No, that wasn't my point. I've got my quals/creds in my resume, online in various job search engines, in LinkedIn exactly where I worked and what positions. I've been featured in a magazine for an award or 2, and even a couple of newspapers (gasp...I'm old!). I was known by my community (as fledgling as it was), and could be found in various groups that you can google (or my preferred - duckduckgo).
This dude isn't active anymore, and is working for a political campaign, so we can probably assume that he's not still a spook. But nothing of his cred is online, not a PME paper, not a twitter handle, not a FB, not a LinkedIn, not previous work, not where he currently works that would employ him as a cybersecurity expert...and want to highlight that. He apparently doesn't have his own company he's pushing either. He's cited as a cybersecurity expert, but he's not in any of the circles I can turn to in order to evaluate (not prove) expert.
I can't even find out when this dude retired, which would inform me if he was slinging bytes or simply signing paperwork approving the next "digital weapon buy" for random-three-letter-agency. His career-progression makes sense, as there's a lot of Army O's the crossed -- my exp has been mostly Artillery O's. But did he cross as a O5? He legit could have crossed as a O6. Would he be smart on cybersec, for sure. Would he be an expert...no. But, I don't know because we're unable to validate anything about him.
Look, this is exactly the same as you zipper-suited Sun-Gods bitching about rando general having 69hrs of flight time in a platform and not being qualified to speak on X in platform (Phoenix Program comes to mind).
Like everything else about the Trump campaign - lies, disinformation and utter failure at their mission.
//BREAK BREAK//
I actually just watched the video of the entire testimony from PA, and looked at spiderfoot. Here's a link to spiderfoot overview...it does not appear to do what he claims it does. That's as nicely as I can put it. Yes, their main webpage was connected to the internet on voting day, same as it is now.
I will also give him the benefit of the doubt that he's speaking, unsworn, to legislatures...but he called his people, for his unnamed company "white hat hackers." dude is sus.
Found his whole testimony here, he claims to have done the following in the last 1/2 of his career:
"info warfare as - psychological operations officer, information operations officer, doing computer network operations, electronic warfare and special electronic warfare, deception, counter-deception, OPSEC, and a couple other specialties." Simply...bullshit.
"One of our white hat hackers (sus) previously discovered malware that's present on 'the servers.'" - This is a crime. As an "expert" he should know you can't do that in our country without prior approval. Did they have approved access to get on those systems and evaluate them to discover that malware? Which servers, the webservers, the voting servers, development servers, update servers, etc?
"No audit trail." Except those paper ballots they hand over, and can you know...audit with.
Here's a guy on twitter breaking down the AZ testimony as the utter bullshit it is as well. You can check his quals in his twitter bio, like a real world expert.
EDIT - Found out he retired in 2017 as a Col. Assume 3 years for in rank retirement he pinned on in 2014. Looking at some dates, Cyber Mission Force achieved IOC in Oct 2016, and FOC (right before I was there) in 2018. USCC elevated in 2018. I'd put good money on this dude commanding a battalion/brigade that supplied operators that actually did everything he claimed to do to USCC/3LA and being a staffer that pushed to get the CMF stood up. That's it after listening to his testimony in PA.
To be clear, he claimed to do all the following jobs the last 1/2 (15 yrs) of his career - 29A MOS, 35G MOS, 30A MOS, 37A MOS, plus whatever job deception/counter-deception are rolled into. Overall, AF Intel manages their officer (and some enlisted) career paths extremely carefully to build expertise within certain areas, build credibility and ensure people have accesses throughout. We hated it as cyber guys for 2 reasons - fucked us for opportunities, fucked us for employing their people the way we wanted. They were especially stringent at O4 and up. My (limited) experience was the same for the Army (outside GO ranks...because they'll put a Infantry officer anywhere they fucking want in command). So...simply, no.
TL;DR - This dude was minimum exaggerating his experience, and not credible about what he was briefing.