But according to the article: "This latest report suggests that any Linux variation would not meet the standards of the secure by design brief from the ISILG."
Simply downloading Debian from a valid mirror isn't the same.
Red Flag was made mandatory in a lot of public access points like cyber-cafes.