While Intel is working with the big brands to patch the major security holes recently discovered in its Management Engine firmware, System76 plans to take it all to the next level by disabling IME entirely via a firmware update.
https://www.notebookcheck.net/System76-to-disable-Intel-Management-Engine-on-its-notebooks.267696.0.html