I see two possibilities, though I am not that well-versed in the software used at the NSA: 1. Administrator accounts were not confined (in the SELinux sense),

I see two possibilities, though I am not that well-versed in the software used at the NSA: 1. Administrator accounts were not confined (in the SELinux sense), so he was able to transition to whatever security context he needed/wanted. 2. He was able to set up the login credentials for other users. He could have created his own accounts with higher-level clearances, or set up his own smartcard for logging in to some other person's account, etc. It may seem like poor design, but it is understandable why things might have been set up like that. In the first case, it is because the admins need to be able to solve problems that happen in a variety of security contexts / levels, and the overhead of defining a second set of policies governing the admins was just too high. In the second, it would be because someone has to be able to set up credentials and that there are a lot of systems for which credentials must be set up, making it hard to impose restrictions. There is also the matter of audit logs -- it might not be so bad to allow an admin to transition to whatever security level if each transition is logged. I suspect that much of the NSA's computer security is devoted to ensuring that people do not accidentally leak classified information, and that preventing insider attacks is done at a higher level (the clearance process, random audits, etc.).