--- title: "Sensitive UK police data on Microsoft's cloud j… | Firevault" url: https://fire-vault.com/news/uk-police-data-microsoft-cloud-sovereignty-risk-2026 description: "A Guardian investigation reports that criminal records, victim statements and intelligence files from more than 40 UK police forces sit on Microsoft Azure, on…" lang: en-GB --- News · Data Sovereignty # Sensitive UK police data on Microsoft's cloud judged vulnerable to compromise by the US government and foreign actors A Guardian investigation reports that criminal records, victim statements and intelligence files from more than 40 UK police forces sit on Microsoft Azure, on a platform an official police risk assessment judged vulnerable to compromise by foreign actors and to access by United States government insiders. **Mark Fermor**CTO, CMO and Founder, Firevault Published 18 September 2026 · 6 min read Share LinkedIn (https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fuk-police-data-microsoft-cloud-sovereignty-risk-2026)Email UK police case files dissolving into a cyan cloud data stream that crosses a world map toward a distant United States data centre, with a magenta thread tracing the path out of the country Vast quantities of highly sensitive police data are held on Microsoft cloud platforms that an official United Kingdom security assessment deemed vulnerable to "compromise" by foreign actors and by the United States government, according to a Guardian investigation published on 18 September 2026. The files are reported to include criminal records, victim statements, internal emails and sensitive information held by more than 40 police forces across the United Kingdom. Some of the material exceeds "official" classification, according to a police document seen by the Guardian, raising the possibility that information could be classed as secret or top secret. The platform in question is Microsoft Azure, which rests on data centres, networking equipment and fibre optic cables spanning more than 100 countries. ## What the 2017 assessment actually said British policing decided to place some of its most sensitive data on the Microsoft platform in a 2017 meeting chaired by Ian Dyson, then Commissioner of the City of London Police and the senior information risk owner for policing across Britain. Stakeholders considered fifteen risks of moving police data to Microsoft's global cloud. The resulting summary document, seen by the Guardian, recorded that Microsoft software "carries vulnerabilities which will be exploited by cybercriminals and other threat actors in due course". It also recorded that "police forces cannot be certain where their data will be processed or stored", and that police data and its metadata "could be transmitted and stored worldwide by Microsoft, and the extent of this will be unknown". The document went further and named the insider risk directly, stating that there was "a risk of compromise of sensitive data shared by, or taken from, Microsoft by the US government being released by US government insider attackers". The mitigations offered were modest by comparison. Servers were to be patched promptly and kept up to date with antivirus software. For the sovereignty and insider risks, the document suggested applying Microsoft's native encryption and leaving the final decision to individual chief constables. Every police force in the United Kingdom subsequently placed its data, wholly or in part, on Microsoft's cloud. Some began migrating in 2017 and Police Scotland is reported to be still finalising its adoption. ## Why the mitigation does not answer the risk Several specialists who reviewed the findings, including cloud computing experts and engineers working for Microsoft, told the Guardian that the mitigations were inadequate. Platform encryption managed by the provider does not prevent provider staff from reaching customer data, and it does not prevent a lawful United States government demand from being served on a United States company. One Microsoft engineer who reviewed the findings said the information "could be viewed by hundreds of people around the world, some of them not vetted, many of them not directly employed by Microsoft". A source who has held senior roles in United Kingdom policing described the data as "some of the most sensitive that exists", adding that if it reaches the wrong hands "people can get hurt or may die". The National Police Chiefs' Council said access to data stored in the cloud is limited to those with a genuine need and is subject to strict controls, and that policing requires the use of United Kingdom data centres, while accepting that "on occasion" Microsoft employees could access data to provide support. Those reassurances sit awkwardly beside Microsoft's own disclosure to Police Scotland in 2023, in which the company said data "can go outside the UK" and that it "cannot guarantee data sovereignty (https://fire-vault.com/why-oss/control)". Microsoft says it does not provide any government with direct or unfettered access to customer data, that it has not provided United Kingdom data in response to a United States government request, and that, like all United States technology companies, it responds to requests made through valid legal processes. ## The legal position is the uncomfortable part Under United States law, including the CLOUD Act, United States authorities can compel a United States cloud company to produce data it holds, including data stored abroad, and can require that the demand is not disclosed to the customer. Commercial contract terms and regional data centre commitments do not override that statute. The scale of the dependency is what turns a legal technicality into a national question. Up to 60 per cent of United Kingdom government information technology infrastructure is hosted on cloud platforms, the government spends at least 1.9 billion pounds a year on Microsoft software, and the Ministry of Defence uses Azure. Researchers describe a deep dependency on United States hyperscalers built up over thirteen years of cloud-first policy. ## The Firevault view There are two separate questions inside this story, and they