissioner; he also held the position of senior information risk owner for all UK police, responsible for establishing safe data handling norms.
In the assessment, officers concluded that placing police data on Azure would expose it to hacker threats. It was highlighted that Microsoft’s software carried vulnerabilities prone to exploitation by cybercriminals.
Moreover, concerns regarding US governmental access were elaborated, indicating there was a risk of sensitive data being compromised or misused by “US government insider attackers.” The data intended for migration was noted as being highly sensitive, with a considerable amount classified above “official,” potentially categorized as “official sensitive,” “secret,” or “top secret.”
The evaluation also underscored that Microsoft’s platform lacked assurances regarding the secure handling of such sensitive information, making it a more attractive target for cyber threats.
Beyond outlining risks, the document presented several mitigation strategies. To counter cyber threats, it recommended that police servers be promptly maintained, updated, and equipped with antivirus software. To mitigate the risks posed by “US government insiders,” it suggested employing Microsoft’s native encryption and allowing individual police chiefs to make decisions regarding Microsoft‘s utilization.
Experts, including cloud computing specialists and engineers from Microsoft, expressed doubts about the effectiveness of these mitigation measures, believing that internal encryption does not effectively restrict employee access to UK police data.
Despite the identified risks, all UK police forces have transferred their data to Microsoft’s cloud, with some beginning their migration as early as 2017. A few forces, such as Police Scotland, are still in the process of adopting this technology.
Limited Expectations for Data Sharing
The UK government spends billions on services from leading US tech firms, including Amazon, Google, and Microsoft. Approximately 60% of its IT infrastructure is hosted on cloud platforms, with intelligence data located within Amazon’s cloud services and the Ministry of Defence relying on Azure.
This dependency is rooted in over a decade of decisions like Dyson’s, and it remains uncertain whether the potential ramifications are fully recognized. When approached by the Guardian regarding Dyson’s document, the National Police Chief’s Council (NPCC) stated that UK policing typically mandates the use of UK-only data centers but acknowledged “on occasion” access by Microsoft employees for support purposes.
When asked about possible access by the US government, a police spokesperson refrained from commenting on the term “US government insiders,” noting it was outdated and that they do not expect unauthorized sharing without the UK government’s explicit permission.
Microsoft responded by asserting that the claim regarding the inherent insecurity of its cloud services is inaccurate. It insisted, “We have never provided UK government data in response to any US or global authority request.” Yet, legal experts and several anonymous Microsoft engineers cautioned that these statements might not reflect the full spectrum of potential risks.
According to Mark Butcher, a cloud expert, many senior leaders remain complacent about dependence on US tech companies, often placing their trust in reassurances from Microsoft regarding data safety. “Government security departments are painfully aware of all risks,” he noted, but the prevailing sentiment among many leaders appears to be that Microsoft would safeguard against unauthorized access.
Anticipating Security Breaches
A former senior policing source remarked, “All the security guys I worked with expected a significant breach by now, and it will likely take that event to change the police’s viewpoint.” He emphasized the inadequacies of cloud systems in certain situations, saying, “We really don’t know if the data has been breached or not.”
Editor’s Take
This development raises critical concerns about data security and governmental oversight in an age of escalating cyber threats. Users and organizations relying on cloud services may need to reevaluate their trust in two major forces: corporate assurances and data sovereignty. The incident underscores the importance of maintaining vigilance and seeking clarity on the implications of cloud dependencies.
Source: www.theguardian.com
