Just having security clearance doesn't mean that he absolutely didn't necessarily do any 'hacking' to get the data - he may well not have had direct access to the data in question, clearance or not.