Hacker News Reader

Comment by beaker52 | Hacker News Reader

It could also be possible that these companies are legally bound by some sort of investigation-related order to maintain ignorance to the presence of the chips and that Bloomberg have just sunk an ongoing investigation/counter-espionage operation, potentially putting an associated intelligence network at risk.

View on HN

They're not "maintaining ignorance"; they're categorically denying it, and in significant detail. Both Apple and Amazon produced essentially bulleted refutations of the story. That's not what you do when you're trying to brush something off.

At this point it's clearly down to Bloomberg / Businessweek to bring more evidence to the table, and support their story further. The other side has entirely put the ball back in Bloomberg's court. Their credibility will be severely thrashed by this if they don't.

I don’t believe that. No one will remember in a week or two.

SuperMicro shareholders might.

Indeed. SuperMicro is the victim so far.

If trustworthiness amounted for anything in today's world, all major news agencies would be out of business.

Why limit yourself to news agencies? If trustworthiness amounted for anything, nearly all corporations big enough to have a PR department, and all governments would be out of business.

> They're not "maintaining ignorance"; they're categorically denying it

What makes you think the people denying it know about it though? E.g. if the head of Apple security got served an NSL, wouldn't that potentially prevent them from telling the company lawyers or the executive team?

It's a curious forum we're on where on one day there are jiggabytes spilled over how journalists get technical things wrong and on another, they're so reliably accurate, technology organizations making the case reporting on them is inaccurate must have been infiltrated by men in black and have had hapless employees flashed with a neuralyzer.

Can you please not post unsubstantive comments?

HN has 5M monthly users. Obviously there isn't going to be any consistency.

It's not an 'unsubstantive' comment. There is a very large section of users who are ardent believers in the 'Gell-Mann amnesia' effect. There are also seemingly many, many users, as the one I'm replying to and many who've posted similar, highly voted comments on this thread whose explanation for the discrepancies between the reporting on this story and the company responses amount to (in my view) to MiB but with different acronyms. I find that curious. Maybe you don't, maybe you think those users don't overlap much or at all, that's fair enough. But 'things people find curious about HN that you think maybe aren't' is not 'unsubstantive' so get of my case, oppressor!

This is a rare instance where I agree that 'dang has jumped the gun. I don't see how your comment is insubstantial either, and I think HN's weird relationship with the news media is worthy of comment. No reasonable person reads the comment above to mean "literally everyone on HN has inconsistent beliefs about the press".

> HN's weird relationship with the news media is worthy of comment

If I had said something about trusting Bloomberg or the media then sure. But that’s a completely different topic that’s not even remotely related to whether Apple’s denials on potential NSL issues are reliable.

How are those two topics not intimately related? The question of how reliable Apple's employees are is only relevant to the extent that you believe Bloomberg's reporters were competent in sourcing the story.

Thanks, now I'm regretting not going with the pithier 'ur mom has 5M monthly users' a little less.

Apart from that not being remotely what's being said, HN is not one person, it's a lot of different people with different opinions, commenting on different articles.

I'm not sure what is 'remotely not being said' and I have some vague understanding of the idea HN is not one person.

But there are definitely two (among many) strong tribes of HN-popular belief - let's call them the Gell-Mannicheans and the National Security Epistoleros. It's weird (to me) that they rarely meet in threads on stories concerning both! That could be because they live in different timezones or have different interests. It could be that the Epistoleros are just that much more numerous or that for some people epistolerism trumps gell-mannicheism. Or something else altogether. I find it a curious thing to observe and think about - it's not some underhanded 'zomg lolz, I have caught you in logic error' comment.

But the Bloomberg story says that they replaced thousands of servers. How would you get permission and funding to do that without saying anything?

How is "we have found no evidence of..." categorically denying? They're doing exactly what parent says, turning a blind eye to it, and "truthfully" saying they haven't seen anything amiss.

Because it explicitly contradicts Bloomberg's story, which repeatedly claims Apple had knowledge of compromised hardware.

The story claims that the Apple worked with the FBI to investigate the issue, and Apple is saying no such cooperation ever happened. There really is no way to square these two sides; somebody is either wrong or lying.

Not taking a postion here, but given motivations it's hard to know what to conclude

> That's not what you do when you're trying to brush something off.

It /could/ be what you do if good relations with the Chinese government are crucial to your business (true for both Apple and Amazon).

