....and windows 98.
There is a clue in that article as to why this sort of thing happens. "Ms. Bunk said that although many agencies did use the secure email system, The Federal Register could not require it until Congress made it compulsory by law."
There's the problem. Making a specific infrastructure compulsory by law means your law is obsolete instantly. Making the law specify generic 'security requirements' is the way to go, not naming technologies.
When I worked in SCCs Mainframe division, looking after the VAX/VMS, running batch jobs and BACS transfers etc, I was surprised to find a large trolley that looked like an oversized floppy drive - queried ops manager as to what that was - "oh, that. Yes. 8 inch floppy drive, for one of the banks. Still in use, believe it or not..". Made me smile, almost as much as loading the reel to reel tape drives with the vacuum tube loader. Bank again.
We backed everything up to tape, 4 huge autoloader DAT stacks and shelves upon shelves of securely stored tapes. Ah, memories of coming in at 7am to find one tape had gone squiff and stalled the entire loader/backup job..or spat it's contents into the mechanism. Oh yes.