Microsoft says it won’t let Chinese engineering teams run its cloud services for the U.S. government anymore. That announcement came after a shocking ProPublica story revealed that the corporation had been using workers from China for years, even on projects for the Department of Defense.
At the same time, Amazon, Google, and Oracle all said they would not hire Chinese workers for any federal cloud contracts. The underlying question is: Why did Microsoft take risks while its rivals played it safe?
Everyone Knew the Risks, But Microsoft Didn’t?
For federal cloud support, Google, Amazon Web Services (AWS), and Oracle didn’t use Chinese workers. When asked explicitly, all three told ProPublica that they obey the rules set by the U.S. government: Only Americans can work on U.S. soil, and they must have full security clearance.
But what about Microsoft? It took a chance with a workaround called “digital escorts,” which were U.S.-based workers who passed on commands from engineers in China. But a lot of those escorts didn’t know enough to even understand the code they were sending.
The cloud platforms were used by the Department of Defense and the Department of Justice to store sensitive legal material, conduct internal investigations, and even keep records of law enforcement activities.
Microsoft, on the other hand, relied on a patchwork system that made it hard to show who was really responsible or in danger.
The $10 Billion Question
This is what stings: In 2022, Microsoft still got a big part of the Pentagon’s $9 billion cloud contract. It even won a massive contract over AWS and Google in 2019, even though it used a security model that others wouldn’t touch.
Why? Some people who work for Microsoft say that the company has a lot of connections in Washington and does a lot of lobbying. According to public data put together by The Daily Beast, the corporation made more than $17 billion from federal contracts between 2017 and 2021.
What about the supervision? Not very strict. Microsoft’s technologies were approved by FedRAMP, the government’s own cybersecurity framework, without mentioning that engineers in China were engaged, even indirectly.