Hacker News Reader

Comment by beoberha | Hacker News Reader

I work in azure and this is wildly mischaracterizing the risk, though it is news to me that there are non-US nationals doing escorts for the non-airgapped government clouds.

I assume it is OK to say this: Microsoft has a “China” cloud and a non-airgapped “US Government” cloud. It is standard practice that engineers making production touches in the clouds have to be “escorted” by vendors who make sure you’re not doing anything malicious. I assume the article is implying that these vendors for the US Gov cloud may be Chinese nationals.

As Jason mentions in another comment, anything actually requiring clearance is serviced by the airgapped clouds and only folks with clearance are able to operate there.

Edit: misread the article but the third paragraph stands. The government is totally aware of where the operator boundary lies and this is still wildly mischaracterized.

View on HN

How does the vendor make sure you're not doing anything malicious if they don't have the skills to understand the change?

It sounds like the issue here isn't that the vendor doing the escort is a Chinese national, it's that the engineer making the change is a Chinese national in China and they're using this escort system to check a box saying that because the changes themselves are being made by US nationals, they won't send PII or passwords back to China. But fundamentally a system where an untrusted person gets a less technical person to make a change for them seems inherently extremely high-risk.

Yep, I totally read the article incorrectly. You’re spot on and honestly I’ve asked myself the same question - though less from a national security perspective and more a “what’s the point of this extra tax to mitigate this incident”

It seems pretty reasonable to consider the national security perspective when it seems like the potential risk is organized, nation state actors, and the potential mitigation is only the actual depth of security practices at play.

To put it another way, if the air gap is the only thing preventing the malicious system from doing its malicious thing, it seems like "defense in depth" is working but there's still a problem to solve. That is, making the malicious system not malicious.

> anything actually requiring clearance is serviced by the airgapped clouds and only folks with clearance are able to operate there

It seems like "operate" may be doing a lot of work here.

>“what’s the point of this extra tax to mitigate this incident”

My guess is ATO requires that only US Citizens make changes to the system. However, Microsoft did not want to hire skilled US citizens for pay reasons so they hire unskilled US citizens and get trained Chinese nationals to direct US citizens to make changes they require.

So stockholders get another yacht because GovCloud is expensive but overhead is peanuts and national security be damned.

US Government should announce that their ATO has been revoked but we don't do that.

Yeah it seems like there are two issues here being conflated. The first is that non-US-persons are operating, by proxy, Azure assets that serve US Gov missions. The second is that those persons may be operating assets used in sensitive missions. Say IL4 and up.

The first is a little embarrassing for Microsoft, but a venal sin, not a mortal one. Makes them look like cheapskates offshoring work, instead of training local workers, but Ok, fine.

The second would be a mortal sin, assuming ( its not clear from the article whether) these non-US people are really operating at IL4 and up. Those assets really need US people especially at the higher impact levels. All of the above is public info described in FedRAMP standards.

I think you mis-read the article. Chinese engineers are operating US government cloud computers by proxy. The Chinese just don't see the computer screen. A US grunt copies & pastes the Chinese's commands into the system during a Teams call.

> The government is totally aware of where the operator boundary lies and this is still wildly mischaracterized.

Regardless of the program’s actual risk, it doesn’t seem that the government is fully aware of the program’s very existence. The article quotes the former CIO of the Pentagon as being surprised:

> John Sherman, who was chief information officer for the Department of Defense during the Biden administration, said he was surprised and concerned to learn of ProPublica’s findings. “I probably should have known about this,” he said. He told the news organization that the situation warrants a “thorough review by DISA, Cyber Command and other stakeholders that are involved in this.”

Reply on news.ycombinator.com