Blog

Irish authorities have been formally asked to investigate Microsoft over alleged unlawful data processing by the Israeli Defense Forces.

The complaint has been made by the human rights group the Irish Council for Civil Liberties (ICCL) to the Data Protection Commission, which has legal responsibility in Europe for overseeing all data processing in the European Union.

It follows revelations in August by the Guardian with the Israeli-Palestinian publication +972 Magazine and the Hebrew outlet Local Call that a giant trove of Palestinians’ phone calls was being stored on Microsoft’s cloud service, Azure, as part of a mass surveillance operation by the Israeli military.

The ICCL alleges that the processing of the personal data “facilitated war crimes, crimes against humanity, and genocide by Israeli military”. Microsoft’s European headquarters are located in Ireland.

Joe O’Brien, the executive director of ICCL, said: “Microsoft’s technology has put millions of Palestinians in danger. These are not abstract data-protection failures.”

He said that the cloud services “enabled real-world violence” and it was “essential that the DPC move quickly and decisively” in view of the “threat to life posed by the issues at the heart of this complaint”.

He added: “When EU infrastructure is used to enable surveillance and targeting, the Irish Data Protection Commission must step in – and it must use its full powers to hold Microsoft to account.”

A cache of leaked documents reviewed by the Guardian revealed that Unit 8200, the Israeli military’s spy agency, had opened talks as far back as 2021 to move vast amounts of top secret intelligence material to the US company’s cloud service.

The documents showed how Microsoft’s storage facility had been used by Unit 8200 to store an expansive archive of everyday Palestinian communications, facilitating targeted airstrikes and other military operations.

In response to the revelations Microsoft ordered an urgent external inquiry to review its relationship with Unit 8200. Its initial findings led the company to cancel the unit’s access to some of its cloud storage and AI services.

ICCL claims that Microsoft facilitated critical components of Israel’s military surveillance “Al Minasseq” system.

It says the alleged “removal” of the records of intercepted phone calls from EU servers to Israel obscured evidence of illegal processing before investigations could commence within the EU and claims that unlawful processing was a breach of the EU’s general data protection regulation (GDPR) governing use of personal data.

Equipped with Azure’s near-limitless storage capacity and computing power, Unit 8200 had built an indiscriminate system allowing its intelligence officers to collect, play back and analyse the content of cellular calls of an entire population.

A spokesperson for the DPC said: “I can confirm that the DPC has received a complaint and it is currently under assessment.”

Microsoft has been approached for comment.