Microsoft Stops Using China-Based Engineers for Pentagon Tech Support as Hegseth Orders Review

The decisions follow a letter from Sen. Tom Cotton to Hegseth, pressing the Department of Defense for information about Microsoft's use of engineers based in China to maintain military cloud computing systems.
Published: 7/18/2025, 11:27:08 PM EDT

Microsoft announced Friday it will stop using China-based engineers to provide technical assistance to the U.S. military as Defense Secretary Pete Hegseth ordered a two-week review of Pentagon cloud deals.

The decisions follow a letter from Sen. Tom Cotton (R-Ark.) to Hegseth, pressing the Department of Defense for information about Microsoft's use of engineers based in China to maintain military cloud computing systems.

Cotton, who chairs the Senate Intelligence Committee and serves on the Armed Services Committee, sent a letter to Hegseth on Thursday requesting details about U.S. military contractors using Chinese personnel.

In his letter to Hegseth, Cotton said that "the U.S. government recognizes that China's cyber capabilities pose one of the most aggressive and dangerous threats to the United States, as evidenced by infiltration of our critical infrastructure, telecommunications networks, and supply chains."

He requested a list of contractors using Chinese personnel and information about how digital escorts are trained to detect any suspicious activity. The U.S. military "must guard against all potential threats within its supply chain, including those from subcontractors," he wrote.

Cotton's inquiry comes after ProPublica published an investigation Tuesday, revealing Microsoft's decade-long practice of hiring engineers in China to help maintain Defense Department computer systems with little U.S. supervision.

Hegseth Orders Review

In a video posted on X Friday, Hegseth said he is initiating a two-week review to ensure China-based engineers were not working on any other cloud services contracts across the Defense Department.

"I'm announcing that China will no longer have any involvement whatsoever in our cloud services, effective immediately," Hegseth said in the video. "We will continue to monitor and counter all threats to our military infrastructure and online networks."

Earlier, Hegseth responded in a post on X, calling Cotton's concerns "spot on" and confirming the Defense Department was already examining the matter. "Foreign engineers—from any country, including of course China—should NEVER be allowed to maintain or access [Department of Defense] systems," Hegseth wrote.

Microsoft's Response

Microsoft spokesperson Frank Shaw said on X that the company "has made changes" to how it supports U.S. government customers "in response to concerns raised earlier this week ... to assure that no China-based engineering teams are providing technical assistance" for services used by the Pentagon.
The announcement came after ProPublica's report sparked questions from Cotton and prompted Hegseth to take immediate action.

Digital Escort System

ProPublica's investigation found that Microsoft relies on U.S. citizens with security clearances, known as "digital escorts," to oversee foreign engineers who possess far more advanced technical skills. Such escorts, often former military personnel with little coding experience, are paid barely more than minimum wage for their work.
"We're trusting that what they're doing isn't malicious, but we really can't tell," said one current escort who spoke anonymously with ProPublica, fearing repercussions.

Security Vulnerabilities

The arrangement has been in place for nearly a decade, though its existence is being reported publicly for the first time. The system was critical to Microsoft winning the federal government's cloud computing business, but experts warn it leaves sensitive data vulnerable to hacking from China, which the U.S. intelligence community considers the nation's leading cyber adversary.
Microsoft uses the escort system to handle the government's most sensitive unclassified information, categorized as "high impact level" data that includes materials directly supporting military operations. The loss of this information "could be expected to have a severe or catastrophic adverse effect" on operations, assets, and individuals, according to government standards.

Expert Concerns

National security and cybersecurity experts said they were both surprised and alarmed upon learning of the arrangement.

Harry Coker, a former senior executive at the CIA and National Security Agency who also served as national cyber director during the Biden administration, called it "an avenue for extremely valuable access" for potential operatives, according to the ProPublica report.

"If I were an operative, I would look at that as an avenue for extremely valuable access. We need to be very concerned about that," Coker said, adding that he and his former intelligence community colleagues "would love to have had access like that."

John Sherman, who served as chief information officer for the Department of Defense during the Biden administration, said he was surprised and concerned by the findings. "I probably should have known about this," he told ProPublica investigators, noting the situation warrants a "thorough review by DISA, Cyber Command and other stakeholders."

Skills Gap Problem

The investigation revealed a fundamental mismatch between the technical capabilities of U.S. escorts and the Microsoft engineers they supervise. Many escorts are former military personnel hired primarily for their security clearances rather than technical expertise.

"People are getting these jobs because they are cleared, not because they're software engineers," said an escort who works for contractor Insight Global and spoke anonymously with ProPublica.

Matthew Erickson, a former Microsoft engineer who worked on the escort system, acknowledged the limitations: "If someone ran a script called 'fix_servers.sh' but it actually did something malicious, then [escorts] would have no idea," according to the ProPublica report.

Contractor Operations

Microsoft contractor Insight Global posted a job advertisement in January seeking an escort to bring engineers without security clearances "into the secured environment" of the federal government, with pay starting at $18 an hour. The company's roughly 50-person escort team fields hundreds of interactions monthly with Microsoft's China-based engineers, with escorts inputting those workers' commands into federal networks.

Chinese Threat

Microsoft's arrangement exists amid heightened concerns about China's cyber capabilities. In 2023, Chinese hackers infiltrated cloud-based mailboxes of senior U.S. government officials, stealing approximately 60,000 emails from the State Department alone. The Office of the Director of National Intelligence has called China the "most active and persistent cyber threat to U.S. Government, private-sector, and critical infrastructure networks."
Microsoft, a major contractor to the U.S. government, has had its systems breached by Chinese and Russian hackers. It told ProPublica it disclosed its practices to the U.S. government during an authorization process.

Government Response

The Defense Information Systems Agency told ProPublica that escorts are used "in select unclassified environments" for "advanced problem diagnosis and resolution from industry subject matter experts," stating that experts under escort supervision "have no direct, hands-on access to government systems."
Reuters contributed to this report.