The point is that he intentionally broke policy to set up a communications system which doesn’t meet federal security standards for sensitive information and al

The point is that he intentionally broke policy to set up a communications system which doesn’t meet federal security standards for sensitive information and also doesn’t comply with the rules for retaining records. Think of it like hiring a new bank manager who decides that they need to start storing the money in a second location with a combo lock only they have the password to. They say they’re not doing it to commit fraud but it’s unambiguously more vulnerable and, far more importantly, there’s absolutely no reason to do that except if you’re planning to do something illegal because the existing system works fine for everything they officially need to do.