Federal Cyber Experts Called Microsoft's Cloud "a Pile of Shit" — Approved It Anyway

• Source: Ars Technica / ProPublica
• Verdict: keep
• Why: The government's own security certification process approved a platform that its own experts said wasn't secure. The reason? Microsoft is already too embedded to walk away from.

The L-takes

The quote. Federal cybersecurity experts evaluating Microsoft's Government Community Cloud High (GCC High) for use with U.S. government data privately described it using exactly that language — "a pile of shit" — because of poor documentation, legacy complexity, and unknown security gaps.

The failure. Microsoft repeatedly failed to fully explain how key parts of the cloud platform protected sensitive information. Reviewers were left with "lack of confidence" in its security posture. Missing encryption diagrams. Spaghetti-code architecture.

The approval. Despite these serious internal criticisms, FedRAMP authorized GCC High to handle sensitive government data. The approval came with a "buyer beware" note, but it still let agencies adopt the technology widely — even though the people vetting it weren't convinced it was secure.

Why it happened. Microsoft's cloud is already deeply embedded across government. Pulling back would be politically and operationally painful. Political and institutional pressure to move agencies to the cloud likely played a role, with risk acceptance decisions happening "above" the people doing the technical reviews.

The L: The government created FedRAMP to ensure cloud security, but internal concerns can still be sidelined if leadership decides the tech is too important or too entangled to walk away from. Critical government data is hosted on platforms that even expert reviewers privately questioned. The certification process worked exactly as designed — it just wasn't designed to say no to Microsoft.