New Law Bans China-Based IT Engineers From Pentagon Cloud Access

Latest stories How a sporting snub has rolled back India-Bangladesh relations South Korea walks a narrow bridge between China and Japan Trial balloon: Japan PM Takaichi contemplates Feb. snap election

In the wake of the reporting, leading members of Congress called on the Defense Department to strengthen its security requirements while blasting Microsoft for what some Republicans called“a national betrayal.” Cybersecurity and intelligence experts have told ProPublica that the arrangement posed major risks to national security, given that laws in China grant the country's officials broad authority to collect data.

Microsoft pledged in July to stop using China-based engineers to service Pentagon cloud systems after Defense Secretary Pete Hegseth publicly condemned the practice.“Foreign engineers - from any country, including of course China - should NEVER be allowed to maintain or access DoD systems,” Hegseth wrote on X.

In September, the Pentagon updated its cybersecurity requirements for tech contractors, banning IT vendors from using China-based personnel to work on Defense Department computer systems. The new law effectively codifies that change, requiring Hegseth to prohibit individuals from China, Russia, Iran and North Korea from having direct or indirect access to Defense Department cloud computing systems.

Microsoft declined to comment on the new law. Following the earlier changes, a spokesperson said the company would“work with our national security partners to evaluate and adjust our security protocols in light of the new directives.”

Representative Elise Stefanik, a Republican who serves on the House Armed Service Committee, celebrated the development, saying it“closes contractor loopholes... following the discovery that companies like Microsoft exploited” them. Senator Tom Cotton, the GOP chair of the Senate Select Committee on Intelligence who has been critical of the tech giant, also heralded the legislation, saying it“includes much-needed efforts to protect our nation's critical infrastructure, which is threatened by Communist China and other foreign adversaries.”

The legislation also bolsters congressional oversight of the Pentagon's cybersecurity practices, mandating that the secretary brief the congressional defense committees on the changes no later than June 1, 2026. After that, such briefings will take place annually for the next three years, including updates on the“effectiveness of controls, security incidents, and recommendations for legislative or administrative action.”