Right...on...the...money.
Is it possible the disparity between the two databases has something more to do with the “unmasking” and less to do with auditing?
Exactly. The CIA has always played loose with administrative control (ADCON) and therefore won’t have an administrative trail. That’s where all the “don’t knows” come into play. Normal agencies, including NSA, maintain strict ADCON—forms and signatures for every action. State and CIA regularly play games, feign incompetence, and lie about technical issues.
The “unmasking” was an administrative action performed in an uncontrolled environment. That, in itself, is criminal—especially dealing with HUMINT. HUMINT requires the highest levels of ADCON and OPSEC. Casefiles are not accessible to even system administrators and DBAs. It’s classified and encrypted cradle-to-grave and only disseminated on a need-to-know basis.
The fact that the raw information was disclosed for the unmasking proved intent. The entire scenario shows a blatant disregard for not just procedure, but federal law. Just like Clinton having SAP material in a nonsecure environment. There is no requirement beyond fact. Such acts are criminal without further inquiry.
There is no legal mechanism to account for such breaches of trust—as anyone with a clearance will tell you. Literally tens to hundreds should be in jail, and there remains a technical trail that can prove the facts. People just don’t have the technical understanding, nor the patience or will to follow it.