are constantly conflated. The first is confidentiality of live systems. Policing needs operational systems that are available, searchable and shared between forces. Those systems will be connected, and they will carry the risks that come with connection, including provider access, legal compulsion and the ordinary risk of intrusion. The second is custody of the record. A large share of what sits in these platforms is not being worked on today. It is retained material: closed case files, archived evidence, historic intelligence, records kept because the law requires them to be kept. That material does not need to be permanently reachable, and every day it stays reachable is another day it can be copied, compelled or exfiltrated. Encryption managed by the platform does not resolve either question, because the party holding the keys is the party you are trying to reduce trust in. Contractual assurance does not resolve it either, because a contract cannot repeal a statute. Physical disconnection does resolve the second question. Offline Secure Storage (https://fire-vault.com/offline-secure-storage)® holds selected data on dedicated hardware in a jurisdiction the customer chooses, with no network path to it until an authorised out-of-band command opens one for a defined window. There is no standing connection to intercept, no live platform identity to compel, and no provider console through which an unvetted administrator can browse. When the path does not exist, the copy is not reachable, whoever is asking and whatever authority they hold. The lesson from this investigation is not that cloud platforms are unusable. It is that a risk written down in 2017 and mitigated with encryption and delegated decision making is still an open risk in 2026. Any organisation holding records of consequence, in policing or anywhere else, should be able to say precisely which of its data must stay live and which should be held somewhere an outside party cannot reach at all. ## What to do about it Separate the live estate from the retained estate, and write the split down. Identify the material whose loss or exposure would be most damaging, and ask a plain question about each set: who, other than us, can lawfully or technically obtain this today. Where the answer includes a third party or a foreign authority, move that material to storage that is physically disconnected and held under the jurisdiction you have chosen, and keep only what genuinely needs to be reachable in the connected platform. Source: The Guardian, "Sensitive UK police data vulnerable to 'compromise' by US government and foreign actors", 18 September 2026. ## Questions It reported that criminal records, victim statements, internal emails and sensitive information from more than 40 UK police forces are held on Microsoft Azure, and that an official UK security assessment judged the platform vulnerable to compromise by foreign actors and to access by United States government insiders. In 2017, at a meeting chaired by the then senior information risk owner for British policing. The assessment recorded that police forces could not be certain where data would be stored, that data could be transmitted worldwide, and that there was a risk of compromise by United States government insider attackers. Not for this risk. Encryption managed by the platform provider does not prevent provider staff from reaching customer data, and it does not prevent a lawful demand being served on a United States company. The party holding the keys is the party the control is meant to protect against. United States law allows United States authorities to compel a United States cloud company to produce data it holds, including data stored outside the United States, and to require that the demand is not disclosed to the customer. Contract terms and regional hosting commitments do not override that statute. Up to 60 per cent of United Kingdom government information technology infrastructure is hosted on cloud platforms, the government spends at least 1.9 billion pounds a year on Microsoft software, and the Ministry of Defence uses Azure. It holds selected data on dedicated hardware in a jurisdiction the customer chooses, with no network path to it until an authorised out-of-band command opens one for a defined window. There is no standing connection, no live platform identity to compel and no provider console to browse, so retained records are not reachable by an outside party. About the author **Mark Fermor** CTO, CMO and Founder of Firevault. Mark writes on physical control, offline storage and the incidents that show why both matter. ## More data sovereignty - Threat Analysis · 22 Oct 2026**PHP2Shell: critical PHP vulnerability forces websites offline worldwide**_Read the analysis_: https://fire-vault.com/news/php2shell-critical-php-vulnerability-websites-offline-2026 - Breach Analysis · 21 Oct 2026**State Bank of India confirms data loss after 3,897 customer records found on the dark web**_Read the analysis_: https://fire-vault.com/news/sbi-confirms-data-breach-customer-records-dark-web-2026 - Breach Analysis · 21 Oct 2026**Cyberattack on cloud provider Arcadia may expose data of 125,000 Japanese police officers and staff**_Read the analysis_: https://fire-vault.com/news/arcadia-cyberattack-japan-police-data-breach-2026 - Regulation · 20 Oct 2026**ICO reprimands Data Cymru and Ogi after "Password1" test account exposed data of 3,300 people, mostly children**_Read the analysis_: https://fire-vault.com/news/ico-reprimand-data-cymru-ogi-password1-test-account-2026 - Threat Intelligence · 16 Oct 2026**GhostAction returns: about 1,900 GitHub accounts used to target more than 30,000 repositories**_Read the analysis_: https://fire-vault.com/news/ghostaction-github-actions-supply-chain-attack-october-2026 - Breach Analysis · 15 Oct 2026**EY data breach: client tax records exposed through a support platform**_Read the analysis_: https://fire-vault.com/news/ey-data-breach-client-tax-records-october-2026 Back to the Knowledge Vault: https://fire-vault.com/learn/knowledge Why #OSS ### Keep a clean copy out of reach. Offline Secure Storage® keeps one copy physically