Description
A source told reporter Renee Dudley something she found hard to believe: that Microsoft was running tech support for the Department of Defense through China, the country’s biggest cybersecurity adversary. The arrangement was called “digital escorting.” She thought it sounded like a conspiracy theory — until she started looking into it. This is the story of what she found and how her investigation changed government policy.
Read the original story here.
Transcript
Editor’s Note: “Paper Trail” is produced as an audio series. If you are able, we encourage you to listen to the series. Transcripts are for reference only and may contain typos. Please confirm accuracy before quoting.
Jessica Lussenhop: ProPublica. Investigative journalism in the public interest.
I have, like most people, I assume, a pretty healthy fear of getting hacked. Ugh, even saying that out loud makes me nervous, like I’m speaking it into existence … but it’s become this fact of our online lives. I’ve gotten three alerts this year about my personal information being hacked.
Nobody’s hacking me, to be clear. I’m not important or rich enough for that. People are hacking the big companies I trusted to keep my information safe. And there’s seemingly nothing I can do about it! Nothing except complain.
Renee Dudley: Everybody loves to complain about Microsoft.
Lussenhop: Really?
Dudley: Yeah.
Lussenhop: This is my ProPublica colleague, who does a lot more than complain when she learns about a big hack.
Dudley: I’m Renee Dudley, and I am a cybersecurity and technology reporter at ProPublica.
Lussenhop: Lately Renee’s been more like our Microsoft reporter.
Dudley: Techies have long held that Microsoft is a legacy company with weaknesses that are just waiting to be exploited by hackers.
Lussenhop: Microsoft is one of the world’s biggest companies and a major supplier of technology to one very important customer.
Dudley: The federal government is actually one of Microsoft’s biggest, if not its biggest, customer and has been for years.
Lussenhop: The Pentagon uses Microsoft for email, calendars, storing files. And Microsoft’s weaknesses that everyone loves to complain about? They’ve already been exploited by our biggest cyber adversaries.
Like in 2017, we learned North Korean hackers targeted 150 countries including the U.S. and the U.K. — creating mayhem in the British health service. In 2020, we learned Russian hackers got access to reams of sensitive U.S. government data. And then there’s China — our most active and persistent cyberthreat. In 2023, Chinese government-backed hackers were able to get their hands on about 60,000 State Department emails from Microsoft Outlook.
Congress held a hearing where a Microsoft executive took responsibility for the hack and promised to address security weaknesses.
All of this is why Renee was surprised when she was on the phone with a Microsoft contact of hers and they told her something kind of wild.
Dudley: A Microsoft source told me, sort of apropos of nothing, we’d been talking about this other story. They said, you know, there’s some crazy stuff going on. You wouldn’t believe this, but Microsoft is running IT support and service for the Defense Department through China. And I was like, “What are you talking about?”
Lussenhop: What they were basically saying is any time the government’s Microsoft products needed updating or fixing, there was a chance that engineers in China were the ones doing it. Meaning engineers there could have access to the U.S. government’s sensitive files.
Dudley: My initial reaction was this cannot be true because it just sounds so far-fetched. I mean, I know that Microsoft has global operations. I know that it’s a massive tech company. They’ve got workers all over the globe. But I’m also by this point familiar with the Defense Department’s rules that prohibit non-U.S. citizens from working on highly sensitive information that we would not want our enemies to know: you know, military secrets and the like.
Lussenhop: These are secrets the Chinese government is actively trying to get at. What if they didn’t have to hack into our systems? What if we were handing over our secrets or at least our cyber weaknesses on a silver platter to Chinese citizens? Chinese citizens who could be compelled by the Chinese Communist Party to hand them over.
Given Microsoft’s track record and her past reporting on the company, Renee thought maybe there’s something to this.
So she asked around to see if she could find anyone else who may know anything about this and came across a very interesting comment on LinkedIn talking about this very thing.
Dudley: It was by this guy named Tom Schiller.
