I want more details about that, too. That could be a reckless cowboy but I’ve also seen cases where people routinely bypass the official process because it doesn’t handle all of the work they need to do, or is slow/unreliable in ways incompatible with the volume of work, etc.

It does suggest a big lapse in oversight: if this wasn’t the first time they did this, their security monitoring should have picked it up.

My guess is that this is going to be one of those situations where someone broke the rules in a way their immediate management knew about but sanctioned because the official process was dysfunctional. In those cases it’s really common to crucify the operator and ignore the larger problem.