disconnected at the hardware level between sessions. Why #OSS: https://fire-vault.com/why-oss Control ### Govern the paths attackers depend on. Physical, out-of-band control of selected network paths, composed into ten Blueprints. Explore Control: https://fire-vault.com/control Image: Vault (https://fire-vault.com/__l5e/assets-v1/b9413e6e-5b45-442d-ab80-67cf0c578ba6/oss-approved-vault.png) Ready to start? ### Create your Vault online. Business Vaults from £360 a month inc VAT, on a 36-month commitment. Get started: https://fire-vault.com/get-started Book a demo: https://fire-vault.com/demo ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/uk-police-data-microsoft-cloud-sovereignty-risk-2026#webpage", "url": "https://fire-vault.com/news/uk-police-data-microsoft-cloud-sovereignty-risk-2026", "name": "Sensitive UK police data on Microsoft's cloud j…", "description": "A Guardian investigation reports that criminal records, victim statements and intelligence files from more than 40 UK police forces sit on Microsoft Azure, on…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/news/uk-police-data-microsoft-cloud-sovereignty-2026.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/uk-police-data-microsoft-cloud-sovereignty-risk-2026#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/uk-police-data-microsoft-cloud-sovereignty-risk-2026#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Sensitive UK police data on Microsoft's cloud judged vulnerable to compromise by the US government and foreign actors", "item": "https://fire-vault.com/news/uk-police-data-microsoft-cloud-sovereignty-risk-2026" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Sensitive UK police data on Microsoft's cloud judged vulnerable to compromise by the US government and foreign actors", "description": "A Guardian investigation reports that criminal records, victim statements and intelligence files from more than 40 UK police forces sit on Microsoft Azure, on a platform an official police risk assessment judged vulnerable to compromise by foreign actors and to access by United States government insiders.", "url": "https://fire-vault.com/news/uk-police-data-microsoft-cloud-sovereignty-risk-2026", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/news/uk-police-data-microsoft-cloud-sovereignty-2026.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/uk-police-data-microsoft-cloud-sovereignty-2026.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/news/uk-police-data-microsoft-cloud-sovereignty-2026.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/news/uk-police-data-microsoft-cloud-sovereignty-2026.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "CTO, CMO & Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2026-09-18T21:52:22.421058+00:00", "dateModified": "2026-09-18T21:52:22.421058+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/uk-police-data-microsoft-cloud-sovereignty-risk-2026" }, "inLanguage": "en-GB", "articleSection": "Data Sovereignty", "wordCount": 1193, "keywords": "Sensitive, Data Sovereignty, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "Vast quantities of highly sensitive police data are held on Microsoft cloud platforms that an official United Kingdom security assessment deemed vulnerable to \"compromise\" by foreign actors and by the United States government, according to a Guardian investigation published on 18 September 2026. The files are reported to include criminal records, victim statements, internal emails and sensitive in", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2026 }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What did the Guardian investigation find?", "acceptedAnswer": { "@type": "Answer", "text": "It reported that criminal records, victim statements, internal emails and sensitive information from more than 40 UK police forces are held on Microsoft Azure, and that an official UK security assessment judged the platform vulnerable to compromise by foreign actors and to access by United States government insiders." } }, { "@type": "Question", "name": "When was the risk first identified?", "acceptedAnswer": { "@type": "Answer", "text": "In 2017, at a meeting chaired by the then senior information risk owner for British policing. The assessment recorded that police forces could not be certain where data would be stored, that data could be transmitted worldwide, and that there was a risk of compromise by United States government insider attackers." } }, { "@type": "Question", "name": "Does encryption solve the problem?", "acceptedAnswer": { "@type": "Answer", "text": "Not for this risk. Encryption managed by the platform provider does not prevent provider staff from reaching customer data, and it does not prevent a lawful demand being served on a United States company. The party holding the keys is the party the control is meant to protect against." } }, { "@type": "Question", "name": "What is the CLOUD Act issue?", "acceptedAnswer": { "@type": "Answer", "text": "United States law allows United States authorities to compel a United States cloud company to produce data it holds, including data stored outside the United States, and to require that the demand is not disclosed to the customer. Contract terms and regional hosting commitments do not override that statute." } }, { "@type": "Question", "name": "How much UK public data is exposed to this dependency?", "acceptedAnswer": { "@type": "Answer", "text": "Up to 60 per cent of United Kingdom government information technology infrastructure is hosted on cloud platforms, the government spends at least 1.9 billion pounds a year on Microsoft software, and the Ministry of Defence uses Azure." } }, { "@type": "Question", "name": "How does Offline Secure Storage reduce this risk?", "acceptedAnswer": { "@type": "Answer", "text": "It holds selected data on dedicated hardware in a jurisdiction the customer chooses, with no network path to it until an authorised out-of-band command opens one for a defined window. There is no standing connection, no live platform identity to compel and no provider console to browse, so retained records are not reachable by an outside party." } } ] } ] ```