Comment: Sophos reaction to VTC test report

Comment on Sophos´ reaction to VTC test report August 2000:

In VTC test report "2000-08", the author had to report that Sophos AntiVirus (a participant in previous tests) could not be included due to the following reason:

Quoting from VTC test report (see Executive Summary:)

Also excluded from VTC tests (since "2000-08"): Sweep = Sophos AntiVirus

Reason

After VTC´s publication, Sophos published a reaction on their website (dated October 11,2000) which deserves some corrections:

1) Before the respective VTC test started (products had to be submitted until May 31, 2000), Sophos CEO Dr. Jan Hruska has been asked NOT TO SUBMIT Sophos AntiVirus for the test. Dr. Hruska replied that he would advise his employees not to submit the product but that he regarded this request as "exclusion" from the test, rather than non-submission. In fair respect for Dr. Hruska´s statement, HIS term "excluded" was used although this is formally not correct.
2) The request for "non-submission" was unavoidable when VTC test supervisor was informed that some Sophos representative had threatened a representative of another AV company which was unwilling to join REVS, to DENOUNCE that company of not being willing to protect their customers. As a university laboratory with special focus on education of students for future legally and ethically guided professional behaviour, and with the understanding that such "undue pressure" if exerted in Germany may cause an investigation according to the German Criminal Code, the test supervisor found it adequate to ask Sophos for non-submission.
3) It is NOT true that Sophos AV was asked for non-submission because of their participation in REVS. The reason (as also communicated to a fromer Sophos employee early in June) was indeed the "undue pressure" as described above.
4) Concerning REVS which Sophos regards as a "reputable initiative", it should be mentioned that several AV companies which participate in REVS have grossly misinformed the community at several occasions about threats which after due analysis only demonstrated the technical incompetence of the respective AV personnel, or - possibly even worse - which demonstrates the fact that related "warnings" were guided solely by marketing interests.

The author finds it difficult to regard an initiative as "reputable" where such hardly "reputable" companies can participate. BUT: VTC has NO problem in inviting AV companies to participate in VTC tests IFF they dont behave illegally or unethically.
5) Moreover, it is worthwhile to understand that Sophos is much more than a "normal" REVS member. Among other facts (regarding the genesis of REVS):
- Sophos runs the REVS server in their computer lab and therefore has in principle prime access to the hardware, and
- present or former Sophos employees defend REVS at related conferences.
6) The author of VTC test reports was deliberately vague in describing the reason for non-admission (aka exclusion) as "undue pressure" as Sophos is not just an AV company:
- the technical Virus magazine "Virus Bulletin" is co-owned by Dr. Jan Hruska, who is also co-owner of Sophos
- Virus Bulletin holds annual conferences, the content and speakers of which are not selected by an independent body (e.g. a Program Committee which selects papers and invited speakers)
Consequently, Virus Bulletin can hardly be compared to a really independent magazine such as "Secure Computing" (also of UK).

In this situation, the author of the test report found it reasonable to protect the integrity of his informant. This - and nothing else - was the reason for the deliberately vague description.
7) Sophos writes in the related statement:
This statement is PLAINLY WRONG. There was some discussion on an electronic forum in which the report author participated for some time (he left the forum when personal insultations of some Sophos employee reached a level that he felt personally untolerable). BUT there was NEVER ANY PRIVATE EMAIL FROM ANY SOPHOS EMPLOYEE to Dr. Brunnstein.
8) It is worthwhile to state that neither the VTC test team nor the test supervisor and author of VTC test reports has any "hostile attitude" against Sophos. It was Sophos activity which forced the supervisor (who does not only write about and teach Ethics and legal aspects) to react in the way as described.
9) Finally, it should be noted that Sophos was also "not invited" for participating in VTCs first in-depth "AntiVirus Repair Test ART2000B" (published November 19, 2000: see ftp://agn-www.informatik.uni-hamburg.de/pub/texts/tests/pc-av/2000-11/ ).

In summarizing, Sophos statement - although understandable to protect their business interests - fails to clarify the issue adequately. As there is no evidence for insight on Sophos´ side, they will also not be invited to participate in the forthcoming VTC test.