Why would a representative of a US government agency use a Russian VPN with legitimate, freshly created login credentials? I'm confident this is against all the cybersecurity rules in place.

I also don't understand why the HN comment section is full of people trying to make excuses or explanations.