Microsoft's use of Chinese engineers on DOD systems leaves sensitive info vulnerable

Microsoft has used engineers in China for the maintenance of US Defense Department computer systems with little oversight from US officials, which may leave some of America's most sensitive information vulnerable to Chinese hackers, according to an investigation done by ProPublica.

According to the outlet, with Microsoft's arrangement that was established over 10 years ago, the set-up has relied on "digital escorts" who have citizenship in the US and have security clearance to oversee the work of Chinese software engineers in an effort to prevent espionage and hacking. However, ProPublica has found that the "digital escorts" lack the skills necessary to police the foreign actors.

“We’re trusting that what they’re doing isn’t malicious, but we really can’t tell,” one of the current escorts told reporters. The "digital escorts" make just over minimum wage for their work. The program has never been made public previously.

Although Microsoft said it has disclosed the details of the program with US officials, government workers have never heard of "digital escorts" being used. The program is so low-profile that the DOD's IT department did not have an easy time finding someone who could speak to the details of the arrangement.

"Literally no one seems to know anything about this, so I don’t know where to go from here,” Deven King, a spokesman for the Defense Information Systems Agency said.

A former executive at the CIA Harry Coker said, “If I were an operative, I would look at that as an avenue for extremely valuable access. We need to be very concerned about that." The former official also wondered if the vulnerability "could be part of an explanation for a lot of the challenges we have faced over the years.”

A chief information officer for the DOD during the Biden administration was concerned about the report from ProPublica: “I probably should have known about this," he said, adding that the situation needs a “thorough review by DISA, Cyber Command and other stakeholders that are involved in this."

Microsoft did not have executives in the company take questions from the outlet but said that the Chinese personnel work in a manner “consistent with US Government requirements and processes.”

One ad that had been posted for an escort position reviewed by ProPublica said that application stated technical skills were “highly preferred” and “nice to have," but that security clearance was the main requirement. Pay started at $18 an hour to monitor the foreign actors.

"People are getting these jobs because they are cleared, not because they’re software engineers,” one escort said.