Dive Brief:
- Senate Intelligence Committee Chairman Tom Cotton, R-Ark., wants the Defense Department to investigate its contractors’ reliance on Chinese workers following a report about Microsoft’s use of engineers in China to perform sensitive tasks.
- “DoD must guard against all potential threats within its supply chain, including those from subcontractors,” Cotton wrote in a Wednesday letter to Secretary of Defense Pete Hegseth.
- Cotton’s inquiry reflects deep unease within Congress about the security of military computer systems, given Microsoft’s unusual arrangement with its Chinese engineers.
Dive Insight:
Cotton’s letter came in response to a July 15 ProPublica story that exposed how Microsoft has been using Chinese employees to “escort” its American workers through the process of making changes to the Pentagon’s computer systems. “We’re trusting that what they’re doing isn’t malicious, but we really can’t tell,” one “digital escort” told ProPublica, which described the arrangement as “critical to Microsoft winning the federal government’s cloud computing business a decade ago.”
Cotton asked Hegseth for a list of all military contractors that “hire Chinese personnel to provide maintenance or other services on DoD systems,” as well as a list of subcontractors that hire digital escorts for Microsoft and other contractors. He also requested information about the hiring and training protocols for those escorts.
“While this arrangement technically meets the requirement that U.S. citizens handle sensitive data,” Cotton wrote, “digital escorts often do not have the technical training or expertise needed to catch malicious code or suspicious behavior.”
The congressional oversight suggests that Microsoft and other high-profile government contractors with large Chinese businesses are likely to face intense scrutiny over their supply-chain security practices.
Microsoft in particular has been in the U.S. government’s crosshairs for years because of how its lax security practices have enabled massive cyberattacks on federal systems. One of those attack campaigns, which targeted Microsoft Exchange servers through a zero-day vulnerability, began with activity by Chinese government-linked hackers, according to federal prosecutors.
Microsoft did not immediately respond to a request for comment about Cotton’s letter.
