There has to be more to this story that we don't know. Bloomberg has a lot to lose by publishing such a harsh claim that's not extremely fact-checked. Reliable newspapers generally don't throw around anonymous government sources without doing background checks on these people. I have little doubt that they got the information from who they say they did.
At this point I wonder if they should stop protecting their sources on this story and see if that shakes out any truth.
The problem with that is of course that it erodes trust for future sources, and potentially puts these sources at personal risk. But if not doing so starts putting the entire publication into question, that might be a risk they have to take.
The "should have" pressed the sources for hard proof, or found examples in the wild of adulterated servers before publishing the story. That ship has sailed, of course.
But if what was reported was actually true the best thing that can happen now, for Bloomberg and the public, is for their sources to step forward voluntarily with proof.
Admittedly, that will take a lot of courage in today's political climate, but if it's not all just bullshit, highly principled people may do it.
What I would like to know is what the Bloomberg reporters expected would happen as a result of this story?? Did they think Supermicro and Apple would just admit it? Then what?
If the sources are willing to step forward now, why wouldn't they before?
Sometimes the reason for reporting evidence you have is to motivate other people to display evidence they have but don't know was interesting or useful until they saw your story.
That's why so often a single public allegation leads to an avalanche of similar allegations.
Even if Bloomberg's story is completely true, Apple / Amazon / Super Micro might have no other choice, but to firmly deny it. Because in that case, it's United States vs. China, not just some publisher vs. a few publicly traded companies. When national security interests and international relationships between two largest economies in the world are at stake, it's not Tim Cook or Jeff Bezos, who get to decide, what can be publicly shared, and what cannot.
If the story was true, only a few people in each company would have been aware of these vulnerabilities, and they might not have been allowed to talk to anyone about them by FBI. Then, even if others were informed, they would have to pretend, that they were not.
If it's a national security risk they might not have needed to be compelled to lie at all, but decided to do so themselves. This would be big enough to damage their entire supply chain if they did publicly verify it as truth.
The national security adviser to the president of the United States is the one, who would have to deal with this publicly, if such information was confirmed by some of largest companies in the US. And he might as well prefer to deal with it privately, if it was true.
Not correct. Instead of denying it, they could either confirm it, or non-denial deny it. They would not knowingly issue specific and categorical denials that are lies.
In the cases as this, if you don't firmly deny everything, you basically confirm that it's true. And people responsible for issuing categorical denials might have had no awareness of any vulnerabilities, even if they actually existed.
I don't see why people discard the scenario where both the sources and supermicro are right, but there's been a misunderstanding.
This could happen, for example, with a tabletop exercise. I know the military does these, so it's not unlikely the CIA does them too. The CIA dreamt up a scenario where a US company's hardware was compromised by China, and simulated their response for training. Since it's just an exercise, it obviously wasn't as secret, so employees would have probably not feared to talk about it loudly at e.g. lunch break. Someone overhears, it, runs to bloomberg and we have the situation we have now.
Not the only scenario, but something along these lines is my theory.
At this point I wonder if they should stop protecting their sources on this story and see if that shakes out any truth.
The problem with that is of course that it erodes trust for future sources, and potentially puts these sources at personal risk. But if not doing so starts putting the entire publication into question, that might be a risk they have to take.