Microsoft President Brad Smith testified before a US House panel on homeland security, fielding questions about the company’s security practices and ties to China. This comes a year after Chinese hackers infiltrated federal emails by breaching the tech giant’s systems.
Last summer, China-linked hackers stole 60,000 US State Department emails by hacking into Microsoft’s systems. Additionally, a Russian group separately accessed emails of Microsoft’s senior staff this year, including correspondence with government officials, according to the company’s disclosures.
Lawmakers grilled Smith for Microsoft’s inability to prevent both hacks, which they said did not use sophisticated means and repeatedly put federal networks at risk.
“Microsoft is one of the federal government’s most important technology and security partners, but we cannot afford to allow the importance of that relationship to enable complacency or interfere with our oversight,” said Democrat Bennie Thompson.
The hearing referenced an April report by the Cyber Safety Review Board (CSRB), formed by US Secretary of Homeland Security Alejandro Mayorkas, which criticized Microsoft for its lack of transparency over the Chinese hack, calling it preventable.
“We accept responsibility for each and every finding in the CSRB report,” Smith said in his opening statement, adding that the company had already begun working on most of the report’s recommendations.
He explained that cyberattacks have increased and become more sophisticated over time, stressing that public-private partnerships are critical in defending against them. “We’re dealing with formidable foes in China, Russia, North Korea, Iran, and they’re getting better,” Smith said. “They’re getting more aggressive … They’re waging attacks at an extraordinary rate.”
When questioned about why Microsoft couldn’t detect the Chinese intrusion, which was discovered by the State Department, Smith said: “That’s the way it should work. No one entity in the ecosystem can see everything.”
But Congressman Thompson wasn’t convinced. “It’s not our job to find the culprits. That’s what we’re paying you for,” Thompson told Smith.
Lawmakers also probed Smith for details on Microsoft’s business and presence in China. “Over the years, Microsoft has invested heavily in China setting up research incentives, including the Microsoft Research Asia center in Beijing,” said Congressman Mark Green from Mississippi, chairman of the homeland security panel. “Microsoft’s presence in China creates a mix of complex challenges and risks. We have to talk about that today.”
Smith stated that around 1.5 percent of the company’s revenue came from China, and that it was working on reducing its engineering presence there.
Microsoft, the world’s biggest software-maker and a key vendor to the US government and national security establishment, has faced heightened criticism from its security industry peers over the past year due to the breaches and lack of transparency.
Following the board’s criticisms, Microsoft said it was working on improving its processes and enforcing security benchmarks. In November, it launched a new cybersecurity initiative and declared that security would be the company’s top priority “above all else – over all other features.”
