An escort who cannot read the command is not a security control

The week

On July 15, 2025, ProPublica reported that Microsoft had used China-based engineers to help maintain Defense Department cloud systems. Under the arrangement, U.S. personnel with security clearances, called digital escorts, typed in commands on the engineers’ behalf. The report said many escorts lacked the technical expertise to judge whether those commands were safe. The systems involved handled sensitive but unclassified government data. Members of Congress demanded answers. On July 18, Defense Secretary Pete Hegseth said China-based engineering teams would no longer support the department’s cloud services and that the department would investigate. The same day, Microsoft said it had changed its support for U.S. government customers so that no China-based engineering teams provided technical assistance for Defense Department cloud services.

FedRAMP and the Defense Department’s cloud security requirements describe in detail how a service must be built, configured and monitored. They say much less, at least in terms an agency program office reads, about which individuals can change a running service, from where, and under whose eye. The escort arrangement sat in that gap. It met the requirement that a cleared U.S. person performed the action. The knowledge behind the action sat with someone the agency had never screened.

Closing the gap means answering three questions in order: who can touch the system, how their work is checked, and what the agency can prove. Each has a different owner. The first belongs to the contracting officer, the second to the provider’s operations leadership, and the third to the agency’s own security team.

Who can touch the system

Large cloud providers run on global engineering teams. Routine operations are often automated. Hard problems escalate to specialists who know a particular component deeply, and those specialists sit wherever the provider built that expertise. A customer that assumes its support comes only from cleared U.S. staff is usually describing the first tier, not the last.

Personnel rules tend to count people who hold credentials. The escort model shows a third category that matters as much. There are people with standing access, people granted temporary access for a task, and people with influence but no access: the engineer who dictates the command that someone else types. A screening requirement that covers only the first two categories leaves the third untouched.

Agencies can ask for this in a form they can use. A personnel access matrix lists each support role, its location, the screening it requires, and whether it acts directly, through temporary elevation, or through another person. The matrix should cover escalated support and incident response, not only steady-state operations. It should also say who writes the operational scripts and runbooks used in the government environment, since those are another path for influence.

Code is a related but separate question. Engineers around the world write software that later deploys into government regions, and that path is governed by secure development and code review practices rather than personnel access rules. Agencies should keep the two apart, so that a promise about support locations is not mistaken for a promise about who wrote the code.

How their work is checked

Supervision works only if the supervisor can evaluate the work. ProPublica described escorts with limited engineering experience reviewing commands written by more experienced engineers. That arrangement satisfies the letter of a rule while placing the substance of every decision with the person the rule was meant to restrict.

Stronger designs rely less on any one person’s judgment. Temporary access is approved against a specific ticket and expires. High-risk commands run only from pre-approved runbooks, never as free text. Sessions are recorded. Changes that touch security settings, keys or data stores require a second engineer of comparable skill to approve them. Automated policy checks block known dangerous operations regardless of who requests them.

These controls have costs. Each one adds minutes to an outage, and during a serious incident minutes matter. An agency that demands two-person review for every privileged action on a high-impact system is accepting slower recovery in exchange for assurance. That is often the right trade, but it should be made knowingly and written into service levels.

The workforce side deserves equal attention. Escort-style roles are often staffed for clearance first and engineering depth second, which places the least experienced person at the most sensitive point. Agencies can ask how supervisory roles are trained and paid, how many sessions each supervisor oversees, and whether supervisors have clear authority to stop a command they do not understand. Those answers predict how the control behaves at three in the morning.

What the agency can prove

Agencies see a provider through its authorization package, its continuous monitoring reports and its incident notices. Those documents describe controls at a level where escalation staffing rarely appears. Monthly monitoring focuses on vulnerabilities and remediation plans, not on who held a privileged session last Tuesday.

Contracts are the main tool for changing that. Useful clauses require disclosure of the personnel access matrix, advance notice of material changes to support locations or supervision models, and periodic independent assessment of the specific privileged access controls the agency relies on. Some providers offer workflows that require customer approval before engineers can view customer content. Agencies should confirm which support paths those workflows cover, because content access and changes to the underlying service are often governed differently.

State and local agencies carry their own obligations. The FBI’s CJIS Security Policy sets screening requirements for personnel with access to criminal justice information. IRS Publication 1075 sets conditions on contractor access to federal tax information, including restrictions on offshore access. Agencies subject to those rules should confirm, with counsel and their oversight bodies, that a provider’s escalation model complies, not only its steady-state operations.

Not every workload needs restricted support. A public website does not justify the cost of a narrower support pool. Restrictions mean fewer eligible specialists, slower escalation and often a higher price. The agency, not the provider, should decide which workloads carry those costs, record the decision, and make it enforceable through the contract and verifiable through evidence it actually receives.

With hindsight

In late August 2025, Hegseth said the department had sent Microsoft a formal letter of concern and would require a third-party audit of the escort program, including code submitted by China-based engineers. He also said department experts would examine whether other providers had similar arrangements. He acknowledged that the program had been designed to comply with contracting rules, and said it nonetheless exposed the department to unacceptable risk.

That admission is the durable part of the episode. The arrangement passed the paperwork and failed the substance. We have not found a public account of the audit’s findings, and we would not claim one. What holds up in 2026 is the distinction the story forced into view: a system can be properly authorized while the people who operate it are supervised in ways that provide little real assurance. Agencies that now ask for a personnel access matrix, and for evidence that supervisors can understand what they approve, are testing the control rather than the paperwork.