Microsoft Used China-Based Support for Multiple U.S. Agencies, Potentially Exposing Sensitive Data

Microsoft used China-based engineering teams to maintain cloud computing systems for multiple federal departments including Justice, Treasury, and Commerce, extending the practice beyond the Defense Department that the company announced last week it would discontinue. The work occurred within Microsoft's Government Community Cloud, which handles sensitive but unclassified federal information and has been used by the Justice Department's Antitrust Division for criminal and civil investigations, as well as parts of the Environmental Protection Agency and Department of Education.

Microsoft employed "digital escorts" -- U.S.-based personnel who supervised the foreign engineers -- similar to the arrangement it used for Pentagon systems. Following ProPublica's reporting, Microsoft issued a statement indicating it would take "similar steps for all our government customers who use Government Community Cloud to further ensure the security of their data." Competing cloud providers Amazon Web Services, Google, and Oracle told ProPublica they do not use China-based support for federal contracts.

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[HiThere]

They aren't the only one, but ISTM that they're currently the most aggressive intruders.

Government Efficiency

[Hotice919]

This is truly the hallmark of great efficiency. Why wait for phishing scams and other schemes when you can provide that service yourself?

Seriously, how is this not a federal crime?

[Anonymous Coward]

None of these systems should have a non-US person anywhere near them.

Re:Seriously, how is this not a federal crime?

[russotto]

And that's supposed to be the rule (with some specific exceptions for allied nationals in some cases). I've had to do work on a government cloud, and question one was "Are you a US citizen physically located in the US". I'm not sure what (or if) Microsoft was thinking.

Re:

[gweihir]

I'm not sure what (or if) Microsoft was thinking.

They were thinking "Dollars! More Dollars! Many More Dollars! And who cares about the customer!" That is what Microsoft usually thinks. Lets hope this time it comes back to haunt them.

Re:Seriously, how is this not a federal crime?

[ArchieBunker]

I know a guy guilty of 34 of them in a much more dangerous position.

Wow

[Anonymous Coward]

Maybe China could release the Epstein files?

Digital escorts

[dgatwood]

I suppose that's one way to keep the (probably mostly single male) software engineers and IT people doing what you want them to do, but I feel like digital managers would be more effective. :-D

Re:

[toxonix]

I was thinking Wallace Corp's "Joi" romantic companion model.

Re:

[gweihir]

I expect real escorts (the hooker type) would have been more effective, because they typically have a good radar for when something feels off. They would have been about as effective on the tech side, because it is essentially impossible to monitor what something competent does on a computer keyboard. I know, I have tried.

access control

[toxonix]

Microsoft employed foreign engineers and then employed "digital escorts" to keep an eye on them?
I want to see the job posting for that one:
  "Wanted: Cloud Digital Escort. As a Cloud Digital Escort, you will watch over IT workers located in China to prevent them from doing nasty things like send sensitive data to China. Great hours for night owls! Pay: Hourly/min wage/less"

Every time I have to use Excel I remember how bad MS is at building software, but how good they are at roping everyone into using it.

Such a surprise

[gweihir]

The Chinese will have anything worth knowing from these MS customers now. And they will have placed countless backdoors. "Escorts" like the ones used by MS are completely worthless. I had the opportunity to observe that in person and to run some experiments a few years back (me and my boss tried to "supervise" each other, complete failure). The customer still decided to go with this flawed idea. And a few months later a developer placed a backdoor and they only noticed a few weeks later on a traffic analysi

Pretty simple

[Ol Olsoc]

Threw needs to be a DoD level investigation, and if classified data has been compromised, there needs to be arrests and trials, and if convicted, jail time. And in that event, Microsoft must be blocked from ever having access to sensitive data again. Microsoft might just be sitting on the biggest classified information handover since forever.