Lussenhop: Renee called him up, and Tom told her that he’d done some work with a contractor for Microsoft and he’d learned that, sure enough, Microsoft was using their engineers employed in China to service sensitive government systems. What’s more: Tom said he’d seen how it was happening up close. He said the China-based engineer could get around the U.S. government’s rules by having a U.S. citizen escort them.
Dudley: He finds out about this system that he referred to as digital escorting.
Lussenhop: When you just hear the term digital escort, like, what was your first thought?
Dudley: What’s he talking about? And then as soon as we hang up, I start Googling and, you know, quickly realize I’m probably gonna get flagged by HR and IT for, you know, untoward searches on my work computer. Um, but …
Lussenhop: Because it is, to be explicit, a little, possibly, I don’t know, porny sounding?
Dudley: Little racy. You know …
Lussenhop: A little …
Dudley: The results that I was getting weren’t what I was expecting.
Lussenhop: Digital escorting. She didn’t understand exactly what that meant. It was a strange term … and it came to her from Tom, who turned out to be a bit of an unusual source.
Dudley: He was a, a little bit of a conspiracy theorist, to put it mildly.
Lussenhop: Tom was describing digital escorting as part of something … very nefarious. He called it a quote “CYBER 9-11.” He theorized that Microsoft was collaborating with the Communist Party of China, calling it the “Prelude to WWIII.”
But given all the successful cyberattacks from the Chinese government over the years … this lead seemed like it was too big not to investigate.
Dudley: It was shortly after this conversation that I found a real piece of evidence on the internet that made me realize I think that both the original tipster and Tom Schiller are onto something here.
Lussenhop: I’m Jessica Lussenhop. This is “Paper Trail.”
Lussenhop: Renee started her reporting journey in a pretty basic place: searching the term “digital escort.”
Dudley: I sort of just kind of go to town on Google to see if there’s any mention of this whatsoever. And I did come across this job ad.
Lussenhop: A job ad posted by a company called Insight Global. It’s the same one that Tom Schiller had done work for.
Dudley: They’re looking for a digital escort.
Lussenhop: They’re willing to pay $18 to $28 an hour.
Dudley: And the description of the job almost exactly matched what Tom Schiller described it as.
Lussenhop: The job ad spelled out the exact skills and requirements for a so-called digital escort, which again, to be clear, were not like OnlyFans skills. They were computer skills. But strangely it didn’t seem like a suitable candidate needed to be a tech wizard. Most of the tech skills listed were just, quote, “nice to have.”
Dudley: The main prerequisite was that you have to have a security clearance.
Lussenhop: So right away, it seemed like, OK, digital escorting was probably a thing. Renee’s next question was: Who were these people working as digital escorts? She knew they had to be U.S. citizens, since that’s a requirement for a security clearance. But what exactly was their job?
Dudley: So I started working with Doris Burke, our brilliant research reporter here at ProPublica. She’s a wizard at LinkedIn, and I asked her if she could find me everybody who’s ever worked at Insight Global and everybody on LinkedIn who has the term digital escort listed anywhere in their profile.
Lussenhop: One of the things I love about this story is that I think people love to dunk on LinkedIn as being possibly one of the most obnoxious social media sites out there just because it’s, like, people, like, hyping themselves up and fishing for work and just kind of in some ways being their worst online selves.
Dudley: That’s gold. That’s gold to me. Let me hear about every detail of what you’ve done as a digital escort.
Lussenhop: So Doris put together an Excel spreadsheet of all these people. The list of people ended up being over 100 names long, and the majority of those people had recently come out of the military.
Dudley: They had a security clearance already from their prior employment. From what I understand about the security clearance process, it makes it easier for the next employer if you’ve already been through the process.
Lussenhop: Renee reached out to all her leads, and eventually someone got back to her.
Dudley: Somebody who was actually a current digital escort at Insight Global.
Lussenhop: Renee got on the phone with this living, breathing digital escort. They were a bit hesitant to speak with her but also didn’t seem surprised that a reporter had reached out to them.
Dudley: They were sort of waiting for a call like this.