As for the UK NCSC, it's bizarre that they would comment at all. One possible motivation: eagerness to discover how to use such a backdoor themselves

> “The NCSC engages confidentially with security researchers and urges anybody with credible intelligence about these reports to contact us”

Right. Wouldn't the inside sources also know if Apple/Amazon were somehow gagged? If you're going to leak the whole story, why not leak that part too?

I have reason to believe that Apple and Amazon (and intelligence agencies) silo some data internally on a need-to-know basis wherever possible. A leaker shouldn’t be capable of leaking everything.

So not one of the fifteen Bloomberg sources knew about any kind of gag order or reason for Apple/Amazon to deny these claims? Just saying that seems unlikely.

Sure, but it wouldn't make sense to only relay the gag order to a subset of people who were aware of an incident - that would add risk and defeat the purpose of the risk-mitigating silos that you're suggesting.

APPLE:

> Finally, in response to questions we have received from other news organizations since Businessweek published its story, we are not under any kind of gag order or other confidentiality obligations.

https://daringfireball.net/linked/2018/10/04/what-businesswe...

FWIW, NSLs prevent you from talking about being under a NSL. I don't think they can be forced to lie, though

Which is actually what Reddit did with their annual transparency report. They said something along the lines of "if we haven't been gagged, we'll explicitly tell you we haven't been gagged. Otherwise..."

If the government can compel one kind of speech, it's not hard to compel others. They don't even have to make a a brand new rule for this. The companies have stated they use this technique to get around the gag order.

Judges aren't compilers who will faithfully follow all the rules as written down without deviation. They at specifically empowered to make decisions in light of new evidence, so why wouldn't they force companies to actively like if they are already adding exceptions to the first amendment?

That is a commonly accepted position. As any prosecutions under an NSL would presumably be kept secret in order to keep the NSL itself secret, I strongly suspect that governments in general will take a dim view of such loopholes. The aforementioned secrecy means you are unlikely to find out.

Wow, that would be the press doing their job! Still too early to tell whether this is what happened.

This seems the most likely scenario to me. The official response definitely does not pass the smell test, and this is the simplest way 5 eyes has to benefit from lying.

Out of curiosity, why doesn't the response pass the smell test? Why is one of the possibilities more likely than another?

What would have made you believe Apple if they said it ?

This seems preposterous to me. We are not in China here.

There is plenty of precedent for the US government issuing national security letters (“NSLs”) containing gag orders for ongoing investigations, often with massive monetary penalties imposed for violations.

Apple with the largest pockets and very positive ratings would be the one that could make a stance against such draconian laws.

Unless the fine is implemented as a percent of revenue, market cap or the like. Similarly, the US government once threatened to fine Yahoo $250k per day for non-compliance with PRISM. [0]

As an aside, what do you think is draconian about such a law? It seems like there are reasonable arguments for why it would be in the national best interest to keep an ongoing investigation classified. In fact it seems like an unusually straight forward application of the cliche justification “for national security reasons.”

[0] https://news.ycombinator.com/item?id=8305925

I have no problem with keeping the details of an investigation classified. The issues is that you can't even say there is an investigation.

It is also a straight forward violation of the first admentment.

I doubt that.

"Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances."

talks about Congress, not an executive branch. the latter can gag a person, or a company.

The First Amendment applies to all three branches of the government, not just Congress. The executive branch can attempt to obtain a gag order, but the 1st Amendment nonetheless places limits upon them.

See, for example, https://en.wikipedia.org/wiki/New_York_Times_Co._v._United_S...

That would be less than a $100 million per year operating expendeture.

Which Yahoo shareholders would be irate about, and the Yahoo corporation could not trivially afford to throw away regardless. That would have destroyed about 1/4 of Yahoo's profit at the time.

That would be bad enough, however the next step by the government would be to increase the fine amount, were Yahoo to hold out over time. Kick it up to $1 million per day and Yahoo would have folded no matter what. The problem is pretty straight forward: the government could push it as high as necessary to compel the result they wanted.

> There is plenty of precedent for the US government issuing national security letters (“NSLs”) containing gag orders for ongoing investigations

I don't think the U.S. government can compel companies to lie. It can, though, request them to.

If the NSA said "your servers were compromised by a state-sponsored scheme, and we'd like your co-operation in running counterintelligence operations" I think it would be fair for a company to say "yes". Particularly if part of the offer included help extracting infected hardware from said company's infrastructure.

However, the US enforces the Patriot Act that obligates US companies to turn over user data and are further legally obligated to keep the fact secret? Is it that far fetched to think they couldn't be obligated to avoid admitting (explicitly, or implicitly) something that would jeopardise ongoing espionage-related activities?

Reply on news.ycombinator.com