I wonder how much the author was involved with actual tests. My guess is that it was exactly zero. I was heading the team overseeing these tests for a large we

I wonder how much the author was involved with actual tests. My guess is that it was exactly zero. I was heading the team overseeing these tests for a large western European company. The reviews are done on the customer's company computers, with no access to network. After that the Russians only get a hash of the binary compiled with the reviewed code, that's all. They then compare this hash to the sw they get (on firmware for instance) to make sure that it comes from the code they reviewed. I am paranoid but this is a very reasonable requirement we do not, unfortunately, normally have in Europe for "friendly" software coming from "friend" US companies (and probably vice versa but I do not care that way). Snowden proved that the BFF approach does not work.