No, it literally cannot be both, full stop. There should rigorous, well defined procedures and processes for handling classified data, and chiefly among those should be something along the lines of “don’t upload classified documents to a publicly-available internet-connected location/service/filestore/etc”. If it’s not, a security officer has not done their job.
It could be both. In the absence of more data, I’m reserving my judgement.
No, it literally cannot be both, full stop. There should rigorous, well defined procedures and processes for handling classified data, and chiefly among those should be something along the lines of “don’t upload classified documents to a publicly-available internet-connected location/service/filestore/etc”. If it’s not, a security officer has not done their job.