Cases of plagiarism by cyber security certification company EC-Council have been documented for over a decade. As I wrote previously, I personally was one of many victims of this behavior recently. On June 27, 2021, I was contacted by email by the CEO of EC-Council, Jay Bavisi, to inform me that they had released a statement regarding the issue.
On the surface, the statement appears genuine and direct. However, I knew after sitting with it for some time I’d start to see the issues more clearly. So while I immediately shared it on social media, I did not offer any reaction. I’m ready now to openly share my thoughts on this statement.
A Lengthy Response
The statement from EC-Council is long and clearly took some considerable thought to assemble. It touches on some points of accountability and offers some transparency into how EC-Council plans to address the situation. So I’m going to go point by point, offering my reactions to each here.
Their explanation
In these first couple paragraphs, Mr. Bavisi attempts to address the silence from his organization. Remember this statement came a full week after I first reported the plagiarism. While I’m glad they addressed this issue, why it took a week to investigate and admit wrong-doing is a mystery. Clearly crisis communications are not EC-Council’s strong suit. Still, I’m glad to see he came prepared to face the music. Let’s see what they’ve learned.
What they learned
OK, this looks like a good start. This is the first time in the week since my report that EC-Council has used the words “plagiarism” and “sorry”. They go on to loosely explain it as a series of missteps. This is a bit of minimization considering these accusations can be found dating back to 2011. However, nice to see ECC finally admit culpability.
The second bullet and things are getting shady already. In their previous statement, ECC claimed their blogs were checked for plagiarism by “industry accepted software.” However, now they contradict that. Alright, so gaps happen. However, it’s the rest of this point that’s troublesome to me. Bavisi attempts to distance this situation from their certification and course content. Of course he does, because those are the primary sources of ECC’s revenue. They are the crown jewels and this situation has undermined their credibility in the market.
The problem is, there is a high profile case of plagiarism in ECC’s exam questions documented on the internet as well. So this becomes a divide and conquer maneuver. Bavisi is already attempting to treat this as a one-off event rather than consider the bigger picture of the culture at his organization.
Whatchya gonna do about it Jay?
Um so what does this mean you take full responsibility? You’re the CEO, of course you do whether you like it or not. But this is a meaningless platitude if not met with action. Maybe your following bullets will help explain it more. The unreserved apology is nice, the second time contrition has been presented without caveat. That’s a far better response than the first statement you released.
This is an interesting response. In most organizations, blogs such as ECC’s which serve a very specific purpose fall under marketing. It’s called content marketing for a reason. Your blog is setup to offer free materials in order to market your products. So could this be a shift in how ECC plans to leverage their blog? I’ll be staying tuned as that could be something potentially, dare I say, innovative?
This sounds like a great idea. Bring in people who are technical experts to create original content that is high-quality and of value to the community. I think Jay actually read my previous blog and is taking my suggestion on this. Value contribution is a principle I called for them to apply and this sounds like they’re moving in that direction. Well done!!
Any of my skilled writer friends need a job? I know someone who’s hiring. In all seriousness though, this is a good move and a good investment. Time to bring in someone that knows what they’re doing. Someone connected with the industry and with journalistic practices would be a big improvement.
I’m tackling these two together because they seem to go together and express pretty much the same thing I got from the previous two points. These are good moves. An advisory board, and hiring subject matter experts. In the past ECC has relied on free contributions from whoever they could get to provide them with such content. That’s not a recipe for getting the best and brightest. Pay people for their knowledge. That’s how you get quality work!
Yes you should be hiring across a diverse set of candidates. Your writing pool should represent the same diversity that is in the community you serve. Thinking this is a callback to the situation in April.
A Vlog is an interesting approach. However, Jay, be aware that this will not “ensure that plagiarism won’t happen again”. It is possible to plagiarize via spoken word as well. However, it is also harder to find. So, I truly hope that you don’t think just because it’s live or recorded content being spoken on video means that it can’t be plagiarized material. Tread lightly on this one.
I’m not sure what this is asking. Jay, are you asking for all currently identified victims of the plagiarism to contact you at this email? Are you offering compensation or something similar for the works your organization stole and profited from? Or are you looking for further victims to make themselves known? If the latter, I’d say with how trivial it was for us to find additional plagiarized content, perhaps your team should be doing that work. Especially now that the blog is offline so searching it requires use of the WayBack Machine.
Oh cool, the rest of EC-Council too? So does that mean you’re making improvements in exam question authoring as well? You need to come through on this promise. I’m sure your missteps so far this year have had an impact on your bottom line. Don’t want anymore of that.
Well, um, what? Jay, I thought you were taking full responsibility? Also, how senior was this marketing executive if they weren’t even listed on the executive team page on your website? This one bothers me. Not that there wasn’t good reason for this person to resign. However, it screams of scapegoat-ism. It ignores that the problem goes higher. Given how long this has been going on and the number of issues (not just plagiarism) at play, clearly there is a cultural shift needed. What is the rest of your executive team doing to make real change happen Jay?
Wrapping things up
So the conclusion begins with another apology and Jay again saying he takes full responsibility. Still wondering about that executive marketing leader. Then he announces the upcoming release of their diversity report that they committed to back in April/May. Clearly he wants us all to know ECC is trying to get better. Fair.
The third paragraph is wonderful but perhaps should have appeared early in this statement. Jay actually acknowledging (I believe for the first time ever) that there has been a lengthy history of this behavior from ECC. That’s important because, as I’m sure Jay with his law degree knows, this puts him legally on the hook now. If things don’t get better after this, he has no plausible deniability.
The next statement is nice if it isn’t platitude. Jay reaching out to the community for their thoughts on what ECC can do to get better. Yes, that’s a great invitation, but I hope there’s some substance behind that. I also hope this isn’t a lazy attempt at finding your issues without doing the hard work of introspection. Interacting with and hearing from your community is important, so maybe a good step? We’ll see.
The verdict
Well as I said when I shared this on social media, some good info and some problematic statements. I’m not convinced at this point. Given ECC’s history of this kind of behavior they’ve got a long road to travel. From the responses I’ve seen privately and publicly on social media, it seems much of the industry feels the same way.
I don’t wish for the failure of EC-Council. I don’t think that would be good for our community in long run. However, my opinion could be changed if EC-Council themselves continue to cause damage like this. So for me for now, I’ll be keeping them at arm’s length. They need to show me they’re actually changing. That they’ve learned it’s ok to make profits but that those profits should come from building up the security community not draining from it.