Lussenhop: They’d been concerned about the work they’d been doing for a while.
This person described what a day in the life of a digital escort was like. A digital escort leaps into action when there’s a problem. Like, let’s say one of the government’s Microsoft programs needs a software update.
Behind the scenes, unseen by the users at the U.S. government, it’s not just one person who responds. It’s two people. The U.S.-based digital escort who is there to chaperone a foreign-based engineer. The real, live digital escort confirmed to Renee on the phone that many of the engineers they work with are based in China. So a China-based engineer and the U.S.-based escort are on the case.
Dudley: They meet together on a Microsoft Teams chat.
Lussenhop: The China-based engineer is the one who knows how to fix the problem. On their end, they produce a block of code to solve it and send it over to the digital escort in the U.S. The digital escort then just copy-pastes it.
Dudley: And applies it to the Defense Department network.
Lussenhop: But on the phone with Renee, the real, live digital escort explained the problem with that: The U.S.-based digital escort has way fewer tech skills than the China-based engineer. So when they paste that code into the DOD systems, Renee’s source said:
Dudley: “You know, me and my colleagues, we’ve got some tech background, but we just don’t have the expertise to know what we’re looking at here. We’re flying blind. We’re assuming that what we’re inputting into the Defense Department is safe, but we really have no idea.”
Lussenhop: All of this so that they can follow the government’s rule: that you have to be a U.S. citizen or permanent resident to handle sensitive data.
Lussenhop: It’s just like a little, it’s like a little workaround.
Dudley: It’s a workaround. Yeah.
Lussenhop: It’s a little workaround that actually when you interrogate it like you did, actually completely violates the spirit and the intent of the government’s rule.
Dudley: Yes.
Lussenhop: This “workaround” seemed like a huge vulnerability. Who knows if it had already been exploited? If you were a foreign spy, you’d definitely want to be riding along with a U.S.-based digital escort. You could take advantage of the escort’s lack of knowledge and do something nefarious. Instead of creating code that fixes the problem, they could have the escort unknowingly insert a bug.
Dudley: Now I understand the logistics of how- how this actually, practically goes down.
Lussenhop: What’s going through your mind at this point in the reporting?
Dudley: I- I’m thinking, who came up with this? And does the government even know? And if they do, who approved it? And when and how and why?
Lussenhop: That’s next.
Lussenhop: At this point, Renee was pretty sure that digital escorts were real — that they were working beside China-based engineers on computer systems with sensitive government information. She’d confirmed it with a digital escort who worked for a company that contracted with Microsoft, but she hadn’t confirmed any of this with anyone at Microsoft. So she checked in with her contacts who used to work there, people who’d helped her on previous stories, who she considered reliable and trustworthy.
Dudley: I describe to them this new information that I have, and they’re shook. They’re, they’re sort of in disbelief. They just said no way. You know, there’s just no way. “I don’t wanna shoo you off a topic,” you know, “I know this is your job. I’m not trying to defend Microsoft, but there is just no way that this is happening.” And I, I said, “Well, I don’t know what to tell you cause I’ve got this job ad, and, you know, I’ve talked to somebody, and like, this is happening,” you know.
Lussenhop: Renee thought, she had to find the receipts. Some kind of documented evidence of the existence of this thing.
Dudley: So that brings us to Doris who, who had this idea to check the patents.
Lussenhop: Doris, the research reporter who’d helped Renee search LinkedIn. Patents are publicly accessible documents that companies file to protect their inventions. She wasn’t really sure what exactly to look for, but she took a shot in the dark.
Dudley: She put, you know, Microsoft and escort into the U.S. Patent Office search bar, and, lo and behold, they’ve got a few patents related to digital escorts. And so it confirmed that people knew about it and that this was a real thing in the company.
Lussenhop: And the most exciting part to Renee:
Dudley: It had the list of inventors.
Lussenhop: These were Microsoft employees — past and present — who all had to know about digital escorting.
Dudley: And so I just start going down the list of people.
