If you don't trust people creating cryptography standards you cannot really leave gaps, can you?
Complex tasks like "set up a new computer" had months of lead time.
Maybe I've worked in large corporations too much, but my first question when I see policy violations is not "How is this person conspiring?" but rather "What made following the official policy difficult? And how can we fix that?"
Also, the State Dept seems like exactly the sort of place policy violations become culturally routine: non-technical experts, doing work that is arguably "more important", with IT seen as a cost rather than profit center.
Perfect storm for policy-in-name-only.
And it was in fact not, because there was no functioning policy enforcement at State.
I agree, the laws were not enforced in this case.
If you can't do your work for the public under public scrutiny, you shouldn't.
Anyway, interesting take that people working for the public should have no right to privacy in any way. Not sure you will find many people for such work, though.
Even innocently, if, for example, two employees meet at home for dinner with their respective families and there is talk about work - needs to be recorded in that view. Or people car sharing on the way to work - recorded. Any work related communication is very very broad.
And everything recorded open to the public, too.
You don't have privacy in what you do at work when it comes to your employer. That's why it's called privacy, it relates to private and personal things. Your work for someone else is, by definition, not private.
You don't get to push stuff into production and play coy about what you're pushing, do you? Why would that change when the employer is the public?
The solution can't possibly be not even knowing the difference between someone putting salt or toe nails into a pan -- but ensuring cooks don't talk to each other, so even though we have no clue what they're doing or should be doing, we magically know nothing bad is going on.