Or they straight out lied.
Wouldn't be the first time.
Wouldn't be the first time.
See, now we have complete set of possible answers! So, what does it means when NSA officially announces something? I'd say, it means nothing.
Maybe they didn't know. But we certainly do not have the right to know if they did know or not. This means something.
For the money they get, and the supposed "Cyber Command" mission, they should have a team of great auditors, and advanced tools, that's much larger and more competent than the volunteer OpenSSL team itself. This group should go over all similar code multiple times with a magnifying glass.
Otherwise, what's the point of the NSA & Cyber Command, on its own stated terms?