Federal cyber experts called Microsoft’s cloud a “pile of shit,” approved it anyway

In late 2024, cybersecurity evaluators from the federal government delivered a concerning assessment regarding one of Microsoft’s prominent cloud computing services. An internal government report, which was examined by ProPublica, noted that the tech giant's failure to provide adequate security documentation resulted in a significant lack of confidence in evaluating the overall security of the system. One evaluator bluntly described the situation by stating, "The package is a pile of shit." For years, Microsoft has struggled to adequately clarify how it secures sensitive data as it traverses various servers in the cloud. This lack of transparency left federal experts unable to affirm the technology's security, raising alarms for any company attempting to do business with the U.S. government. The implications were particularly serious for Microsoft, especially considering its products were central to two major cybersecurity breaches affecting the U.S. within just three years. These incidents included Russian hackers exploiting vulnerabilities to access sensitive information from multiple federal agencies, including the National Nuclear Security Administration, and Chinese hackers compromising the email accounts of high-level government officials. The inability to confirm the security of Microsoft's Government Community Cloud High, which is designed to protect some of the nation’s most critical data, could pose further risks to the federal government. Despite these alarming findings, the Federal Risk and Authorization Management Program (FedRAMP) made a striking decision to authorize Microsoft's product, effectively granting it the federal government’s cybersecurity endorsement. This ruling, which included a cautionary note for any federal agency considering the GCC High, enabled Microsoft to solidify and expand its lucrative business within the government sector, valued in billions of dollars.