The US protesteth too much
Whilst an argument can be made that the guy should pay for the cost of fixing any damage he caused to systems, the cost of "putting things completely right" is something that should be born by the organisation.
Its a cost they should have incurred before the incident, and should be incurring on an ongoing basis in any event; NASA is a organisation which has information of economic and military value and its only reasonable to expect the information on its systems to be kept secure.
I'd suspect a charge of about $20,000 would be much more appropriate to conduct an audit of the affected systems and repair any damage caused. $200k is one nought too many and the US claim is two zeros too many.