A ProPublica investigation by reporter Renee Dudley, with research by Doris Burke, has uncovered a little-known Microsoft program that may be exposing sensitive U.S. military data to Chinese hackers. According to the report, Microsoft has for years used engineers based in China to help maintain Defense Department computer systems, relying on a workaround known as “digital escorting.” The system is so obscure that even top Pentagon officials and cybersecurity experts were unaware it existed, and many now say it could pose a major national security risk.
How Digital Escorting Works
To comply with federal rules requiring only U.S. citizens or permanent residents to access sensitive military networks, Microsoft created a workaround. Instead of giving foreign engineers direct access to government systems, Microsoft uses U.S.-based contractors—called digital escorts—to oversee the work.
Here’s how it works: when a Microsoft engineer in China identifies a support issue, they submit a ticket and connect with a U.S. escort through Microsoft Teams. The Chinese engineer then sends specific computer commands, and the American escort, who may have little or no technical expertise, manually inputs those commands into the Defense Department’s system.
“We’re trusting that what they’re doing isn’t malicious,” said one current escort, “but we really can’t tell.”
A Skills Gap with High Stakes
The idea behind the escort system is to act as a security buffer. But according to the ProPublica investigation, many of the escorts lack the technical background to understand or verify what they are entering. One job listing from Microsoft contractor Insight Global offered the position at just $18 an hour, and described technical skills as “nice to have.”
“People are getting these jobs because they are cleared, not because they’re software engineers,” one escort said.
Matthew Erickson, a former Microsoft engineer who helped develop the escort program, admitted that escorts could be easily fooled. “If someone ran a script called ‘fix_servers.sh’ but it actually did something malicious then [escorts] would have no idea,” he told ProPublica. Even so, he defended the system, saying the “scope of systems they could disrupt is limited.”
Others strongly disagree. “Here you have one person you really don’t trust because they’re probably in the Chinese intelligence service, and the other person is not really capable,” said David Mihelcic, former chief technology officer at the Defense Information Systems Agency (DISA).
Why It Matters Now
The data involved in this work is not technically classified, but it is still extremely sensitive. The Defense Department categorizes it as “Impact Level 4 and 5,” which covers information that supports military operations and that, if compromised, could cause “severe or catastrophic” harm to U.S. assets or personnel.
John Sherman, who served as the Defense Department’s chief information officer during the Biden administration, said he was “surprised and concerned” to learn about the escort program. “I probably should have known about this,” he said, calling for a “thorough review” by DISA, Cyber Command, and other relevant agencies.
The Office of the Director of National Intelligence has repeatedly called China “the most active and persistent cyber threat” to U.S. networks. In 2023, Chinese hackers infiltrated Microsoft’s cloud systems and accessed emails from senior U.S. officials, including the commerce secretary and the U.S. ambassador to China. They stole some 60,000 State Department emails alone.
In light of this, experts now say the escort program is a potential open door for future cyberattacks. “If I were an operative, I would look at that as an avenue for extremely valuable access,” said Harry Coker, a former CIA and NSA official who later served as national cyber director. “We need to be very concerned about that.”
Did the Government Know?
Microsoft claims it disclosed the escort system to federal officials during the authorization process. But ProPublica found that multiple former government officials, including those who directly oversaw cybersecurity programs, had never heard of it.
Even DISA’s public spokesperson, Deven King, admitted, “Literally no one seems to know anything about this, so I don’t know where to go from here.”
A statement from DISA later confirmed that escorted access was allowed “in select unclassified environments” and claimed that foreign experts under escort supervision “have no direct, hands-on access to government systems.” But critics say the distinction is largely meaningless if escorts are simply acting as a human extension of the foreign engineer’s keyboard.
A Cost-Driven Workaround
The escort system was born from Microsoft’s desire to win government cloud contracts without building an entirely U.S.-based workforce. According to ProPublica, a Microsoft program manager named Indy Crowley pitched the idea as a way to balance cost and compliance.
Crowley reportedly told defense officials that hiring only U.S. engineers would be too expensive and that the escort model would allow Microsoft to meet security rules without dramatically increasing labor costs. He called it “the path of least resistance.”
Some within Microsoft disagreed. One former employee involved in cybersecurity strategy said they opposed the idea from the start. “People who got in the way of scaling up did not stay,” they told ProPublica.
Microsoft and its contractors say that escorts receive training and are not blindly following orders. In a statement, Microsoft said escorts are provided with “training on protecting sensitive data, preventing harm, and use of the specific commands/controls within the environment.” The company also claims to use internal safeguards like audit logs and automated code reviews to detect unusual activity.
But current and former employees say these protections are inadequate. One escort said they had raised concerns repeatedly with Microsoft and Insight Global, but nothing was done. “Will that get caught? Absolutely,” they said. “Will that get caught before damage is done? No idea.”
Another former Insight Global worker, Tom Schiller, even contacted the Defense Department inspector general and wrote to members of Congress to warn them about the program. Though the inspector general interviewed him, the case was eventually closed, with officials saying the issue was better handled by “management.”
It is still unclear how widespread awareness of the escort program is within the federal government. The Cyber Safety Review Board, which examined the 2023 email hack, did not mention the escort system in its report. Neither did Microsoft executives during Senate testimony earlier this year. Microsoft President Brad Smith said only that the company was “pushing Chinese out of agencies,” without explaining how they got in.
As U.S.-China tensions continue to rise, and cybersecurity threats grow more aggressive, critics say the escort model is no longer acceptable. “This kind of indirect access, through someone else’s fingers, is still access,” said one security expert.
For now, Microsoft has made no public plans to change the system. And with a growing backlog of support tickets, dozens of China-based engineers continue to work, one command at a time, behind the digital curtain.
ACZ Editor: This might have been OK 20 years ago, but in the current environment, this is almost criminal incompetence.