8 ms·

It seems like there are two possibilities to me: 1) Bloomberg has a number of sources that are mistaken/misinformed, but this is not necessarily a made-up stor

It seems like there are two possibilities to me: 1) Bloomberg has a number of sources that are mistaken/misinformed, but this is not necessarily a made-up story, or 2) Bloomberg is nearly correct (minus some technical details) but the US government is forcing these companies to respond as if the story is wrong - possibly because of diplomatic reasons. What is the likelihood that #2 is correct? (there are other alternatives, but I believe that the likelihood that this is 100% or at least majorly fabricated by Bloomberg is near enough to zero)

roblabla 8y ago
The US cannot force those companies to lie. They can force them to stay silent, in which case they'd just say "No comments". If those companies are lying, they are committing security fraud.
- 394549 8y ago
  > The US cannot force those companies to lie. They can force them to stay silent, in which case they'd just say "No comments". If those companies are lying, they are committing security fraud. Would the US government have to force these companies to lie? It's quite possible that the denials were the result of voluntary cooperation.
  - macintux 8y ago
    A public company issuing such strongly-worded denials that turn out to be untrue would be leaving themselves at risk of an investigation by the SEC and/or a shareholder lawsuit.
    - ggggtez 8y ago
      It would be pretty extraordinary for the government to sue a company for cooperating with the government. A company has to follow court orders. The government would have to sue itself.
      - macintux 8y ago
        The SEC prides itself on its independence; I don't think it would have any problem taking on a company that lied on behalf of some other agency of the federal government. Now, a court order would indeed be something different, but I find it hard to conceive of a judge compelling a company to lie.
      - PeterisP 8y ago
        If they didn't have to lie and there was no legal order but voluntary cooperation, as the grandparent post suggests, then such voluntary misinformation can easily be a violation of SEC requirements; and one part of the government certainly can prosecute you for doing something that another part of the government suggested (but didn't/couldn't legally require), it wouldn't be the first time.
- swarnie_ 8y ago
  > The US cannot force those companies to lie That's a nice government tender you're working on, looks very profitable! Would be a shame if someone rejected it because reasons. While it isn't the direct influence described i imagine this scenario is highly effective and getting companies to stay in line.
- solarkraft 8y ago
  Is it really so clear-cut what the US can do? Maybe this so significant (it may well be if the allegations are correct) that they're running a campaign to really try to make people believe that this story is false. The companies may have a strong incentive to cooperate in this campaign too, both to save face and government relations. Unfortunately all of Bloomberg's allegations don't hold much water either, even though it'd be so easy for them to make the story credible with some details.
- monocasa 8y ago
  What case law exists for not being able to force a company to lie? Particularly non-press.
- busterarm 8y ago
  But if the story was entirely false, they'd have sued Bloomberg for libel already.
  - macintux 8y ago
    Well, the story just came out a few days ago. I wouldn't rule it out in the future, nor would I leap to the conclusion that an absence of such a move means there's truth to the story.
  - module0000 8y ago
    There could be other arrangements made with Bloomberg that would be jeopardized by that course of action. EG... you find a serious piece of news that can destroy me, so I pay you or make another arrangement to prevent that. If I later turn around and sue you, our backroom deal could blow up in my face. Too much is unknown right now.
  - Karunamon 8y ago
    That might still be in the works, legal process moves slowly. If we don't hear anything in another week or so, this could be worth considering.
- pixl97 8y ago
  >The US cannot force those companies to lie. When it comes to companies like ATT/Verizon it seems like no forcing is necessary. They are complicit.
- late2part 8y ago
  You are right and you are wrong. Legally, you are right. Practically, there is evidence that various elements in the US Government have at times coerced people into making untrue statements.
- cm2187 8y ago
  But they probably can force a handful of engineers to tell nothing to their employer, who would be vehemently denying in good faith.
  - mediocrejoker 8y ago
    How would the government get in contact with the engineers who discovered the hack without going through their managers, the CISO, etc. ?
    - cwkoss 8y ago
      An LRAD "Voice of God" would certainly get their attention. https://www.wired.com/2007/12/the-voice-of-go/ https://www.wired.com/2007/12/the-voice-of-go/
  - pishpash 8y ago
    Not only would they have to force the engineers to tell nothing, they'd have to force all capable engineers to vehemently deny it to their bosses who ask or ask them to look again.
- PurpleBoxDragon 8y ago
  >The US cannot force those companies to lie. But they can. Maybe only in cases where silence is a canary, but that still sets a precedence for them being able to force you to lie.
- ggggtez 8y ago
  You have it backwards. The government can't force them to put out "no comment" press releases. They can force them not to reveal certain information. Maybe that means the only logical thing to do is to say "no comment", but it certainly doesn't prevent a company from commenting as long as they don't reveal the gagged info.
