Date: Fri, 16 Oct 2026 To: "Spitzner, Lance" Cc: investigativ@spiegel.de, Juhan.Lepassaar@enisa.europa.eu, juhan.lepassaar@gmail.com Subject: Re:Request for Lance Spitzner SANS.org, about Failing Security Policies . Interesting.. So you are saying that the advice that SANS is dishing out to govt and other org's around the world, is Not within your responsibility to care about if it is functional ..or Not.. ~> even misleading. And also don't care if SANS's own security policy is functional or Not really; ~ Like for instance.. that there are several people working at SANS who get sensitive/secret/NDA information from high-risk clients, which they actively 'share' with criminals who use it to gain access or manipulate situations. ~ Like for instance.. that various SANS people are ignoring various security rules stated in SANS's own advice and courses. Like creating data-leaks with sensitive Internal information via 'hidden' meta-data which isn't filtered/removed before files go to the outside world. ~ Like for instance.. some SANS ICT people also blatantly ignoring various common sense security rules and policies, by Not implementing a few specific basic 'secure by design' security measures ..but instead going the lazy path and just use IT systems connected/accessible to/from public internet with lacking security measures and some which are notoriously known for their bad reputation due to endless CVE's => www.sans.org/information-security-policy/access-management-policy => www.sans.org/cyber-security-courses/strategic-security-planning-policy-leadership => www.sans.org/reading%255Froom/ Lance, You told me a long time ago about your time in the Army, and what it did to your state of mind. Is the "neither my expertise nor passion" a long term effect of that ? That you don't even care to ask some other 'leader' at SANS to see if he/she could Learn something about "How" to fix a very serious _Core structure_ security issue which leads to so many major security incidents [which can be prevented, ..if.. people like you would "Care".. instead of playing ostrich-politics while getting paid for Ivory Tower functions ]:( *george [Security issues partly caused by SANS.org bureaucrats not caring to give functional Safeguard advice :( * www.sqcic.org/Pages/nato.html * www.sqcic.org/Pages/corruption-espionage-sabotage.html * www.sqcic.org/Pages/the-international-criminal-court.html * etc.. -- On Wed, 14 Oct 2026 11:51:37 +0000 "Spitzner, Lance" wrote: > Appreciate the kind invite, but I???ll have to pass as policies are neither my expertise nor passion. However best of luck with the project! > > Thanks! > > Lance Spitzner > Technical Director > Workforce Cybersecurity Training > > On Oct 13, 2026, SQCIC wrote: > > > > External email warning - This email originated outside the company. Please do not click links or open attachments unless you were expecting this communication. - SANS Security Team - > > > > Hi Lance, > > > > That is correct, of course ;) > > > > And.. ? do you care to have a frank dialog about "why" the standard national and > > international "security policies" are all failing to provide a functional protection > > structure. {So many years of newspaper headlines about major security failures at the top > > high-risk organisations which should not even be possible to happen If the security > > policies/standards where functional.., aught to be enough evidence itself on would > > think..} > > ~> All those security policies/standards have the same (copy-paste) base structure, and > > thus all have the same gap/blind-spot, it seems when looking at the long term research > > outcome. > > > > Interested to know if you are willing to discuss the situation, and see if we can move > > forward to resolve it by first highlighting whats missing and at the same time fixing the > > structure to facilitate a pragmatic functional Safeguard structure. > > > > > > *george > > --- > > On Mon, 12 Oct 2026 13:19:41 +0000 > > "Spitzner, Lance" wrote > >> Hi, you reached out to SANS support in an effort to reach me? > >> > >> Thanks! > >> > >> Lance Spitzner > >> Technical Director > >> Workforce Cybersecurity Training > > ----- > >> Hi Lance, > >> > >> We've met many years ago at CanSecWest, also had a chat afterwards in a Pub together > >> with Fyodor about critical infra protection. > >> > >> Would you care to have a dialog about "Why" the current mainstream 'security' policies > >> are all clearly dysfunctional (incl SANS methods), due to a blind spot in all of them, > >> and more importantly about "How" to fix that fundamental Sec Catch-22 issue, with a > >> very pragmatic "Safeguard" method. > >> > >> Background info can be found at: > >> > > SQCIC.org > >> & > >> > > Tiwasburg.info > >> > >> Kind regards, > >> *george (CSO & Researcher) > >> > >