As reported by SecurityAffairs, a Guardian investigation has resurfaced a 2017 UK police risk assessment that explicitly warned of "US government insider" access to sensitive law enforcement data hosted on Microsoft Azure. The document, signed by then-City of London police commissioner Ian Dyson, identified 15 risks tied to migrating criminal records, victim statements, and potentially secret-classified material to Microsoft's cloud. Five independent experts confirmed those risks remain live today.
The core issue here is not a vulnerability in the traditional sense—no CVE to patch, no zero-day to chase. It is a structural trust problem inherent to the shared-responsibility cloud model, and it is one that every organization handling sensitive data in hyperscaler clouds should be scrutinizing.
Encryption Alone Does Not Equal Control
The 2017 assessment's proposed mitigations—enable Microsoft's built-in encryption, keep servers patched—reflect a common but dangerous misconception. Provider-managed encryption protects data at rest from external attackers, but the provider itself holds the keys. Microsoft engineers can access the data. And under mechanisms like the US CLOUD Act, the US government can compel Microsoft to produce data stored anywhere in the world, regardless of data residency promises.
The question was never where the data sits. It is who holds the keys and who can compel their use.
This is the distinction between encryption in transit/at rest and customer-managed key control. The former is table stakes. The latter is what actually determines sovereignty.
Who Is at Risk Beyond UK Policing
The Data Residency Fallacy
As the SecurityAffairs report notes, Microsoft's infrastructure spans over 100 countries and individual files can fragment across jurisdictions. Microsoft has introduced EU Data Boundary offerings, but researcher Dave Michels correctly identified the deeper problem: focusing on where data is stored misses the point that access is governed by the provider's legal jurisdiction, not the server's geographic location.
A UK police record stored in a London datacenter is still subject to US legal process if Microsoft—a US-headquartered entity—controls the encryption keys. Residency boundaries constrain replication, not compelled disclosure.
Shield53 Recommendations
For Government and Law Enforcement Cloud Architects
- Implement customer-managed keys (CMK) at minimum, using Azure Key Vault with keys generated and stored in HSMs under your control, not Microsoft's
- Evaluate hold-your-own-key (HYOK) or external key management for any data classified above "official"—where keys never leave your infrastructure and the provider cannot decrypt without your ongoing participation
- Conduct a data classification audit across all Azure-hosted workloads to identify what is currently protected only by platform-managed encryption
- Map legal exposure: document which data sets are theoretically subject to CLOUD Act or other extraterritorial disclosure mechanisms, and brief senior risk owners on that exposure
- Require sovereign cloud alternatives for top-secret or equivalent classifications—UK options exist, and the 2017 assessment essentially recommended this by letting chiefs decide
For CISOs in Regulated Industries
- Stop treating cloud provider encryption as sufficient for sensitive data—treat it as a baseline, not a control
- Negotiate contractual terms that require notification of any government data request, where legally permissible
- Build detection capabilities for anomalous administrative access to your cloud tenancy, including provider-side access patterns where logging is available
The UK police assessment was not alarmist—it was prescient. Nine years on, the architecture it warned about is more deeply embedded than ever. The lesson for defenders is that cloud adoption without key sovereignty is a risk acceptance, not a risk mitigation. That acceptance should be documented, reviewed, and revisited every time the threat landscape or legal framework shifts.