- AnthonyMouse 8y ago
  It's interesting that everyone is assuming the only country interested in pressuring them to lie would be the US rather than China.
josefresco 8y ago
What is the likelihood that #2 is correct? I read a lot of (recent) American history books - #2 gets my vote.
resters 8y ago
My take on this is that it's been fairly obvious for a long time that these kinds of attacks are possible (if not easy) with today's technology. One could design a microcontroller, for example, that was disguised as an 0805 capacitor and functioned like an 0805 capacitor, but also had other functionality. So why is this suddenly breaking news? It bears resemblance to most of the propaganda stories we have seen in recent years: - it is based on truth. Supply chain attacks are known to exist - the US government has a goal of escalating with China over trade and IP practices. - national security threats justify nearly any form of government action in today's world. - the story turns out to have been leaked through foreign sources. This is typically the pattern we see because of concerns about propaganda coming directly from US government officials to US news outlets. There is typically a middle layer that is outside of the US where the allegations can originate from until they are broadly accepted as fact. So Apple and Google are not really lying. Chances are there has not been any sort of major security breach in either of those companies due to supply chain attacks. It is possible that they have been barred from revealing information about it for national security reasons (in this case propaganda reasons). So I think we can expect the following next steps: - The story will continue to hover in this slow reveal format until enough laypeople come to understand the key concepts -- circuit assembly, components, trojan horse components, QC processes, subcontractors, etc. Once the stage has been set there will be more revelations and leaks from major companies that corroborate the story. The goal is to make China the crisis in the buildup to the 2020 election. It's not a coincidence that this strategy is getting underway right after the midterm elections in the US. Our president has already been attacking China with rhetoric and trade sanctions, and this story is meant to turn public opinion broadly against China. The supply chain attacks do not have to have been significant (or successful) to make this happen. The very idea that "sneaky" Chinese intelligence agencies and firms would be able to slip this by US firms' quality control measures is enough to inflict paranoia on Americans and help them start to view China as a terrifying adversary that must be stopped. China's military outnumbers the US military by 20:1 in terms of the number of active duty fighters, and China's economy is approaching first world standards in major cities far faster than the US had ever expected. China dominates scientific publications in the hard sciences, and its top universities are 10x more competitive (or more) than top US universities. So hawks in the US realize that this may be the last opportunity for some sort of power projection or military driven containment of China's ambitions. This is foolhardy, because China is led by a group of highly rational people whose policy responses to the administration's trade threats have been masterful and precise, and have conveyed with no uncertainty that China will not be bullied. So what we're seeing is a short time horizon strategy by the US which is meant to have electoral consequences in 2020 and pave the way for some degree of hostile escalation with China. US weapons systems are still significantly more advanced, but China has likely weaponized many aspects of US infrastructure via these sorts of supply chain attacks. My guess is that the US Government is not aware of many of these, and will panic when they are discovered. Fortunately for us all, China's leadership is calm and not prone to knee-jerk responses. China is rising to world prominence faster than expected, and the US will not take that lying down. However it is probably too late at this point, as China has a tremendous amount of soft power stemming from its importance to the US supply chain. Because of this there is still much hope for a peaceful, trade-driven equilibrium to emerge.
WillPostForFood 8y ago
or 3) Bloomberg is vaguely correct, but wrong in the specifics, including naming Apple and Amazon. I.e., They get credible reports of SuperMicro servers having been compromised, they know that Apple and Amazon are customers. They find 1 over eager source willing to say Apple and or Amazon received compromised servers.
AJ007 8y ago
Taking the writer's statements as truth, 6 out of 17 sources for the original Bloomberg story were government. Presuming the information was classified, each one of those individuals is risking losing their job and going to prison for talking about it. What kind of conclusions the writers made from talking to the other 11 sources, what seniority they had, or even what companies they were from besides 3 from Apple, are anyone's guess. I always am suspect when a government official or employee releases classified information. In some cases extreme moral outrage seems very plausible (Manning, Snowden.) The information is so startling the leaker decides they can handle spending much of the rest of their life in prison. In a much larger number of cases it is for political reasons (Libby, countless other stories where the source is never identified.) Many times, however, I suspect, the information is made up and then no laws have been broken, as far as I understand it.

roblabla 8y ago

The US cannot force those companies to lie. They can force them to stay silent, in which case they'd just say "No comments". If those companies are lying, they are committing security fraud.

