SE Kansas News

Congressman Jake LaTurner (KS-02) has issued a letter to the Director of the Cybersecurity and Infrastructure Security Agency (CISA), Jen Easterly, seeking further details about Microsoft's cybersecurity practices. Microsoft is currently the leading IT security and software provider for the federal government.

LaTurner's letter underscores the evident security weaknesses in Microsoft's systems, which have been exposed by recent high-profile cyberattacks attributed to Chinese and Russian intelligence groups. These breaches led to the theft of 60,000 emails from the State Department and exposed thousands of customer accounts and data.

In his letter, LaTurner states, "Microsoft is a leading provider of productivity software, cloud services, and security technology to the federal government, but I am concerned about recent vulnerabilities exposed during cyber-attacks against the company and the potential impact on our national security. In just the past few years, it has been reported that Microsoft’s security posture has failed numerous times – exposing data and information for millions of records."

He further adds, "Given that your Executive Assistant Director for Cybersecurity, Eric Goldstein has said Microsoft is “perhaps the most critical enabler of both government and critical services across the economy,” it is a matter of urgent concern that Microsoft continues to experience such challenges in protecting sensitive data. As a member of the House Committee on Oversight and Accountability, I am deeply concerned with these ongoing security failures."

LaTurner has requested Director Easterly to address several questions related to Microsoft's cybersecurity measures. These include inquiries about why it took so long to develop a fix following the 2020 SolarWinds security breach; what specific results can demonstrate an improvement in security; whether there is a timeline for implementing recommended actions from a recent CSRB report; what outcomes would prompt CISA to reconsider its reliance on Microsoft products; and if there are assurances that no government data will be compromised in future breaches.

The full text of LaTurner's letter can be found here.