Does he know this himself independently, or is he answering based on the common knowledge of this?

I suspect it's the latter because he would have no reason to have anything to do with stuxnet, and I doubt the security is that bad that any employee anywhere can find out everything about every program.