Supposedly she got the server set up because the NSA refused to give a politician who travels frequently a secure smartphone. She (I personally believe) was likely ignorant of many of the security requirements of such a server (even one set up for unclassified e-mail), as was whoever set it up. And no-one on her staff either knew enough or was willing enough to say anything. She is also supposedly not the first Secretary of State to have an arrangement of this nature.
This feels like the very definition of systematic failure and clearly needs to change. But the conversation is almost exclusively based around a) her having nefarious motivations, because she is Hillary Clinton, or b) this all being a Republican plot to derail the Democratic candidate for President.
It's all very depressing.
Baloney. She was the second most powerful person in the US government. If she couldn't get them to provide modern secure communications, she had the ear of the one who could.
If it was as you say, and truly that systemic a problem, then indeed heads should politically roll - starting from the top, which means her.
Handling national secrets on a cheap generic PC in one's bathroom because a subordinate huge-budget agency won't cooperate is a sign of gross incompetence on many levels. If jail time is what it's going to take to motivate people to get this systemic problem solved, them so be it. The standards are obvious, and ominously violated to a dangerous degree.
She shouldn't have set up her own server. And the NSA should have been more sensitive to how important mobile email is to a modern diplomat.
http://www.politifact.com/truth-o-meter/statements/2016/mar/...
Politifact rates this idea mostly false.
Powell maintained his own email but without the server in his house, Rice claims she avoided all email, so we have exactly 0 secretaries of state who've handled email 'the right way' in 220-some-odd years of this fine country.
As someone who believes strongly in revitalizing self-hosting, I find focusing on Hillary's use of a personal mail server (and not on the fact that it was not an official e-mail account, full stop) to be unfairly marginalizing personal mail servers or personal servers in general. There's nothing wrong about running your own mail server. The problem is running your own mail server to give yourself a personal e-mail account to use in your job as Secretary of State. But the key part is using a personal e-mail account for your job that involves dealing with highly sensitive and classified materials—an action that would get most government employees fired if not imprisoned.
This wasn't just poor IT security, this was willful ignorance of the consequences of state secrets being in the open. It is incredibly likely she was targeted by foreign intelligence. And perhaps Russia found it useful that no one was talking about their impending invasion of Ukraine or Iran learned how desperate the administration was to cut a deal? There were a thousand ways this could have undercut US foreign policy, which has recently been disastrous (Like when Hillary hung up the phone on her Russian counterpart in 2012 when Russia was trying to negotiate a peaceful conclusion in Syria - according to the Wikileaks embassy cables).
To be clear, this was unclassified email. Classified email is on a separate network.
Certainly having access to the Secretary of State's unclassified emails could yield valuable intelligence insights but these are not emails that are going to contain "secrets" per se.
Doesn't seem to square with:
http://www.computerworld.com/article/3075347/government-it/s...
The NSA refused to give Clinton a device similar to the one used by Obama: a modified BlackBerry 8830 World Edition with additional cryptography installed. And while Clinton's predecessor Condaleeza Rice had obtained waivers for herself and her staff to use BlackBerry devices, Clinton's staff was told that "use [of the BlackBerry] expanded to an unmanageable number of users from a security perspective, so those waivers were phased out and BlackBerry use was not allowed in her Suite,"[1]
This being Clinton there are probably conspiracy theories (the NSA is out to get her!) but I suspect they simply didn't want to have to deal with it, and had the ability to say no. So they did.
[1] http://arstechnica.com/information-technology/2016/03/nsa-re...
That infrastructure simply isn't scaleable.
[Edit: See this HN comment for sources. https://news.ycombinator.com/item?id=11306380]
Unfortunately, the alternatives to her aren't that great either. I'm hedging my bets until November, hoping some sort of miracle happens. Hoping this election invokes the 12th amendment and goes to the house. I feel none of the current candidates would be eligible and we'd get a fresh start.
She didn't want the one they offered her, which was an older-style Windows Mobile phone. As the emails frequently note, she is not a "computer person", she knew how to work one kind of device for accessing email and refused to use anything different. They offered her a secure computer with a dedicated outside line even inside State, but her handlers thought she wouldn't even be able to deal with the concept of accessing her email on a PC rather than a Blackberry. I am not bashing Clinton here, I am just reading back the stuff from the emails that was on JudicialWatch.
What's "depressing" to me is that I have had to handle classified material in the past and there's zero doubt what would happen to me if I handled this shit like her and her staff did, but there's going to be zero material consequences for her. I kind of feel like there's two sets of law books, ones for peons like me, and ones for special people like her.
I have a very hard time believing that the 3rd (possibly 2nd) highest person in the US government couldn't get their IT requests fulfilled.
Careful with the phrasing - it has been said others have used "private e-mail" but that is, to me, not the same as setting up a server and using it exclusively.
Do you know anybody with their own home email server?
> It's all very depressing.
Not at all.
Because of this fiasco, every clown with political aspirations will be using an approved and encrypted system instead of rolling their own garbage.
It's not if you don't think about it. And given how it's not personal, that can be done.
That would have made it more difficult for the NSA to spy on her. I know this sounds cynical, but really, do you think the NSA doesn't spy on our government officials?
Re nefarious motivations. The server and its location weren't just used for diplomatic stuff. There are nefarious things going on. She worked hard to block any FOIA requests or supeonas that would enlighten us more. The mark of an honest politician or nonprofit. ;)
>Outlook Web Access, or OWA, was running on port 80 without SSL (unencrypted)
>Remote Desktop Protocol, port 3389, was exposed through the DMZ (open to anyone on the internet.) This, at the time it was being used, was open to critical vulnerabilities that would allow for remote execution of code.
