Then either he’s bypassing existing controls, or proxy-ing once outside the fedgov firewall, or the controls don’t exist at his facility.
Any or all of those things are possible. I can't say any more.