The UK’s intelligence services are to store their secret files in the AWS cloud in a deal inked earlier this year, according to reports.
The GCHQ organisation (electrical/radio communications eavesdropping), MI5 (domestic UK intelligence matters), MI6 (external UK intel) and also the Ministry of Defence (MoD) will access their data in the cloud, albeit in UK-located AWS data centres.
The news was first reported in the Financial Times newspaper (paywall), which said GCHQ drove the deal that was signed earlier this year, and the data will be stored in a high-security way. It is claimed by unknown sources that AWS itself will not have access to the data.
Apparently the three agencies plus the MoD will be able to access information faster and share it more quickly when needed. This is presumably in contrast to each agency storing its own information on its own on-premises computer systems. The source information could be uploaded to AWS from both domestic UK and foreign locations, with access from anywhere in the world to authorised staff.
One might conceive of a searchable spies’ data warehouse that could enable searches across the three agencies’ files in a single process. However the individual agency’s data would clearly need indexing and migrating to AWS in some organised and planned way to make this possible.
Another concern raised by some is the spectre of GCHQ using AWS’s AI-based tools, such as translation and speech recognition technology, to bear on vast data sources it holds.
Apparently, according to a quoted Ciaran Martin, an ex-GCHQ branch head, the agencies will be able “to get information from huge amounts of data in minutes, rather than in weeks and months.” This doesn’t say a lot about their existing computer systems.
Since AWS is elastic in capacity terms it could hold greater amounts of data than the existing agencies store. Martin didn’t think storing even more information was an aim of the system: “The obvious business case is to use existing large amounts of data more effectively.”
Of course, for the US, AWS is a domestic firm. The French government is setting up its own sovereign public cloud called Bleu for sensitive government data. This “Cloud de Confiance” will be based on Microsoft’s Azure platform – and will include Microsoft 365 – but will apparently be “delivered via an independent environment” that has “immunity from all extraterritorial legislation and economic independence” from within an “isolated infrastructure that uses data centres located in France”
In GCHQ’s reported view, no UK-based public cloud could provide the scale or capabilities needed for the security services data storage requirements.
The UK government already spends plenty of cash with AWS, and last year the UK’s Home Office signed a four-year hosting contract worth up to £120m with the US cloud biz. TechMarketView pegged AWS as the fastest-rising services and software player in the UK public sector in 2018 and since then it has also bagged a three-year cloud MoU with Crown Commercial Services.
Neither AWS nor the UK agencies involved have commented on the story. ®