Microsoft's Chinese Engineers Access Pentagon Systems with Minimal Oversight
A shocking investigation by ProPublica has revealed that Microsoft is using engineers in China to help maintain the Defense Department's computer systems, with minimal supervision by U.S. personnel, leaving some of the nation's most sensitive data vulnerable to hacking from its leading cyber adversary.
The arrangement, which Microsoft deems critical to winning the Pentagon's cloud computing business, raises serious concerns about national security and the risk of espionage. The system relies on U.S. workers with security clearances, known as "digital escorts," to supervise the Chinese engineers and serve as a firewall against malicious activities.
However, ProPublica found that these escorts often lack the advanced technical skills needed to effectively monitor the foreign workers, who possess far greater coding expertise. Some escorts are ex-military with little software engineering experience, earning barely above minimum wage. This knowledge gap creates an opening for Chinese operatives to infiltrate U.S. networks.
The Digital Escort Program: A Workaround for Global Talent
Microsoft's digital escort program appears to be a workaround to leverage its global workforce while still bidding for Pentagon contracts. Here's how it works:
- A China-based Microsoft engineer submits a digital "ticket" to perform maintenance.
- A U.S.-based escort picks up the ticket and meets virtually with the engineer, where they relay commands for the escort to input into the federal cloud system.
- The engineer provides instructions without the escort necessarily understanding the code, creating an opportunity for malicious code to go undetected.
Microsoft states it has monitoring safeguards in place, but insiders warn that the knowledge gap between the engineers and escorts is too vast to mitigate the risks. Staffing firms like Insight Global, which supply the escorts, look for candidates with security clearances, not coding skills.
Risks and Concerns
Concerns about the security risks were raised to Microsoft multiple times over the years, even by one of its own cybersecurity leaders, but the company expanded the escort program anyway. Experts say any visibility into Pentagon networks presents a huge espionage risk, especially given the rising tensions with China and its sweeping authority to compel citizens to aid intelligence efforts.
A Call for Greater Transparency
The Defense Department mandates that only U.S. citizens, nationals or permanent residents handle its most sensitive data. The ProPublica investigation highlights the need for greater transparency and accountability in the government's use of foreign workers to maintain national security systems.