Imagine someone got the password to your Facebook account. They have no access to your PC whatsoever. They didn't hack into your computer and they have no access to your files or banking information, they just have access to post things on your Facebook. Same thing here, the CIA public facing website is not on the CIA network, it's an external service.