Aren’t these the same guys who want to communicate exclusively thorough non FOIA means and also have full unfettered access to the entire system? Security audits tend to lose their punch when there’s no proof of anything and the logs have been purged as part of the stuff that’s not “read only”