Lussenhop: She reached out and a few of them got back to her. They helped answer a question for Renee: why and how did Microsoft even come up with this?
Dudley: It goes back to the very beginning of the government’s use of the cloud.
Lussenhop: The cloud. It used to be that the government would store and process its own data on its own servers — kinda like how you used to have to keep all your documents or photos on a hard drive. But then the cloud came along. People like me started using Google and Dropbox to store my photos and documents. And the government was eager to move to the cloud, too. Microsoft really wanted them to move to its cloud. So they struck a deal — well, several deals — to move a lot of the government’s data and computing to Microsoft’s cloud services.
Dudley: And it’s no longer gonna be on a U.S.-owned and controlled server. It’s in a server in a massive data center, you know, controlled, owned and operated by Microsoft.
Lussenhop: This meant IT support for the cloud would also have to come from Microsoft employees. Microsoft’s engineers were already trained to work on the cloud. It’s just that many of them weren’t U.S. citizens or even based in the U.S.
But when the government gave Microsoft its rules — that only U.S. citizens and permanent residents could work on its sensitive files — former employees told Renee that was easier said than done.
Dudley: Microsoft told the government, you know, that’s gonna be really expensive to hire a slew of U.S.-based engineers that they get security clearances for to do nothing but maintain government systems. What else can we do?
Lussenhop: So Microsoft and the government are going back and forth, trying to make this work. And the idea comes up for a workaround: digital escorting.
Microsoft’s global engineers would do the bulk of the work, writing the actual code. But they’d hire digital escorts with the right clearances to be the hands on the keyboard. Renee talked to one Microsoft employee who said that an executive at the company ran with it.
Dudley: The corporate vice president over Microsoft’s cloud platform just embraces the idea. You know, this is great. This’ll help us scale up. And from the discussions that I had, the people who were working on the digital escort concept, they weren’t thinking about the worst-case scenario. I talked to this one engineer, and he said, you know, I don’t have any reason to suspect someone more just based on their country of origin.
Lussenhop: Which, like, fair enough. Like, country of origin is not a reason to automatically assume bad intent.
Dudley: No. However, the U.S. has rules for who can and cannot access this highly sensitive data.
Lussenhop: In the worst-case scenario, Microsoft’s China-based engineers could be coerced by the Communist Party of China to insert a bug to bring down the U.S. government’s computer systems. But it didn’t seem like Microsoft was thinking about that scenario.
Dudley: They were not thinking like an investigative reporter or a conspiracy theorist.
Lussenhop: Tom Schiller, the person who first tipped her off to the existence of digital escorts, had a bit of an affection for conspiracy. But he’d been onto something.
Dudley: Although we were coming to this from different, probably, worldviews, the common ground I think that investigative reporters have with conspiracy theorists is that we have the ability to imagine the worst possible outcome of something. What’s the worst that could happen to people? What are the consequences? And, that view that you don’t have any reason to suspect someone because they’re based in another country: You know, national security experts that I talked to about this — they see that as naive. I spoke with Harry Coker, who was a former senior executive at both the CIA and the National Security Agency.
REPORTING CALL, Harry Coker: I would look at that as an avenue, uh, to, to extremely valuable access if I were an operative.
REPORTING CALL, Dudley: Right.
REPORTING CALL, Coker: Uh and we need to— we need to be very concerned about that.
Dudley: And said if the roles were reversed.
REPORTING CALL, Coker: And uh, we would love to have had access like that.
REPORTING CALL, Dudley: Yeah.
Dudley: The U.S. intelligence community would love to have this kind of setup for spying on China. Coker also basically raised the point of, you know, gee, I wonder if this is the reason for all of these attacks that we’ve faced over the past few years from China. I mean, who can say? But it, you know, he raised that point.
Lussenhop: Yeah, it’s, it just, like, seemed like a, an awfully nice opportunity.
Dudley: Yeah.
Lussenhop: Renee finally reached out to the Microsoft press office with the mountain of evidence she’d compiled, and they confirmed that yes, the program did in fact exist. But the company defended itself, saying that global workers didn’t have direct access to the systems and that the escorts were given training on how to protect sensitive data. Plus, they said, they were following all the government’s requirements.
