Here's some examples of solid evidence
- Leaked documents either from Intel or the NSA documenting the NSA pressing Intel to provide backdoors, and Intel accepting
- One of the APT groups believed to be associated with the US government is found using an ME vulnerability in the wild, before the vulnerability became publicly known
- Refusal or extreme reluctance on the part of Intel to fix a discovered vulnerability
- A vulnerability which is clearly intentional, like having ME automatically execute any shell script sent over the network signed with a particular certificate or something.
Examples of circumstantial, but still quite compelling evidence:
- A vulnerability which appears intentional, as in it doesn't require any buffer overflow or shell code injection or abuse of certain registers, but rather seems to be a part of normal operations.
- Intel pushes a change to fix an ME vulnerability, but that change simultaneously introduces another vulnerability.
- Evidence that Intel, while giving the US government the ability to disable ME, refuses to give such an ability to other large customers (Google, Amazon, other governments, etc.), for any amount of money.
Seriously, if someone comes forward with evidence like the above, I'm completely open to accepting the possibility Intel ME is an active backdoor for the US government.
I'm not intimately familiar with the situation but I heard some chatter a few years ago about Google (which likes to use Coreboot on its Chromebooks) asking Intel for documentation and source code for various firmware components including the IME and being turned down.
Researchers recently found an undocumented bit can be set in recent IME versions with a name ("High Assurance Program (HAP)") said to be associated with the US government which disables most functions of the IME.[1]
[1] http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
If you have a source to back up the claim that Google offered money for access/documentation for disabling ME and were rejected, that's something, though.
I did some quick searching (I mostly skipped the coreboot mailing list which is probably the most interesting place to look but I didn't want to spend too much time) and every reference I've found alludes to someone from Google or Coreboot _asking_ for Intel's assistance in the form of documentation or source code, which Intel has plenty of non-NSA-related reasons to refuse to provide for free (licensed code, preserving competitive advantage, DRM shit, etc.). I couldn't find any references to anyone offering to _pay_ Intel for ME firmware source code or similar but then again such an offer would hardly be public. So this is weak circumstantial evidence at best.
I find AMD's refusal to cooperate with the FOSS community on the matter of its management coprocessor to be slightly suspicious as well as it's an area where it could possibly gain a significant competitive advantage vs Intel but a lot of Intel's reasons for keeping the IME locked down apply to AMD's insistence on black boxing its PSP as well.