Actually, they aren't. But they are allowed to attach removable drives, at least they were until recently, at least at this one base. The various databases, updates, etc. were provided by external HDs and even thumb drives. It is assumed that the virus was delivered by this path. The removable drives carried the virus' and installed them when they are connected to other devices. It's a feature in Windows called auto-run.
Similar to Safaris's Open "Safe" downloads function (Why that was ever created is beyond me, also).
I'm no expert, but it seems some kind of checksum value of the whole removable device could have detected when something 'extra' had been added. And all removables should have been attached to a non-networked device that could have checked for the correct value as well as scanned for other files (embedded or otherwise).
As I say, I'm no expert, I don't even play on TV but this sounds like pure, simple lack of security planning and execution.