Dudley: One of their defenses of the arrangement is: This is government approved. This is U.S.-government approved.
Lussenhop: If that was true, who approved it and why? Renee knew it must have been someone in the Defense Information Systems Agency. DISA for short. It’s essentially the Department of Defense’s IT agency. They’re the ones who maintain the rules around the cloud for the department.
So she calls them.
Dudley: PR people that I’m dealing with, you know, they’d never heard of it. Seemed skeptical. I’m kind of shuffled between a couple different communications people.
Lussenhop: Days go by, and eventually one of the PR contacts tells her that really, nobody in the department knows what she’s talking about.
Dudley: He told me he’d reached out to more than three dozen people within DISA in his attempt to get information. And his quote was, “Literally no one seems to know anything about this, so I don’t know where to go from here.” I’m thinking even if nobody there now knows anything about this, there must be some paper trail, if you will.
Lussenhop: Hey that’s the name of the show!
Dudley: Of the existence of this thing.
Lussenhop: So Renee went back to Microsoft and told them the government is still saying they have no idea what this is. She says, surely there has to be some sort of document showing the government approved this, right? Where could she find that proof?
Dudley: Microsoft goes back to the drawing board and they get back to me to say, oh, OK, we know where the paper trail is.
Lussenhop: The company tells Renee they have to periodically submit plans to show how they’ll meet the government’s requirements … and then the government has to accept them.
Dudley: There’s this report called the CCSRGSSP. The CCSRGSSP.
Lussenhop: Ugh!
Dudley: And I’m like, wha— OK!
Lussenhop: Just rolls right off the tongue.
Dudley: Rolls right off the tongue, the Cloud Computing Security Requirements Guide System Security Plan.
Lussenhop: Microsoft tells Renee to go back to the government and tell them to look there — in the CCRGSSP thing.
Dudley: I go back to DISA. I said, “In this report, do a control-find for escort, and you will see what Microsoft is talking about and that I’m talking about.” And so a few more days go by and they, they provide a statement acknowledging the existence of digital escorts.
Lussenhop: In the statement, DISA said that foreign engineers didn’t have, quote, “direct, hands-on access” to government systems and only provided recommendations. And they said cloud service providers like Microsoft were required to vet their specialists.
Lussenhop: I think it — there’s so many things about this that are remarkable, including that what you managed to do here is prove that the government said yes to something without seemingly institutionally having any memory of that.
Dudley: Yeah, this went across four different presidential administrations. This went through Obama, Trump one, Biden and Trump two without anybody really raising an eyebrow about it.
Lussenhop: So this is kind of a nonpartisan screwup.
Dudley: Yes. I will say, you know, just as a matter of fairness, I didn’t know then, you know, this came out later. I got a copy of that CCRGSSP. I actually got a copy of it, and I could see what Microsoft actually told the government. And there was no mention of foreign engineers being used, and definitely no mention of China.
Lussenhop: What Microsoft did describe in the document was a system of, quote, “escorted access” … but that document wasn’t clear about how it would all work.
Dudley: Maybe nobody in the government had that conspiratorial mindset to assume the worst, that the person being escorted could be a Chinese spy.
Lussenhop: Renee published the story about this digital escorts program.
NEWS CLIP, OAN: ProPublica published findings of an investigation they conducted into a Microsoft computer system our Department of Defense uses to store sensitive information in cloud-based storage.
NEWS CLIP, CBN: China’s potential in to DOD systems … appears to be Microsoft employees based in China, operating under oversight of undertrained U.S.-based supervisors. While these Microsoft …
Lussenhop: And she says the story gets the fastest response she’s ever gotten in her journalistic career.
Dudley: It was pretty swift. I think there was just an immediate recognition of — this is low-hanging fruit for espionage, and this is something that we need to address. Right away, members of Congress were posting online about it and directly asking Defense Secretary Pete Hegseth to do something about this. And by the end of the week that this story published, he had released a video directly addressing this situation.
