​The Digital Escort Fraud: Another Major Pentagon Security Failure

Of course it was not only the design information and other details that enabled China to be successful: China also conducts industrial espionage in depth , so its agents can penetrate US contractors and subcontractors and infiltrate their supplier networks.

The US classifies some sensitive information, but actually quite a lot less than one might think. This enables contractors to work without the burden of cleared workers. We have seen numerous cases of people caught working in critical companies smuggling components needed by China either for further exploitation or use.

In regard to cloud security in 2018 I said:

We understood, in 2018, that the cloud security problem was supposedly solved by using only security-cleared American employees. It seems that the pledge was violated by the Defense Department, which permitted foreign workers to support and service the DoD cloud so long as they were“supervised.” The supervisors are called“digital escorts.” The workers, so far at least in Microsoft's case, turn out to be Chinese.

Chinese engineers work remotely in China, and it is probably a fair assumption that digital escorts allegedly monitor the work of the Chinese engineers, also remotely. In other words, the so-called escorts are virtual, they don't sit next to the Chinese operators.

We do not know anything really about the qualifications of the digital escorts, or even if they understand the Cloud network they are supposedly protecting. They would have to understand the actual cloud software and the underlying processors, and they would need to follow guidelines on what might constitute any sort of breach of the protocols or data by the Chinese.

Any clever operator in China could figure out how to insert malware into the cloud, but actually since they have full time access to it anyway there is no overpowering reason for them to do so. Instead they can just suck up all the data and run it through their supercomputers, or even their latest quantum computers. China leads the world in quantum computers, and if they really do work, they can smash encryption codes in seconds.

DoD information in the cloud is supposed to be encrypted, or at least we are told that. But that may just be the outside of the system to keep out random hackers. The actual information may not actually be encrypted. That would mean a potential bonanza for China and a huge risk to US security.

The original DOD contract was supposed to be to a single contractor. However, complaints from industry and the public – and from security experts, as in our panel discussio – pushed the department to support more than one cloud application (and also may have allowed for some backup if a cloud operation crashed, for whatever reason, although DoD has not told us about any backup).

The question arises: If Microsoft was using Chinese engineers, were the other cloud providers doing the same thing, and did they have digital escorts, or something like them?

Along with Microsoft, other participants in the DoD cloud contract, initially for $9 billion, were Amazon, Google and Oracle. All of them do business in China. Oracle has offices in Beijing. Amazon has offices in Beijing, Shanghai and Wuhan. Google has offices in Beijing, Shanghai and Shenzhen. Of course we do not know if DoD granted them the same deal they allowed for Microsoft, but it is important to find out.

Or maybe DOD never agreed to digital escorts and Chinese engineers? We don't really know, but it is unlikely Microsoft could have hired Chinese engineers without some Defense Department input. If DoD never approved, then it is another example of a security failure. If they did approve, of course, it is also a security failure. Either way it is a disaster.

Hegseth understands the digital escort issue is a big deal, but he cannot just accept Microsoft's decision to end China's participation in the Defense Department cloud. Hegseth needs to back a full scale inquiry and investigation. We need an assessment of how much damage was done and, potentially, what programs may have possibly been compromised.

Sign up for one of our free newsletters

• The Daily Report Start your day right with Asia Times' top stories
• AT Weekly Report A weekly roundup of Asia Times' most-read stories

Such an investigation has to assess just how long the Digital Escort system has been in place. How long has China had access to the Defense Department's computer heartland? Hegseth needs to find out what the other contractors are doing and if they are using foreign workers.

Finally there is a serious question about outsourcing American security to private contractors, especially those who are not core defense contractors and who depend on foreign revenues to support their bottom line. Companies that are mainly commercial are inherently a risk because they lack a security culture and always want to expand into markets that can prove difficult and risky. Putting trust in them raises more than eyebrows.

Stephen Bryen is a special correspondent to Asia Times and a former US deputy undersecretary of defense for policy. This article , which originally appeared in his Substack newsletter Weapons and Strategy , is republished with permission.

Sign up here to comment on Asia Times stories Or Sign in to an existing accoun

Thank you for registering!

An account was already registered with this email. Please check your inbox for an authentication link.

• Click to share on X (Opens in new window) X
• Click to share on LinkedIn (Opens in new window) LinkedIn
• Click to share on Facebook (Opens in new window) Facebook
• Click to share on WhatsApp (Opens in new window) WhatsApp
• Click to share on Reddit (Opens in new window) Reddit
• Click to email a link to a friend (Opens in new window) Email
• Click to print (Opens in new window) Print