That's definitely possible. But it's also possible he doesn't want to out his friend because he's a decent guy. You know we would all think this guy was a scumbag if he outed his friend/colleague at the NSA who would likely suffer for it.

Without hard evidence it's hard to believe him, you're right. But not naming his source doesn't effect his credibility negatively in my eyes. It's equally likely he's not naming his source because he's a nice person, as it is because there is no source.