It's always easier to blame contractors than to determine why and how. And Snowden talked about in his book that roughly 95% of the fed gov is contractors. Reason is that getting money is easy, but getting OMB approval for more hires is ridiculous.

These people had a public trust or a clearance. They've worked their way in the fed gov. I wouldn't immediately question malice or otherwise. You don't just throw away a career with sabotage.

Also having worked in a similar environment, I can guarantee you that although there may be a test env, it is nowhere near similar to prod. I've seen it myself with different firewall rules, different GPOs, different software hardening packages. And I also complained that there should be no distinctions between stage and prod - insomuch that DNS and SSL should be the only real differences.

I'm also acutely aware if my project has a similar incident, that I too would be scapegoated and fired. It's part of the course of this job.