394549 8y ago
> The US cannot force those companies to lie. They can force them to stay silent, in which case they'd just say "No comments". If those companies are lying, they are committing security fraud. Would the US government have to force these companies to lie? It's quite possible that the denials were the result of voluntary cooperation.
- macintux 8y ago
  A public company issuing such strongly-worded denials that turn out to be untrue would be leaving themselves at risk of an investigation by the SEC and/or a shareholder lawsuit.
  - ggggtez 8y ago
    It would be pretty extraordinary for the government to sue a company for cooperating with the government. A company has to follow court orders. The government would have to sue itself.
    - macintux 8y ago
      The SEC prides itself on its independence; I don't think it would have any problem taking on a company that lied on behalf of some other agency of the federal government. Now, a court order would indeed be something different, but I find it hard to conceive of a judge compelling a company to lie.
    - PeterisP 8y ago
      If they didn't have to lie and there was no legal order but voluntary cooperation, as the grandparent post suggests, then such voluntary misinformation can easily be a violation of SEC requirements; and one part of the government certainly can prosecute you for doing something that another part of the government suggested (but didn't/couldn't legally require), it wouldn't be the first time.
swarnie_ 8y ago
> The US cannot force those companies to lie That's a nice government tender you're working on, looks very profitable! Would be a shame if someone rejected it because reasons. While it isn't the direct influence described i imagine this scenario is highly effective and getting companies to stay in line.
solarkraft 8y ago
Is it really so clear-cut what the US can do? Maybe this so significant (it may well be if the allegations are correct) that they're running a campaign to really try to make people believe that this story is false. The companies may have a strong incentive to cooperate in this campaign too, both to save face and government relations. Unfortunately all of Bloomberg's allegations don't hold much water either, even though it'd be so easy for them to make the story credible with some details.
monocasa 8y ago
What case law exists for not being able to force a company to lie? Particularly non-press.
busterarm 8y ago
But if the story was entirely false, they'd have sued Bloomberg for libel already.
- macintux 8y ago
  Well, the story just came out a few days ago. I wouldn't rule it out in the future, nor would I leap to the conclusion that an absence of such a move means there's truth to the story.
- module0000 8y ago
  There could be other arrangements made with Bloomberg that would be jeopardized by that course of action. EG... you find a serious piece of news that can destroy me, so I pay you or make another arrangement to prevent that. If I later turn around and sue you, our backroom deal could blow up in my face. Too much is unknown right now.
- Karunamon 8y ago
  That might still be in the works, legal process moves slowly. If we don't hear anything in another week or so, this could be worth considering.
pixl97 8y ago
>The US cannot force those companies to lie. When it comes to companies like ATT/Verizon it seems like no forcing is necessary. They are complicit.
late2part 8y ago
You are right and you are wrong. Legally, you are right. Practically, there is evidence that various elements in the US Government have at times coerced people into making untrue statements.
cm2187 8y ago
But they probably can force a handful of engineers to tell nothing to their employer, who would be vehemently denying in good faith.
- mediocrejoker 8y ago
  How would the government get in contact with the engineers who discovered the hack without going through their managers, the CISO, etc. ?
  - cwkoss 8y ago
    An LRAD "Voice of God" would certainly get their attention. https://www.wired.com/2007/12/the-voice-of-go/ https://www.wired.com/2007/12/the-voice-of-go/
- pishpash 8y ago
  Not only would they have to force the engineers to tell nothing, they'd have to force all capable engineers to vehemently deny it to their bosses who ask or ask them to look again.
PurpleBoxDragon 8y ago
>The US cannot force those companies to lie. But they can. Maybe only in cases where silence is a canary, but that still sets a precedence for them being able to force you to lie.
ggggtez 8y ago
You have it backwards. The government can't force them to put out "no comment" press releases. They can force them not to reveal certain information. Maybe that means the only logical thing to do is to say "no comment", but it certainly doesn't prevent a company from commenting as long as they don't reveal the gagged info.
AnthonyMouse 8y ago
It's interesting that everyone is assuming the only country interested in pressuring them to lie would be the US rather than China.

