In today's interconnected world, the role of major technology companies in the national security of the United States is coming under increasing scrutiny. One name stands out: Microsoft. It is a global leader in software, cloud computing, and artificial intelligence and has become both a vital player and a potential major risk factor for the US.
The worries relate to the extent of the company’s wide and deep role within the federal government’s IT infrastructure. According to former White House cybersecurity director Andrew Grotto, recent security lapses at Microsoft run beyond technical failings and have become a full-blown national security concern.
Microsoft’s dominance over government systems has hindered federal agencies' ability to manage and mitigate security breaches – such as the SolarWinds attack – which compromised key elements of the US legal system and breached at least one email account in the attorney general’s office.
Despite generating substantial revenue from its security services, Microsoft has been slow to implement basic security measures without significant pressure from the government. Combined with recent cyberattacks by foreign entities, which have exploited Microsoft products, these lapses highlight the urgent need for greater scrutiny and competition in the software market for government and public service applications.
For as long as its dominant status minimises competition for government contracts, Microsoft lacks incentive to significantly improve its systems’ security, even as it earns billions of dollars of revenue from public contracts. Grotto stressed that even securing minor concessions from the company has been a major challenge for federal agencies, particularly in the aftermath of high-profile breaches, which have created alarm within the government at the extent of the vulnerability to cyberattacks.
The government’s contracting out of services to the private sector has made Microsoft and its Windows operating system the biggest and most critical part of computer infrastructure across federal agencies. It operates a large swathe of the IT needed to keep the state functioning, including data centres that run everything from official databases to diplomats’ emails. Outsourcing to the private sector should make government more cost-effective and efficient.
The contracts granted come with stringent security and confidentiality conditions. Once met, the government allocates a budget to execute the project within a specified period, often renewing the contract as needed. Such contracts can be highly profitable, prompting fierce competition among companies to secure them.
Microsoft has established itself as one of the biggest government contractors, both in terms of the market value of its deals—which runs to billions of dollars annually—and in terms of employee numbers. It is a major custodian and manager of the government’s cloud computing systems and federal email facilities. That means, if and when Microsoft is breached, much critical government infrastructure is at risk.
Such breaches can also impact international power dynamics, as technology has become a crucial factor in global politics. In recent years, Microsoft has suffered several significant breaches, primarily by Chinese and Russian groups, with catastrophic consequences. The emails of key figures, including the Secretary of Commerce, the American ambassador to China, and numerous American diplomats, were among the most severely compromised.
It was once unthinkable that the security of such sensitive figures could be at risk, but now Microsoft has found itself at the centre of national security concerns amid uproar over the breaches.
Read more: A global cyber shield is needed to avert chaos
Chinese and Russian attacks
The firm has been the target of specific attacks over the last four years. In 2021, Microsoft announced that a hacking group operating in China, known as "Hafnium," had breached its email servers. The data of over 30,000 individuals and entities in the United States and around 200,000 worldwide were compromised.
Hackers exploited an unknown vulnerability in three phases: first, they accessed the servers using stolen passwords, then they established a command-and-control (C2) system for the breached servers, ultimately allowing them to steal data by remotely controlling the servers based in the US.
This was not the only incident involving China-backed hackers targeting Microsoft. In the summer of 2023, Chinese hackers exploited another vulnerability in Microsoft’s email system to access sensitive information from the federal government. High-profile officials whose emails were breached included Secretary of Commerce Gina Raimondo, Ambassador to China Nicholas Burns, Assistant Secretary of State for East Asia Daniel Kritenbrink, and hundreds of State Department diplomats.
The hackers specifically targeted an unclassified government email system, which was widely regarded as vulnerable to breaches. At the time, the Biden administration believed that the Chinese operation provided Beijing with critical insights into US strategies before Secretary of State Antony Blinken’s high-risk visit to China in June 2023.
The tactics used in that attack bear striking similarities to previous operations. US intelligence agencies connected it with a past campaign known as Operation Aurora. It was first discovered in late 2009 when Google revealed it had been the target of a sophisticated cyberattack. Aurora targeted several major organisations, including Google, Adobe, and other companies in sensitive industries, with the apparent goal of stealing intellectual property and accessing corporate secrets.
The attacks were linked to Chinese cyber-espionage groups known for their advanced capabilities. While the extent of the Chinese government's links to these attacks remains unclear, evidence suggests that they were either directly involved or, at the very least, aware of the campaign. The attackers employed sophisticated techniques such as phishing emails and exploiting software vulnerabilities to infiltrate networks. Once inside, they were able to access and extract sensitive information.
Operation Aurora had a significant impact, highlighting vulnerabilities in corporate and government networks and sparking increased efforts to bolster cybersecurity defences. In response, many affected organisations enhanced their security. Aurora raised broader awareness of the growing threat posed by state-sponsored cyber espionage. These revelations spurred international discussions about the need for stronger cybersecurity standards and coordinated responses to such attacks.
