Microsoft Used China-Based Support for Multiple U.S. Agencies, Potentially Exposing Sensitive Data

Microsoft says it will no longer use China-based engineers to support the Pentagon. But ProPublica found that the tech giant has relied on its global workforce for years to support other federal clients, including the Justice Department.

Last week, Microsoft announced that it would no longer use China-based engineering teams to support the Defense Department’s cloud computing systems, following ProPublica’s investigation of the practice, which cybersecurity experts said could expose the government to hacking and espionage.

This article was written by Renee Dudley, with research by Doris Burke and originally published by ProPublica.

But it turns out the Pentagon was not the only part of the government facing such a threat. For years, Microsoft has also used its global workforce, including China-based personnel, to maintain the cloud systems of other federal departments, including parts of Justice, Treasury and Commerce, ProPublica has found.

This work has taken place in what’s known as the Government Community Cloud, which is intended for information that is not classified but is nonetheless sensitive. The Federal Risk and Authorization Management Program, the U.S. government’s cloud accreditation organization, has approved GCC to handle “moderate” impact information “where the loss of confidentiality, integrity, and availability would result in serious adverse effect on an agency’s operations, assets, or individuals.”

The Justice Department’s Antitrust Division has used GCC to support its criminal and civil investigation and litigation functions, according to a 2022 report. Parts of the Environmental Protection Agency and the Department of Education have also used GCC.

Microsoft says its foreign engineers working in GCC have been overseen by U.S.-based personnel known as “digital escorts,” similar to the system it had in place at the Defense Department.

Nevertheless, cybersecurity experts told ProPublica that foreign support for GCC presents an opportunity for spying and sabotage. “There’s a misconception that, if government data isn’t classified, no harm can come of its distribution,” said Rex Booth, a former federal cybersecurity official who now is chief information security officer of the tech company SailPoint.

“With so much data stored in cloud services — and the power of AI to analyze it quickly — even unclassified data can reveal insights that could harm U.S. interests,” he said.

Harry Coker, who was a senior executive at the CIA and the National Security Agency, said foreign intelligence agencies could leverage information gleaned from GCC systems to “swim upstream” to more sensitive or even classified ones. “It is an opportunity that I can’t imagine an intelligence service not pursuing,” he said.

The Office of the Director of National Intelligence has deemed China the “most active and persistent cyber threat to U.S. Government, private-sector, and critical infrastructure networks.” Laws there grant the country’s officials broad authority to collect data, and experts say it is difficult for any Chinese citizen or company to meaningfully resist a direct request from security forces or law enforcement.

Microsoft declined interview requests for this story. In response to questions, the tech giant issued a statement that suggested it would be discontinuing its use of China-based support for GCC, as it recently did for the Defense Department’s cloud systems.

“Microsoft took steps last week to enhance the security of our DoD Government cloud offerings. Going forward, we are taking similar steps for all our government customers who use Government Community Cloud to further ensure the security of their data,” the statement said. A spokesperson declined to elaborate on what those steps are.