Microsoft’s Use Of China-Based Engineers Could Be Leaving Pentagon Tech Exposed To Hackers
Microsoft has relied on engineers based in China for years to help maintain some of the U.S. Department of Defense’s (DOD) most sensitive cloud computing systems, potentially leaving them vulnerable to hacking…
Microsoft has relied on engineers based in China for years to help maintain some of the U.S. Department of Defense’s (DOD) most sensitive cloud computing systems, potentially leaving them vulnerable to hacking, according to a new investigation from ProPublica released Tuesday.
Because U.S. law prohibits foreign nationals from directly accessing federal systems that handle sensitive data, Microsoft has been funneling work through American “digital escorts” — low-paid workers with security clearances but often possessing limited technical expertise — who input commands from more skilled China-based engineers into federal networks, according to ProPublica. The arrangement, largely unknown even within the federal government, is raising alarms among national security and cybersecurity experts as the engineers could gain access to sensitive government data with little oversight, potentially exposing critical systems to Chinese cyber espionage.
The system has reportedly been in place for over a decade, ProPublica reported. China remains America’s top cyber security adversary, posing both a threat to government and private sector entities, according to a February 2024 report from the Office of the Director of National Intelligence.
This arrangement is used to handle “high impact level” information, which includes “data that involves the protection of life and financial ruin,” where “loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals,” according to U.S. government policy reviewed by ProPublica. The escorts effectively act as middlemen, copying and pasting commands from foreign workers into Pentagon-linked systems, in some cases without fully understanding the functions of those commands.
“We’re trusting that what they’re doing isn’t malicious, but we really can’t tell,” one escort, who works for Microsoft contractor Insight Global and spoke on condition of anonymity, told ProPublica. “They’re telling nontechnical people very technical directions,” the current Insight Global escort said, adding that the foreign engineer could install an update allowing an outsider to access the network.