Back to news
Facebook Twitter WhatsApp Email
13.11.26

As Microsoft outage disrupts services, new investigation finds 84/100 of the UK’s most essential organisations run on US tech leaving Britain exposed to major security risk

13th November 2026, London -  The vast majority of the organisations the British public relies on every day depend on US technology companies to operate, according to new research published today by campaign group People vs Big Tech, as a global Microsoft outage disrupts tens of thousands of people around the world. 

The investigation checked 100 of the UK’s best-known organisations across the sectors the government designates as critical national infrastructure, i.e. energy, water, food, health, finance, transport, communications and government services. For each one, researchers used simple, publicly verifiable checks on the organisation’s email domain to establish which company operates its email, and by extension, whose technology the organisation is likely built on.

42 of the 100 organisations checked run their email directly on Microsoft 365, including NHS England, Scotland and Wales, the Metropolitan Police, HMRC, Royal Mail, Thames Water, BT and British Airways. 

84 of the 100 organisations checked depend on US technology to send and receive email. Just 5 organisations in our list appear to rely on non-US tech. For the remaining 11, we could not verify what lies behind a non-US security gateway, so we’ve classified them as “unknown”.

This means that almost 95% of the organisations for which we were able to determine the company they use to provide email depend on US technology.

The UK Government currently has no public strategy to address this reliance on US technology.

Today’s outage appears to have been an accident, but the findings come as President Trump has repeatedly shown a willingness to use America’s economic and technological power against the interests of its closest allies. This includes imposing a 10% baseline tariff on nearly all UK goods in 2025, and sanctions that saw the International Criminal Court’s chief prosecutor lose access to his Microsoft email and bank accounts, even in his home country of the UK. Microsoft denied suspending his account. Reuters has also reported that US officials raised the prospect of cutting Ukraine’s access to Starlink satellite internet unless Kyiv agreed to a minerals deal with Washington (a claim Elon Musk has denied).

Among the report’s findings:

•        Every water company checked relies on US technology, as does the entire electricity transmission network in England and Wales. Thames Water, Anglian Water, Yorkshire Water and Welsh Water run on Microsoft, while Severn Trent, United Utilities and National Grid route their email through US security company Proofpoint.

•        NHS England, NHS Scotland and NHS Wales all run their email on Microsoft, as do Superdrug, Lloyds Pharmacy, Bupa and Nuffield Health. Boots uses Cisco, and GSK and AstraZeneca use Proofpoint, both US companies. Only Northern Ireland’s NHS hosts its email on an independent UK server.

•        The Metropolitan Police, Police Scotland, Greater Manchester Police, West Midlands Police, British Transport Police and the National Crime Agency all run on Microsoft. Of the forces checked, only the Police Service of Northern Ireland does not.

•        HMRC, the Ministry of Justice, the Electoral Commission and the parliaments of Scotland, Wales and Northern Ireland all run on Microsoft; Downing Street and the Cabinet Office run on Google, the Department for Work and Pensions uses Cisco, and the Home Office’s mail servers are self-hosted but run on Amazon’s cloud.

•        British Airways, easyJet, Virgin Atlantic and Heathrow all run their email on Microsoft, and Jet2 routes its email through Proofpoint, meaning every airline checked relies on US technology.

•        Just a small handful of public bodies - including the DVLA, Northern Ireland’s health and police services, and the Scottish Prison Service - have email that is self-hosted or run by UK-based providers.

Despite the scale of US reliance, the UK does not currently have a public digital sovereignty strategy in place to address this risk. In January, 45 MPs signed a motion calling for one; in March, the chair of the Science, Innovation and Technology Committee said the government had failed to set out “a coherent strategy.” In July, the Burnham government dissolved the responsible department - the Department for Science, Innovation and Technology (DSIT) - altogether, splitting its responsibilities three ways. A parliamentary briefing published a month later found there is still “no official UK Government position on what digital sovereignty is”, and noted that stakeholders continue to call for a strategy.

Ava Lee, Executive Director of People vs Big Tech, said:

“Today’s Microsoft outage shows just how vulnerable the UK is because of its over-reliance on a handful of US tech companies. Our new research shows that if the US decided to, it could drive the UK to a halt within a matter of hours. It is extraordinary that the British public are being left so exposed to the whims of a President who has already shown he is willing to use access to technology as a political weapon against his allies. This isn’t just a hypothetical risk. The Burnham government needs to treat digital dependence on US companies as the critical national infrastructure threat it clearly is, and act before Washington decides to test it.”

People vs Big Tech is calling on the Cabinet Office’s National Security Secretariat (which already coordinates the UK’s preparedness for national security threats) to take ownership of the UK’s digital dependence on US technology, treat it with the same urgency as any other critical national infrastructure risk, and inform the public of its strategy for addressing it.

Notes to editors:

The findings are available at https://peoplevsbig.tech/uk-daily-life-relies-heavily-on-us-tech-leaving-it-extremely-vulnerable-to-political-pressure-from-washington/ 

Methodology:

Researchers compiled a list of 100 household-name organisations across the UK, selected using the UK government’s own official list of critical national infrastructure sectors.

For each organisation, researchers looked up the MX (mail exchange) records of its email domain in August 2026 (public DNS entries that reveal which company’s servers receive an organisation’s email) using DNS Checker and MX Toolbox. Providers were classified by their country of headquarters: Microsoft, Google, Cisco, Broadcom/Symantec, Trellix/FireEye and Forcepoint as US and organisations whose email routes through their own servers as “self-hosted”. The security gateway company Proofpoint was classified as US due to its US headquarters, but Mimecast and Trend Micro (which are both security gateways and non-US companies) were classified as “unknown”.

Because the 11 “unknown” organisations route through non-US security gateways that could, in principle, sit in front of US mail servers, researchers were unable to independently verify what lies behind those gateways to a publishable standard, meaning the 84/100 figure is most likely a floor, not a ceiling.

This investigation assessed only which company operates each organisation’s email. It does not assess, and makes no finding about, any organisation’s contingency planning, backup systems or disaster recovery arrangements (which will vary by organisation, and which we did not investigate for this report).

Contact:

Ava Lee, Executive Director, [email protected], +44 7500 876452

Nienke Palstra, [email protected], +44 7835 003433

Rosie Sharpe, [email protected], +45 28558308

This website does not use tracking cookies. We will update you if this changes. Read our privacy policy

Got it!