@Dan
All that you say is very reasonable, and yet ...
Legislative controls are only going to be as good as the implementation and oversight of controls. In this case, it appears the AFP simply were not aware of their employee's previous and current relations with foreign nationals, multiple citizenships, previous employment with the armed forces of a foreign power, etc, etc. Given that he was previously employed in the counter-terrorism part of the AFP, this appears (to my simple mind) to be a complete failure of the security clearance process, to the point where I am doubtful that he indeed had any sort of clearance, and simply should not have been allowed access to any sort of sensitive data.
Biting the hand that feeds IT
