Pentagon ends Microsoft's use of China-based support staff for DoD cloud The Pentagon has formally kiboshed Microsoft's use of China-based employees to support Azure cloud services deployed by US government agencies, and it's demanding Microsoft do more of its own digging to determine whether any sensitive data was compromised. Defense secretary Pete Hegseth announced the change in policy Thursday …
First sensible thing Hegsegh has said as SecDef. Still a broken clock is right twice a day.
I struggle to see in any world why Microsoft would allow anyone outside the US to support DoD systems. They should all be security vetted too.
I guess they are doing similar for other countries Defence and Government contracts from Five Eyes theu UK NHS to pretty much anyone on the Azure bandwagon.
"Microsoft designed its policy of using staff based behind the Great Firewall to comply with government contracting rules"
The letter but not the spirit it seems. Even so, they should have realised it couldn't possibly be acceptable.
I suppose anyone but Microsoft would have found it galling to be lectured on common sense by Mr Signal Leak with him having the right of it.
That's a good question. Many years ago I was a consultant to a local government. I wasn't just proposing stuff and cashing my check; I got to implement them too, which I really enjoyed about that gig. One thing I wanted to do there was move them from Windows to Linux, but I didn't tell anyone that. Instead I was going to first move everyone to applications available on Linux, one at a time, starting with MS Office to LibreOffice. Dear mother of God what a hornet's nest that was. People just don't want to change. I had other fish to fry so I backed down from that idea and made other improvements instead.
At the same time I was the owner/operator of the town's first internet café (which tells you how long ago this was). The machines were all Linux, albeit with a DE that had a Win95-like start button and taskbar. In all the years of operation only one customer even commented on it.
I guess the conclusion to be drawn from those two examples is, get the OS and applications right from the beginning, and users will take what they're given. But heaven help you if you ever dare change those choices later.
It means that sensitive data will be maintained by staff that are unknown to DoD and prolly not security vetted. Working from who knows where using computers (desktops) of unknown security status (maybe some at their home).
Yes: the agreement might say all sorts of fine things but anyone with any experience in this sort of thing will know that over time security agreements will erode ... eg: the relevant security cleared expert is ill/on-holiday/... so another expert, as a one off, temporarily brought in; temporary slides into often and long term.
On the DoD side: there could be restrictions on what sort of documents/... are put into the MS cloud. Again: that might start well, but sensitive stuff will end up there by accident or as a one off as it is easier than the correct, secure system.
The DoD is big enough to create its own cloud and employ their own staff to keep it working.
Because for decades the DoD has mostly existed for private profit. It favors big weapons systems where they can divide up the work so nearly every congressional district has some money coming in for it, that makes it almost impossible to kill even when it is a boondoggle like F35.
The DoD is a huge animal with tentacles all over the place so not everything it does is Most Secret. Or even Somewhat Slightly Secret. They're also pretty much exclusively Microsoft based so a lot of their work's going to be inside the Microsoft ecosystem, especially if its boring Not Really Secret At All stuff.
When an organization's data goes off to the cloud it should be an amorphous blob. At least it should be. Whether that data is stored within reach of an 'adversary' or not should be unimportant, all that's important is that its secure -- multiple copies and solidly encrypted.
This is unlikely to register with a recycled sportscaster (for that's who our Defense Secretary is). Their understanding of the world, data security and so on is firmly rooted in comic strips and superhero movies.
Microsoft will happily charge you through the nose for a GCC High or Gov Cloud tenant, so we can keep DoD contracts satisfied.....alarming (but not surprising) to find out they've not even got their own house in order.
Good work by Pete MegaDeath for once.
Loads of Americans consider the Trump regime to be a national security threat.
I guess the USG could roll out a Trumpian version of the Nuremberg Race Laws to define those who are American enough to support government tech. Three American grandparents, American partners, etc
But it isn't as though the objection was American citizens of Chinese descent working on this. They were having Chinese citizens who have probably never set foot in the US working on it! I don't even know how that happens, given all the requirements for obtaining clearance to do even the simplest stuff on a DoD project.
There ought to be some consequences to Microsoft for knowingly and blatantly violating US government citizenship and clearance requirements for working on defense related projects. If this was a "small contractor" that only did a billion dollars or so of business a year they'd have all their contracts canceled and end up bankrupt in no time. But Microsoft is told "hey don't do that" while they continue to feed at the taxpayer trough to the tune of billions a year.
I was the security consultant to a bid to manage a UK Government system, and the 'sales person' was adamant that I must not be permitted to tell them they could not use support staff and systems based in India. He even went up, across and down the management chains to get my direct line manager (also a security consultant) to tell me that a specific named senior manager, had said to tell me that. Otherwise the price would be too high and we would lose the bid.
Well, the data being at the time RESTRICTED, and being contractually obliged by my contract with GCHQ/CESG to prevent said offshoring of support, the bid was not a happy one.
I wonder if they will find out who actually approved this monumentally stupid idea and see if they cannot sue or prosecute them.
I need a drink, and I don't mean water.
"and being contractually obliged by my contract with GCHQ/CESG to prevent said offshoring of support, the bid was not a happy one"
Well done! Unfortunately we've had GCHQ recruiting dodgy interns, and negligently allowing them to take classified data out of the place which is pretty damning on management. And that's the one they caught.
I've been banging this drum for ages!!!! Cheap Indian IT / engineering labour is purely a honeypot to ensure the west is entirely compromised when the rubber hits the road and everyone has to pick a side.
Mind boggling that nobody else can see it, profit and margins are making corporations blind to the seemingly obvious risk.
On the screen image for the story, the stars in the 'Star Spangled Banner' aka the flag of the United States of America, do not appear to be quite right.
See, e.g., https://www.britannica.com/topic/flag-of-the-United-States-of-America
Of course as a 'limey' I am probably not allowed to comment on another country's flag, but as their Supreme Leader has just signed an EO banning the burning of said flag, I think the USAfolk might want to check.
It’s the old, pre-1959, flag. Alaska and Hawaii became states in 1959.
It’s a common error. The other way, using the 50-star flag when deplicting events prior to 1959, has happened on several tv shows and movies. And at least one Western epic set just after the American Civil War has used the 48-star flag, which amused me no end, as the 48-star flag dates from 1912. (I was told to shut up, it’s just a movie. It also had the Colt Single Action Army 0.45 revolver, despite being set in 1867 when the Colt was designed in 1872 and adopted by the US Army in 1873. And the Winchester 73, also from 1873. I had _fun_ spotting anacronisms in that thing.)
