Start a trial

Operational notes Observatory

Microsoft and Unit 8200: when the cloud provider pulls the plug

5 min read

Aerial view of a large data centre complex among the hills
The cloud is always a physical place, inside a jurisdiction — and inside a policy.

On 25 September 2025 Microsoft did something no hyperscaler had ever done so explicitly: it switched off cloud and AI services for a unit of an allied government’s armed forces, and stated publicly why. The recipient was a unit of the Israeli Ministry of Defence — press reports identify it as Unit 8200, signals intelligence — and the reason was the use of Azure to store mass-intercepted Palestinian phone calls. The decision closes (for now) a saga that ran for months, built on investigative journalism, internal protests and two successive reviews. It is worth reconstructing precisely, because for anyone buying cloud — public or private sector — it is a textbook case.

The facts, in order

  • February 2025 — the AP investigation. The Associated Press documented that the Israeli military’s use of commercial AI from Microsoft and OpenAI had grown to roughly 200 times pre-7 October 2023 levels, and that data stored on Microsoft servers had doubled, to more than 13 petabytes. Among the uses described: transcription and translation of intercepted communications. Microsoft did not comment at that stage.
  • May 2025 — the first review. Following protests from some employees (two had been dismissed in April for disrupting the company’s fiftieth-anniversary event), Microsoft published a note: it confirmed supplying the Israeli Ministry of Defence with software, professional services, Azure and Azure AI, and stated it had found no evidence that its technologies had been used «to target or harm people» in Gaza. It did, however, admit a structural limit: it has no visibility into how its products are used inside customers’ own systems.
  • August 2025 — the Guardian/+972/Local Call investigation. The reconstruction described a Unit 8200 surveillance platform built on Azure and operational since 2022, with an ambition — according to internal sources — to archive «a million calls an hour». By July 2025 the data had reached roughly 11,500 terabytes, largely held in data centres in the Netherlands and Ireland. Microsoft launched a formal review, entrusted to the law firm Covington & Burling and to independent technical consultants. Internal protests intensified: in August a sit-in in president Brad Smith’s office in Redmond ended in arrests and dismissals.
  • 25 September 2025 — the decision. Brad Smith announced that the review had found elements confirming parts of the investigation, including Azure storage consumption in the Netherlands and the use of AI services by the Israeli Ministry of Defence. Microsoft «ceased and disabled» the specific subscriptions involved, invoking a long-standing principle: its technology must not facilitate the mass surveillance of civilians.

Two clarifications are due. First: the measure was surgical — it concerns specific services and subscriptions, not the overall relationship with Israel, which continues, including on the cybersecurity front. Second: Microsoft reiterated that it cannot access customer content, and so worked from its own commercial records; the more serious descriptions of how that data was used remain journalistic allegations, not findings established by the company. The facts confirmed by Microsoft itself, however, are enough to ground the lesson.

Lesson 1: the cloud provider is a geopolitical actor

A cloud supplier is not a power utility. It has terms of use, stated values, employees who protest, journalists who investigate — and the technical ability to switch off a service unilaterally. In this case it did so to a military apparatus; nothing, contractually, makes it unthinkable that it could happen to others, for ethical, legal or political-pressure reasons. Anyone designing critical systems on public cloud must treat this as a concrete risk: operational continuity, copies of data under one’s own control, a tested exit plan. This is at the heart of our approach to designing architectures that remain the client’s own.

Lesson 2: terms of use are a real contract — in both directions

Microsoft acted by invoking its own terms of service: they prohibit using the technology for the mass surveillance of civilians. This shows that acceptable use policies are not boilerplate: they define what the supplier can hold you to, and what you can demand of it. But the case also shows the reverse: the supplier cannot see what you do inside your tenant, and you cannot see what the supplier decides inside its own. Responsibility for lawful use remains with the buyer — with documented human oversight of processes that touch personal data, as we require on every project.

Lesson 3: sovereignty means knowing where the data is, and who can switch off what

One detail of the investigation deserves attention: Unit 8200’s data sat in European data centres, in the Netherlands and Ireland. Third-party jurisdictions found themselves caught up in an affair they had not chosen — and the military customer discovered that its own infrastructure depended on decisions made in Redmond. For anyone working in sensitive sectors, defence included, the question is not «cloud, yes or no», but: which data can sit on third-party infrastructure, in which jurisdiction, with what plan if the supplier — for its own reasons — turns off the tap.

What to do, if you buy cloud

  1. Read your provider’s terms of use: what they prohibit, what they can suspend, with what notice.
  2. Map data and regions: which information sits in which jurisdictions, and under which law.
  3. Test the continuity plan: if a subscription were disabled tomorrow, what would stop? How quickly could you restart elsewhere?
  4. Document legitimate use: internal policy and human oversight of sensitive processing, to bear the burden of proof — towards the supplier and towards the regulator.
  5. Negotiate transparency: clauses on data location, notification of suspensions, full data exportability.

Want to understand how much your operations depend on your cloud provider’s decisions? Half an hour with one of our experts for an initial assessment.

Sources