Reporter Renee Dudley answers our questions about today’s investigation.

Microsoft President Brad Smith told Congress in 2021 that “there was no vulnerability in any Microsoft product or service that was exploited” in the SolarWinds hack. You spoke to a former employee named Andrew Harris. What does he say happened?

Harris said that he discovered a security weakness in a Microsoft product that many customers, including the U.S. government, used to log onto their devices. The flaw could allow attackers to masquerade as legitimate employees and rummage through victims’ “crown jewels” — national security secrets, corporate intellectual property, embarrassing personal emails — all without tripping alarms.

Beginning in 2017, Harris said that he pleaded with the company to address the issue. But at every turn, Microsoft dismissed his warnings, telling him that addressing the flaw would undermine its business goals. Frustrated, he left the company in August 2020. Four months later, the sprawling SolarWinds hack was discovered. In the attack, Russian spies exploited the very flaw Harris had warned about when they breached government agencies including the National Institutes of Health and the National Nuclear Security Administration.

What is Harris like? What has he told you about why he came forward?

Harris is someone who was drawn to computers at an early age. While still in college, he began working for the Department of Defense, where he stayed for almost seven years. Because of that background, he said he felt a commitment to helping protect national security. So after discovering the flaw in the Microsoft product, he became obsessed with the potential impact on federal government customers who relied on it. He was frustrated when the company refused to act on his warnings, saying, “They’re telling me it’s not ‘customer first,’ it’s actually ‘business first.’”

Microsoft declined to make Smith and other top officials available for interviews for this story, but it did not dispute ProPublica’s findings. Instead, the company issued a statement in response to my questions, saying, in part, that its assessment of the issue Harris raised “received multiple reviews and was aligned with the industry consensus.”