He is a SANS instructor, CEO of Dragos Inc and very well respected in the infosec community. Helpful input like this, and being an educator, is why he has that reputation.
But like, "let me confirm off hand on twitter what classified things we did or didn't do at the NSA", is exactly what you can't say. Why is he being allowed to confirm/deny specific actions of the NSA?
