UK Police Cloud Risk Assessment Flagged Foreign Access in 2017

En bref

• A 2017 assessment examined risks from housing UK police data in Microsoft’s cloud, including Azure.
• It warned that foreign access could expose law enforcement information.
• The sign-off involved Ian Dyson, an official responsible for information risk and linked to the City of London’s police organization.
• Guardian reporting and an investigation later brought the document to public attention.
• The concerns covered police data on a national scale.

Documents and reporting from 2017 show that an assessment of UK law enforcement’s move to Microsoft-hosted services sounded an early warning. The review considered Azure and the wider Microsoft Cloud, and it identified a possible danger: systems and information could become reachable from outside the country. That mattered because the material involved was police data, not ordinary commercial records.

An investigation later surfaced the signed-off paperwork. Ian Dyson, described as a senior figure responsible for information risk and linked to the City of London’s police organization, was associated with the approval. The Guardian also played a role in bringing the issue into public view. The facts do not indicate a confirmed breach, but they do show that the risk was recognized and the document proceeded anyway.

The scope was not limited to one local force in practical terms. The assessment touched on UK police data on a nationwide basis, so any weakness could affect multiple agencies and the public’s confidence in how law enforcement handles sensitive information. In 2017, cloud adoption was accelerating across government, and data-location and foreign-access questions were becoming central to procurement and oversight.

For K-12 and government sector readers in New Brunswick, the episode is a reminder that cloud contracts are risk decisions, not just IT purchases. Reviewing data residency, access controls, and vendor transparency is essential before sensitive records go into Azure or any Microsoft Cloud tenancy. Watch for updated guidance on law enforcement cloud use, any follow-up audits, and whether similar assessments are published or remain shielded from scrutiny.

À faire maintenant

1. Build a current inventory of sensitive law-enforcement or education records stored in Azure or any Microsoft Cloud tenant, then label each dataset by sensitivity and residency requirements.
2. Re-read cloud contracts for data-location, government access, and third-country disclosure terms; demand written assurances where foreign reach is possible.
3. Turn on MFA, conditional access, just-in-time privileges, and full audit logging for every cloud subscription that holds protected information.
4. Where sovereignty risk is high, evaluate customer-managed keys, regional storage limits, or sovereign-cloud options, and document residual risk.
5. Confirm that the accountable information-risk executive, not only technical staff, approves any cloud risk acceptance before deployment.
6. Set up alerts for anomalous cross-border access or admin changes, with a clear escalation path to security and privacy leads.
7. Brief senior leadership and publish a dated remediation plan; track closure of each action in governance meetings.

Source originale

Security Affairs