josefresco 8y ago

What is the likelihood that #2 is correct? I read a lot of (recent) American history books - #2 gets my vote.

resters 8y ago

My take on this is that it's been fairly obvious for a long time that these kinds of attacks are possible (if not easy) with today's technology. One could design a microcontroller, for example, that was disguised as an 0805 capacitor and functioned like an 0805 capacitor, but also had other functionality. So why is this suddenly breaking news? It bears resemblance to most of the propaganda stories we have seen in recent years: - it is based on truth. Supply chain attacks are known to exist - the US government has a goal of escalating with China over trade and IP practices. - national security threats justify nearly any form of government action in today's world. - the story turns out to have been leaked through foreign sources. This is typically the pattern we see because of concerns about propaganda coming directly from US government officials to US news outlets. There is typically a middle layer that is outside of the US where the allegations can originate from until they are broadly accepted as fact. So Apple and Google are not really lying. Chances are there has not been any sort of major security breach in either of those companies due to supply chain attacks. It is possible that they have been barred from revealing information about it for national security reasons (in this case propaganda reasons). So I think we can expect the following next steps: - The story will continue to hover in this slow reveal format until enough laypeople come to understand the key concepts -- circuit assembly, components, trojan horse components, QC processes, subcontractors, etc. Once the stage has been set there will be more revelations and leaks from major companies that corroborate the story. The goal is to make China the crisis in the buildup to the 2020 election. It's not a coincidence that this strategy is getting underway right after the midterm elections in the US. Our president has already been attacking China with rhetoric and trade sanctions, and this story is meant to turn public opinion broadly against China. The supply chain attacks do not have to have been significant (or successful) to make this happen. The very idea that "sneaky" Chinese intelligence agencies and firms would be able to slip this by US firms' quality control measures is enough to inflict paranoia on Americans and help them start to view China as a terrifying adversary that must be stopped. China's military outnumbers the US military by 20:1 in terms of the number of active duty fighters, and China's economy is approaching first world standards in major cities far faster than the US had ever expected. China dominates scientific publications in the hard sciences, and its top universities are 10x more competitive (or more) than top US universities. So hawks in the US realize that this may be the last opportunity for some sort of power projection or military driven containment of China's ambitions. This is foolhardy, because China is led by a group of highly rational people whose policy responses to the administration's trade threats have been masterful and precise, and have conveyed with no uncertainty that China will not be bullied. So what we're seeing is a short time horizon strategy by the US which is meant to have electoral consequences in 2020 and pave the way for some degree of hostile escalation with China. US weapons systems are still significantly more advanced, but China has likely weaponized many aspects of US infrastructure via these sorts of supply chain attacks. My guess is that the US Government is not aware of many of these, and will panic when they are discovered. Fortunately for us all, China's leadership is calm and not prone to knee-jerk responses. China is rising to world prominence faster than expected, and the US will not take that lying down. However it is probably too late at this point, as China has a tremendous amount of soft power stemming from its importance to the US supply chain. Because of this there is still much hope for a peaceful, trade-driven equilibrium to emerge.

WillPostForFood 8y ago

or 3) Bloomberg is vaguely correct, but wrong in the specifics, including naming Apple and Amazon. I.e., They get credible reports of SuperMicro servers having been compromised, they know that Apple and Amazon are customers. They find 1 over eager source willing to say Apple and or Amazon received compromised servers.

AJ007 8y ago

Taking the writer's statements as truth, 6 out of 17 sources for the original Bloomberg story were government. Presuming the information was classified, each one of those individuals is risking losing their job and going to prison for talking about it. What kind of conclusions the writers made from talking to the other 11 sources, what seniority they had, or even what companies they were from besides 3 from Apple, are anyone's guess. I always am suspect when a government official or employee releases classified information. In some cases extreme moral outrage seems very plausible (Manning, Snowden.) The information is so startling the leaker decides they can handle spending much of the rest of their life in prison. In a much larger number of cases it is for political reasons (Libby, countless other stories where the source is never identified.) Many times, however, I suspect, the information is made up and then no laws have been broken, as far as I understand it.