> Yet, to Apple — and Amazon and other companies implicated by the report — they too might also be in the dark. Assuming there was an active espionage investigation into the alleged actions of a foreign government, you can bet that only a handful of people at these companies will be even cursorily aware of the situation. U.S. surveillance and counter-espionage laws restrict who can be told about classified information or investigations.

I think this may be key in this case, which would give plausible deniability to Apple and Amazon. Conversely, I'm also not fully convinced by this argument, I think it applies more easily and more often when companies are directly subpoanaed by authorities not when there are the initiator. In the case of this kind of breach if one engineer find this issue I would think it would report to senior management first, before contacting the authorities. Also Apple directly stated there are not constrained by any gag order, which leave only one possibility if they genuinely think what they say is true: could it be an unkown unknown?