DOD Chinese Hands On Deck

Pentagon Launches Audit of Microsoft’s DoD Cloud Services Over Use of China-Based Engineers

In a move to safeguard national security, U.S. Defense Secretary Pete Hegseth has announced a comprehensive investigation into Microsoft’s cloud services supporting the Department of Defense (DoD), focusing on the company’s past use of China-based engineers. The audit, initiated in August 2025, aims to ensure the integrity of sensitive military systems and address potential cybersecurity risks.

What Sparked the Investigation?

In July 2025, a ProPublica investigation revealed that Microsoft had employed engineers based in China to maintain cloud systems used by the DoD, including those handling data up to Impact Level 5 (just below top secret). These engineers, supervised by U.S. personnel with security clearances known as “digital escorts,” were part of Microsoft’s support for contracts like the $9 billion Joint Warfighting Cloud Capability. Concerns arose due to China’s laws requiring companies to cooperate with government data requests, raising fears of potential espionage or vulnerabilities like hidden malware. The report also noted that some U.S. escorts lacked the technical expertise to fully oversee the engineers’ work, amplifying risks.

Pentagon’s Response

Upon learning of the practice, Secretary Hegseth ordered an immediate two-week review in July 2025 to confirm that no China-based engineers remained involved in DoD systems. Microsoft promptly ended the practice, and by August 27, 2025, Hegseth escalated the response with two key actions:

1. Third-Party Audit: Microsoft will fund an independent audit of its “digital escort” program, examining all code and submissions by China-based engineers to identify any potential security gaps.
2. DoD Investigation: Pentagon experts are conducting a separate probe to assess whether malicious code or backdoors were introduced into DoD systems.

Hegseth also issued a directive requiring all DoD software vendors to eliminate Chinese involvement in their systems, emphasizing the need for secure, domestically controlled technology. He described the prior arrangement as “unacceptable” and stressed that the audits would be conducted at no cost to taxpayers. Read the DoD’s official statement.

Microsoft’s Stance

Microsoft has cooperated fully, confirming it no longer uses China-based engineers for DoD cloud support. The company stated that its practices were disclosed to the U.S. government during contract authorization and reaffirmed its commitment to delivering secure services. No evidence of breaches has been publicly confirmed, but the audits aim to ensure no risks were overlooked. See Microsoft’s response.

Why It Matters

The use of foreign engineers in critical U.S. military infrastructure highlights broader concerns about supply chain security and oversight of contractor practices. With past cyberattacks on Microsoft systems by Chinese and Russian hackers, the DoD is taking no chances. The investigations will determine whether vulnerabilities exist and set a precedent for stricter vendor requirements.

What’s Next?

The third-party audit and DoD investigation are ongoing, with no set completion date. Their findings will shape future policies on contractor security and could lead to reforms in how the Pentagon manages its cloud services. For now, the focus remains on ensuring that America’s military systems are “ironclad” against potential threats.

This issue underscores the delicate balance between leveraging global tech talent and protecting national security. As the audits progress, they may reveal whether the concerns were precautionary or indicative of deeper systemic issues.

For updates or more details, stay tuned to official DoD announcements or trusted tech news sources.