>In the words of one of the former officials, the CIA had “fucked up the firewall” between the two systems.
If you read between the lines, this raises the suspicion that there's a common underlying infrastructure which handles the communications, with management front-ends for different users which are firewalled off from each other, and the security of the system relied upon the firewall between the different front-ends to prevent users from finding out about each other. However, an attacker who compromised the "less secure" front end, could use that as a launching pad to attack the underlying communication infrastructure, and if the attacker pwned the infrastructure, then he'd have a back entrance to the "more secure" front end.
If that's the case, then somebody was grossly incompetent, depending on the age of the system: if the system is old enough, then somebody running ops in the CIA is incompetent, for continuing to operate a system whose security model ("all you need is a strong enough firewall!") was obsolete; if the system is young enough, then either the original architects, or the security engineers who certified the architecture (if there were any), for proposing an architecture with an obsolete security model.
Arguably, that incompetence amounts to criminal negligence, since it resulted in the deaths of US agents, and somebody should be tried for it.