Pete Hegseth: This is obviously unacceptable, especially in today’s digital threat environment. Now this was …
Dudley: The story was published on a Tuesday, and on Friday, Microsoft said it had stopped using China-based engineers to support Defense Department cloud systems.
Hegseth: And I wanna thank all those Americans out there in the media and elsewhere who raised this issue to our attention so we could address it.
Lussenhop: The media, meaning you.
Dudley: The media meaning me.
Lussenhop: And, and Secretary Hegseth is not a, uh, huge fan of the media writ large, so …
Dudley: It was a surprising end to the week.
Lussenhop: After Renee’s reporting was released, the Defense Department also opened up an investigation, looking into whether any of Microsoft’s China-based engineers had compromised the government’s national security. The Pentagon told her that they can’t comment on whether it turned up anything.
But a few months after Renee’s story came out, President Trump signed into law a measure that bans anyone based in China and other adversarial countries from accessing the Pentagon’s cloud systems.
Lussenhop: What about Tom Schiller, the guy who tipped you off to all this. What was his response to all this?
Dudley: Tom Schiller was delighted. This was the reaction that he’d been trying to get from the federal government for years. But I would say his delight was somewhat metered because I hadn’t done enough to connect the dots between this situation and Barack Obama and Joe Biden. So, you know, can’t please them all, you know?
Laura Loomer: Tom, thank you so much for joining me tonight. …
Dudley: Tom Schiller went on to Laura Loomer’s show.
Laura Loomer: This, uh, hidden, dark, deep secret … a relic of the administration of Barack Hussein Obama …
Lussenhop: The podcast “Loomer Unleashed” featured Tom Schiller the Friday after Renee’s story published.
Tom Schiller: … And it was Barack Obama’s name and signature on all of it. He was the person that authorized everything, all of it, across the board. Nobody else, just him.
Dudley: He got to air his conspiracies for two hours on Laura Loomer’s show.
Lussenhop: Conspiracies are different from journalism … the difference is … FACTS. As a journalist, I am DESPERATE to get the facts right. Our whole job is to uncover hidden facts. And then we check them and then check them again and … again and again and again. It’s the root cause of my chronic insomnia.
Which is all to say … Renee did not find factual proof to back up the conspiracies Tom Schiller talked about on Laura Loomer’s show.
Schiller: I think Microsoft and the Chinese government are in collaboration on this. I think that, uh, something nefarious is, is afoot.
Lussenhop: And just to be clear, like, if you were able to prove what he was saying, like, “Oh, there actually is incredibly nefarious intent on the part of the Obama administration or the Biden administration or both administrations,” like, if you had proved that, you would have. But that’s just not where the facts took you.
Dudley: Of course. We just follow the facts where they take us and the evidence where it takes us. And that’s what I did here.
Lussenhop: Renee continues to report on Microsoft and the government’s adoption of private sector technology — including the rush to adopt artificial intelligence systems from private companies in sensitive settings.
Dudley: In the AI age, there are seemingly fewer and fewer guardrails, and the same concerns exist. You know, can I trust the company to do right by the public when it comes to the handling of this data? And story after story, we’ve shown how Microsoft — but I would say corporations in general — will prioritize their own profit over the needs and security of their customers. And that makes a lot of people worry.
Julia Longoria: This episode was produced by Sabby Robinson and me, Julia Longoria. Editing by Katherine Wells. Sound design and mixing by David Herman. Music by Julian Sartorius, Filippo Ansaldi and Simone Sims Longo, with additional music by Epidemic Sound. Our team also includes Gabrielle Berbey and Emma Talkoff.
Insight Global, the company that posted the job ad Renee found, said in a statement that it evaluates the technical capabilities of all hires to make sure they have the right skills for the job and that they provide training on Microsoft policies. Microsoft says that security is a top priority. For full responses from Microsoft, Insight Global and the U.S. government, follow links to Renee’s reporting in the show notes.
See you next time.