Those aren't my words that I put above but it sounds like the red team is basically employed by the company which in this case it would be the state to verify that their website is secure. It would essentially be a security test so I don't think it would be illegal since it's a security measure to prevent future risks. My company goes through something like this once a year to see if we are up to date on our security.

It sounds like the secretary of state was the one who leaked the password and not the clerk. I don't believe the clerk ever had it but I could be incorrect. It's as if the secretary of state is either framing her for her own crimes or simply trying to imprison her opposition. The clerk even said that she was not hiring certain democrats that the secretary of state was telling her to pick.