Given that the CRD/NDA came from Intel and that spectreattack.com is hosted by the University of Graz, I'd assume that that was a one-sided CRD.