Any government has national defense responsabilities. With your logic, Intel is a multinational company and should have informed them all, which leads to its own kind of problems.

Edit: The only reasonable path seems to inform every government simultaneously, at the same time as the public. How could the EU possibly let Intel sell CPUs, and let Intel inform other governments of vulnerabilities first? So that the other governments have a time window to play with the vulnerability against the EU?

I guess people were expecting them to have a higher level of loyalty to their home country.

That gives China a strong case to distrust Intel and use their own chips. It is not like they are not already doing that, but I guess Intel might not really want to add momentum to this process.

Only if you think there is some sort of moral equivalence between the governments.

There is a practical equivalence between governments. If one government could make the case that they should be informed, then any government who bought systems with "Intel Inside" could make the same argument. If you want to split governments into groups based on some notion of morality then you may want to question why a company would be allowed to do business with a country on the wrong side of that morality in the first place. That's actually a discussion I'd like to see.

Practically speaking, providing an exploit to the Russian government vs the US government - that would be a different effect, no? How would you justify providing the exploit to the North Koreans, or the Iranians?

There is a very practical morality at play here. The Chinese government runs protesters over with tanks, imprisons people without cause, attacks their neighbors without cause, etc. Would it be a good thing to aid such a government?

Putting all governments on the same moral plane is counterproductive and nonsensical. Not providing important information to your own government so that they can secure the very systems that protect you - that doesn't seem very practical.

> The Chinese government runs protesters over with tanks, imprisons people without cause, attacks their neighbors without cause, etc.

Oh come on, you're making it too easy!

It's not about moral its about sales, if Intel were to start to tell the US gov directly about security loopholes in products they were still selling to other nations those nations would blacklist intel for life.

Just as the US would blacklist intel if they told another nation directly first. (this is even true if they told allied nations) we have seen that just being allies does not stop the US spying (and I'm sure does not stop the opposite as well just turns out the others might be better at keeping things hush hush)

Is there not?

If it was beneficial from a commercial point of view to first disclose to partners outside of the US this makes sense. Intel doesn't exist to serve US national defense responsibilities; they exist to make money.

I firmly believe that, if the NSA, CIA, and possibly the FBI found out about this exploit, and found out there would be a window of several months to exploit it, then these agencies would be a danger to the safety and security of the American people.

Therefore the patriotic and responsible thing would be to help vendors patch their stuff before directly disclosing the bug to any party that would be likely to abuse the exploit.

The NSA doesn't play ball and responsibly disclose exploits to vendors immediately after discovering and profiling them, expressly because they want to use the exploits, so why should vendors be obligated to do the reverse?

Most likely the NSA already knew, wouldn't they?

Because they aren't omniscient, and the signal to noise ratio is very low when considering the total amount of data they can montor.