Regarding both cases:

https://en.wikipedia.org/wiki/Gag_order

I wonder how legit it would be for an US company to set up an internal gag order? Running on compromised hardware is practically a nuclear meltdown (pun intended) and publicly admitting to it as well.

The trick seems to be having sufficiently uninformed people in all positions that might get to write that kind of response. No need to feign ignorance when you can have the real thing.

At least in the case of Amazon, the denial is published under the name of the CISO, Steve Schmidt, who previously worked for the FBI for a decade.

https://aws.amazon.com/blogs/security/setting-the-record-str...

Not saying he's not lying but it definitely raises the stakes.

Qualification is no hindrance to being or of the loop though, deliberately or not. It just makes it more embarrassing. Ignorance itself is still easily attainable, just "shoot the messenger" (this will make you seem tough and thorough to your higher ups) a few times when bad internal news escalate to your level and you will remain in blissful ignorance for the rest of your tenure.

The event was probably classified as a national security incident which would compel the affected parties to not disclose the event.

How does that actually work? How far down the chain of related facts to the national security incident are parties allowed/required to lie? If facts can be used to triangulate the secret, that can't be disclosed, right? Are incidents like this like a little fact-bomb which can be used to legally hide other institutional facts under its cover?

I assume it’s like national security letter. Only people in the company that has knowledge would be the ceo, general counsel, and people working directly to mitigate the issue. PR and corporate communication wouldn’t have any knowledge on the incident. I wonder how you collect insurance for these types of incidents if you can’t disclose them.

There most likely are classified legal constructs that compel speech. You see that with the PRISM denials by Apple and Google.

s/legal/extralegal/

"Secret law" is an oxymoron.

I mean what are they gonna say? "Yes, we have been aware that an unknown but possibly huge number of our servers have been compromised, but decided to keep our customers in the dark"?

Your point being ?

I think the point is that actual honesty from these megacorps would be so surprising that even raising the possibility of it happening is so absurd it feels like parody writing.

Last week Facebook was reasonably transparent about a hack affecting tens of millions of users.

This may be the first time in the history of the internet a statement from Facebook has ever been held up as an example of honesty and transparency from a corporation in America.

The GDPR has already called out Facebook for lack of info in its response to the breach: https://www.cnbc.com/2018/10/02/facebooks-muddy-account-brea...

Not sure why you'd pick that example.

Mostly because I believe that, while it's important to maintain healthy skepticism around privacy and security issues, I also believe that we don't benefit from cynical hyperbole.

That's because they have been under tremendous scrutiny recently.

The Snowden leak confirmed Apple's statement. It showed that Apple worked with the FBI on a system to process court ordered user data requests. Apple would obviously have no knowledge of the code name of a downstream NSA system that processed that data.

Weren't they uner a gag order? Even if not that's a risky thing to acknowledge.