Microsoft Whistleblower Alleges Foreign Engineer Approved for U.S. Government Cloud Log Access
A Microsoft whistleblower's claims and leaked screenshots suggest an engineer based in India was approved to access U.S. government cloud logs, raising questions about access controls.
A purported Microsoft whistleblower has surfaced allegations concerning the security of U.S. government cloud environments, supported by leaked screenshots that appear to show an engineer based in India receiving approval to access logs from a government cloud via Microsoft's "escort process." While these images raise significant questions about the adequacy of access controls, they do not definitively confirm unauthorized access or a data breach.
The allegations, disseminated by the X account Conspiracookie, identify Microsoft engineer Viraj Chokhany as the requester. The whistleblower, who remains anonymous, reportedly supplied the images and claims Chokhany is not a U.S. citizen. This publication has not independently verified the authenticity of the screenshots or the engineer's citizenship.
One of the leaked images displays an internal Microsoft page, "SPO Environments," listing "DProdMgd151" under the "GCC-Moderate" classification, nicknamed "GCCM." This environment is distinct from separate Department of Defense infrastructure listings. The focus on GCC-Moderate logs is critical, as it pertains to a government cloud environment, not classified military systems.
Another screenshot details incident 815678445, titled "Escort Request: GCCM- Request to view GCC-M logs." It names Chokhany as the creator and the O365 Escort Team as the owning team, indicating the request was resolved. An accompanying approval image for his account alias is also visible. However, approval alone does not confirm what specific information was ultimately accessed or disclosed.
Microsoft's own published GCC service description mandates that employees do not have standing access to customer content. Any staff seeking temporary elevated permissions must undergo rigorous screening, including U.S. citizenship verification and background checks. Yet, the same documentation notes that GCC customer support offers no general assurance regarding an agent's physical location or citizenship, advising customers to confirm recipient authorization before sharing sensitive data.
The core of the allegation hinges on whether the requested logs contained protected customer information that would necessitate the stringent citizenship checks. The provided screenshots do not reveal the actual contents of the logs, nor do they identify the specific government customer or confirm a completed data transfer. Consequently, the whistleblower's suggested violation of FedRAMP compliance remains an unverified allegation.
Further context from the ticket guidance suggests that "ESCORTS ARE NOT ENGINEERS" and are expected to execute commands precisely as written in the ticket, without troubleshooting. This model, as previously investigated by ProPublica, has raised concerns about oversight when escorts may lack the technical expertise to supervise overseas engineers.
While past reports have detailed Microsoft's use of China-based engineers for SharePoint support and the Pentagon's concerns about such arrangements, this specific incident requires concrete evidence regarding the actual logs accessed, the scope of the approval, and the safeguards in place before any breach or compliance violation can be definitively established.