Confirming or denying, or stating the (in)ability to talk about it is a breach of the requirement to keep the information classified. The proper response is 'we do not know what you're talking about'. Which is what they said. It can't be conflated with something stupid like 'cannot confirm or deny' which tells you right away.