What flows out¶
The honest answer is: we do not know exactly. The concerning answer is: probably everything.
The tools provided to the cloud provider are, by design, comprehensive. Detection tools do not detect by watching selectively. They detect by establishing a baseline of normal behaviour and identifying departures from it. This means that before any anomaly can be flagged, the system must first have catalogued what is not anomalous.
The catalogue is the product. The anomalies are the justification.
What we cannot yet establish¶
Whether the data is transmitted in aggregate or in detail. Whether it is retained by the recipient, and for how long. Whether it is shared further. Whether clients in more sensitive sectors are treated differently from others, and if so, on whose instruction.
These are not rhetorical questions. The MCLU has submitted formal enquiries. We note that no response has been received, which is itself a data point, though not one we can file in evidence.