If SAPO let this happen, after they advised her. Then thats on SAPO.

But then, there is perhaps something she is not telling them. Because to implement this AFTER your main intel service says its not a good idea or legal, is kind of ...odd isnt it?