There are some systemic issues at play -- issues not related to this particular person or incident -- that you raise. You say that the best course of action is

There are some systemic issues at play -- issues not related to this particular person or incident -- that you raise. You say that the best course of action is not to say anything. If this is true, and I believe it is, what would be the point of having an Inspector General? I think that working in a government agency would come with some sort of requirement that you cooperate with those people in the agency who are there to make it better. If not? What are you there for? If the server and its file systems were vulnerable, that's a problem. But, still, we have to ask "compared to what?" I believe now you are saying that each political person (?) who joins an agency should make their own private decision about network security and take action appropriately. Perhaps this is true, but only in extreme cases? I'm not sure. I don't think this is anywhere near an extreme case. Political appointees should be agents of change, yes. I think we agree on that. But to be an agent of change, it requires you to, well, change something. In every case I've ever seen where a large organization changes, some people were let go, disciplined, demoted. It's just a rule of large numbers of people that the older and worse the org is, the more of a shakeup there has to be. Federal agencies don't run like that. You could take any of a dozen different scandals over the last couple of decades -- for the most part, nobody got fired. So what really happens is that the higher ups in an agency really run it, the political folks are there to provide political cover, and a collusion forms between lifelong bureaucrats and the political appointees. As a member of one federal agency told me, the first rule is that we never appear in the press. Political systems exist for political reasons. I'm not sure what the correct course of action here should have been. I know, however, that it's extremely difficult to set an example for employees if you disregard the rules you don't like. I also know that employees have a lot more say in what an organization is like than management. This is not a good situation for any organization to be in.