Intel warned Chinese tech firms of security flaws before telling U.S. government

Intel warned certain customers, including Chinese tech firms, of the Spectre and Meltdown security flaws before notifying the United States government, the Wall Street Journal reported. The flaws were first discovered by Google’s Project Zero team in June 2017. Intel held off on disclosing the issue while it worked on possible fixes. The company planned to make the announcement on January 9, but The Register broke the story on January 2. Intel then confirmed the news the next day.

Intel did notify several major tech firms in an effort to limit the potential damage and help work on fixes. A representative from the Department of Homeland Security said that the department did not learn of the flaws until the news was broken, however. Homeland Security is often notified of such issues before the public, and often acts as a source of guidance for how to address them.

In response to questions from Rep. Greg Walden (R-Ore.), Intel has since revealed the reason it didn’t disclose the flaws to government agencies and officials. It claimed that since there was “no indication that any of these vulnerabilities had been exploited by malicious actors,” it didn’t see the need, according to Reuters. It also revealed that it didn’t think the flaw would be capable of harming critical infrastructure because it didn’t believe it could affect industrial control systems.

Alphabet, a department of which discovered the Meltdown and Spectre flaws, had extended its typical 90-day grace period before revealing the bug to the public twice, to January 3 and then January 9.

The NSA was one of those agencies left in the dark about the problem. Rob Joyce, the White House’s top official on matters of cybersecurity, sent out a tweet saying that the NSA was unaware of the vulnerabilities.

Jake-No nuance to my answer. No lawyerly caveats. NSA did not know about these flaws, nor did they exploit them. I don’t put my good name on the line lightly. I understand you are disinclined to believe, 1/2.

— Rob Joyce (@RobJoyce45) January 13, 2018

Intel refused to name any of the companies it warned prior to the scheduled January 9 announcement, though several of the companies had been identified, including Microsoft, Amazon, Chinese computer manufacturer Lenovo, and Chinese cloud-computing firm Alibaba Group Holding. A representative from Intel said that it had planned to brief others, including the U.S. government, prior to the January 9 announcement, but the company said that it was unable to do so because the story was reported sooner than expected.

Recent correspondence to representatives from Microsoft stated that it did inform several antivirus makers about the flaws a number of weeks before the public reveal.

Jake Williams, a former employee of the National Security Agency and current president of Rendition Infosec LLC, told the Wall Street Journal that the Spectre and Meltdown vulnerabilities would have been of great interest to any intelligence organization.

Williams also warned that it is a “near certainty” that the Chinese government was aware of Spectre and Meltdown before the U.S., given that the Communist Party closely monitors such communications.

Representatives from the Chinese government did not comment on this story. In the past, however, the country’s foreign ministry has said that it is “resolutely opposed” to all forms of hacking.

Updated on February 23: Updated information on Intel revelations.