Overview

• The digital escort framework, launched in 2016, routes commands from China-based Microsoft engineers through U.S. personnel with security clearances to access Defense Department cloud systems
• The Defense Information Systems Agency says escorts operate under stringent, government-approved controls and audit logs in select unclassified environments
• Former DoD CIO John Sherman and national security experts say they were unaware of the model and warn it poses espionage vulnerabilities that warrant a full security audit
• Many escorts are low-paid former military staff who lack advanced technical skills to vet complex foreign code, heightening the risk of undetected malicious commands
• China’s laws compel domestic companies to assist intelligence efforts, intensifying fears that the outsourced support system could open a pathway for state-sponsored cyber infiltration