The government is unserious about this stuff in their own networks, this really sounds like somebody got a bee under their bonnet and is trying to make an example.

You need antivirus on security research laptops? How does that work exactly? I've worked .gov for decades and in many systems we don't put AV on them because we're working with things the AV will destroy while we work on them.

The facts will come out, GTRI has the money to fight this, and we'll see, but my general position when the gov starts talking about cyber security is they're probably full of shit.