19 September 2026

When a public service puts information into a commercial computer system, it also makes decisions about power. Who can see the information? Who can investigate a problem? Who can demand a change?

Those questions may appear technical, but their consequences are public. People should be able to understand how the organisations they rely on retain control over important services and records.

Why this is in the news

The Guardian reports concerns about UK police cloud data. Microsoft disputes unrestricted government access.

There is an official record of the wider technology programme. In a parliamentary answer dated 6 November 2024, the Home Office described the rollout of Microsoft 365 and identity and access management to 40 police forces, followed by completion for remaining forces. Read the parliamentary answer.

That answer provides historical context. It does not establish whether a particular system is secure today. The current story concerns scrutiny of existing arrangements, rather than an announcement that a new law has taken effect.

What does “the cloud” mean?

The cloud is a familiar name for computing services accessed through a network. The underlying computers still exist somewhere. Organisations use them to store information or run software without managing every part of the equipment themselves.

The important questions concern the arrangement behind the service. Which people and systems can access it? What permissions do they have? What records are kept? How can a customer examine what has happened?

The National Cyber Security Centre’s cloud security principles cover issues including governance, access controls, supply chains and audit information. The guidance encourages assessment of the service and the evidence supporting assurances. It does not certify every use of a particular provider.

For a public reader, the main point is straightforward: knowing who supplies the software is only the beginning of understanding who can exercise control.

A simple example: responsibility without the means to act

Imagine a hypothetical council using an outside company to run a records service. The council is told it remains responsible for the information.

A resident then asks about a possible error. The council’s staff need to find out who changed the record, when it changed and what happened afterwards. Suppose the relevant information is held by the supplier and is not readily available to them.

The council may have a clear responsibility on paper while lacking the means to fulfil it promptly. The resident experiences the resulting delay, even if each organisation believes it has followed its procedure.

This is an illustration, not an allegation about any council, police force or supplier. It shows why responsibility needs usable information, working relationships and the authority to get a response.

The AE question: can public authority be exercised?

Autopoietic ecology, or AE, examines how people and organisations become able to act, and what sustains that ability.

For a public body, this means asking how decisions become effective. A promise to protect information has to be carried into permissions, working practices, supplier arrangements and responses when something goes wrong.

Consider what may happen when a concern moves from a member of the public to a support desk, then to a technical team and a contract manager. Each handover can help resolve it. Each can also change how the problem is described or who is expected to deal with it.

An AE inquiry follows the concern through those steps. Does anyone have enough information and authority to act? Does the result change the arrangement that caused the difficulty? Or is the same problem likely to return?

Why this is a political issue

Public bodies make choices on other people’s behalf. Those affected cannot always choose another provider in the way that someone might switch a personal email service.

That makes scrutiny particularly important. Decision-makers need to explain why an arrangement was selected, how its risks are assessed and what can be done if it becomes unsuitable.

There is also a difference between having a voice and influencing a decision. A consultation, complaint or committee discussion can record concerns without changing the next contract or technical decision. The useful question is what route exists from a concern to a reasoned response.

AE directs attention to that route. It does not tell us in advance which supplier to use. It helps ask whether public authority is supported by the means to make, review and revise decisions.

Changing providers is not a complete answer

A familiar provider may offer valuable skills and services. An alternative may offer other advantages. Either option needs examination.

Imagine an organisation planning a move to another system. It would need to understand the cost of moving records, the staff time required, how work would continue during the transition and whether the replacement could actually meet its needs.

These questions matter before a crisis. If leaving is only possible in theory, the organisation may have fewer choices than its contract appears to offer.

The relevant comparison should therefore include practical alternatives and the resources needed to use them. A provider’s nationality, size or reputation cannot settle every question about a specific arrangement.

What would a useful public response look like?

A good response would distinguish evidence of a risk from evidence that harm has occurred. It would explain what has been assessed, what remains uncertain and who is responsible for the next decision.

It would also make the practical controls understandable: who can inspect access, who can investigate an incident, who can require a correction and how an essential service would continue during a change.

Some details may need protection for legitimate security reasons. That still leaves room to explain the basis of assurance and the arrangements for independent scrutiny.

The question to keep asking is simple: when a public service says it is in control, what can it actually do when something needs to change?

Subscribe free to receive published EdgeLab posts by email.