In part, this is incompetence or collusion on the part of the State Department. If he was fired, how did he visit his former office. Why wasn’t his ID and access immediately terminated?
That’s how it’s done at my firm and we are just engineers