Microsoft ends use of China-based engineers to support Pentagon’s cloud services

Microsoft is putting an end to the use of China-based engineers to support its cloud services for the Defense Department after an investigation found that the company was using Chinese personnel monitored by U.S.-based “digital escorts” to help maintain sensitive military systems. The digital escorts are U.S. citizens with security clearances who act as intermediaries between China-based Microsoft engineers and the Pentagon’s cloud infrastructure. The IT servicing model could open some of the most sensitive U.S. national security and military secrets to China.

Microsoft, a key contractor for the US government, has previously experienced high-profile breaches by Chinese and Russian hackers. It told ProPublica, the investigative outlet that published the investigation report, that it had disclosed its arrangements with China-based personnel during the government’s authorization process.

Microsoft spokesperson Frank Shaw said on the social media platform X that the company had modified its procedures “in response to concerns raised earlier this week … to assure that no China-based engineering teams are providing technical assistance” for services supporting the Pentagon.

The review was announced after a senator raised the alarm earlier on Friday. Senator Tom Cotton, a Republican from Arkansas and chair of the Senate intelligence committee, sent a letter to Defence Secretary Pete Hegseth demanding clarification on Microsoft’s reported practices. Cotton, who also serves on the armed services committee, requested a list of contractors using Chinese personnel and more detail on how digital escorts are trained to identify suspicious activities.

“The US government recognises that China’s cyber capabilities pose one of the most aggressive and dangerous threats to the United States, as evidenced by infiltration of our critical infrastructure, telecommunications networks, and supply chains,” Cotton wrote. He added that the military “must guard against all potential threats within its supply chain, including those from subcontractors”.