If he wrote a tool that broke up the decompiled stuxnet binary into n-grams and did principal component analysis, then used a a boosting classifier to put it in

If he wrote a tool that broke up the decompiled stuxnet binary into n-grams and did principal component analysis, then used a a boosting classifier to put it in clusters of similarly machine-analysed code deemed by some group of experts to be "high," "medium," or "low" quality, that's an actual technical analysis. Its merits could be debatable, but it's technical. If all we know is that he wrote a tool that found the code to be of fairly low quality, he got up on stage in front of his peers and waved his hands.