>VNC Remote Desktop, port 5900, was also exposed through the DMZ.
>SSL VPN used a self-signed certificate. This isn't inherently bad, but left them open for "spearphishing" attacks, which have already been confirmed to be received by Hillary Clinton and her staff
It's also interesting how they responded to attacks on the server [1]:
>Here is the section from page 41 of the report which references an “attack”:
> On January 9, 2011, the non-Departmental advisor to President Clinton who provided technical support to the Clinton email system notified the Secretary’s Deputy Chief of Staff for Operations that he had to shut down the server because he believed “someone was trying to hack us and while they did not get in i didnt [sic] want to let them have the chance to.” Later that day, the advisor again wrote to the Deputy Chief of Staff for Operations, “We were attacked again so I shut [the server] down for a few min.” On January 10, the Deputy Chief of Staff for Operations emailed the Chief of Staff and the Deputy Chief of Staff for Planning and instructed them not to email the Secretary “anything sensitive” and stated that she could “explain more in person.”
[0] https://np.reddit.com/r/politics/comments/4j2r94/judicial_wa...
[1] http://lawnewz.com/high-profile/clinton-tech-says-private-em...
Can you imagine if this was how Google and Amazon handled security?
the government should have a bug bounty program instead of the current hacker pogrom
"It gets better. Do a dig mx clintonemail.com. You’ll see that the machine’s incoming email was filtered by mxlogic.net, a spam filtering service that works by received all your emails, filtering out the spam, and forwarding you the rest.
This is because the hosting provider, Platte River Network, sold a package along with the hosting. The package included spam filtering and full-disk off-site backup (since then seized by the FBI).
So every email received by Clinton was going through many unsecured places, including a spam filtering queue, a backup appliance and an off-site backup server. Which has already been documented."
http://krebsonsecurity.com/2016/05/did-the-clinton-email-ser...
She could have hired a team of machine learning grad students to build her a personalized spam filter.
but she went with the cheapest option.
this is going to keep me upset for a while.
Seriously, how could anyone really believe she specc'd this out herself? Her staff probably threw it together as a MVP with the full intention of revisiting the implementation "really soon".
And then they lost interest.
Or instead of reinventing the wheel, installed an existing spam detection product like SpamAssassin on the email server.
EVERY one of tells me that if they had done what it appears Hillary did, they would fully expect to be in jail for years.
In researching this, I find that about 4.5 million Americans currently have, and maybe 1.5 million more did have in the past, security clearances.
I find it hard to believe that in Washington DC, surrounded by people with security clearances, this was unintentional and just an accident. It's like Hillary had to look far afield to find people without security clearances so that they would set this up for her.
A rank and file employee obviously could not direct anyone to set up a private email server for their correspondence or request that the NSA provide them with a secure blackberry.
> I find it hard to believe that in Washington DC, surrounded by people with security clearances, this was unintentional and just an accident. It's like Hillary had to look far afield to find people without security clearances so that they would set this up for her.
Clinton certainly was wrong here and people certainly told her not to do this. But I don't think it requires malicious intent, just someone not taking the rules/guidelines seriously and/or thinking they have more power than they do.
NARA compliance is something that many people either don't know about or are confused about at State department so I could see how some might not take it as seriously as they should.
I'm sure she and her inner circle rationalized away the security risk because classified materials are not supposed to be sent to public email addresses, there's a separate network for that.
There's no reasonable question anymore that laws on handling classified data were broken, the only question is will charges actually be brought?
http://www.latimes.com/opinion/op-ed/la-oe-0330-mcmanus-clin...
http://www.ijreview.com/2015/03/264655-3-federal-laws-hillar...
- Executive Order 13526 and 18 U.S.C Sec. 793(f) of the federal code make it unlawful to send of store classified information on personal email.
- Section 1236.22 of the 2009 National Archives and Records Administration (NARA) requirements states that:
“Agencies that allow employees to send and receive official electronic mail messages using a system not operated by the agency must ensure that Federal records sent or received on such systems are preserved in the appropriate agency record keeping system.”
- MSNBC’s Lawrence O’Donnell believes that the use of a personal emails server appears to be a preemptive move, specifically designed to circumvent FOIA:
For answers to most of your questions about the Clinton email scandal, http://www.thompsontimeline.com/ breaks all the factors in play here down in excruciating detail.
Do you believe 100% of her email was entirely unclassified at the time it was sent?
As for innocuous, it's reported that her emails (unsurprisingly) included intelligence from "special access programs" which are actually classified beyond top secret.
If charges are pressed in this case it'll be because of her gender.
The problem is once said law-breaking becomes widely reported and results in State Department and FBI inquiries, where do you go from there? How can they come back with a recommendation not to prosecute Clinton, but yet they vigorously prosecute people like Aaron Swartz?
However, I do disagree strongly with you that if charges are pressed it has anything to do with her gender. If it were John Kerry who had been SoS when Clinton was, operating kerryemail.com, and he was now running for President, I think we would be in exactly the same position.
Because she's unpopular with a large segment of the population, and therefore has less political cover than some of those other people? Maybe.
Because we're getting less tolerant of "senior officials" who can ignore the rules? Hopefully that.
The NSA denied her request for a secure smartphone and gave her some nonsense excuse. She tried a few more times to get one, and then Clinton gave up and ordered somebody to set her up with a private email server. She used this unsecure email server for years. She used it to communicate with top level officials (including the president). That she had this server was common knowledge in the administration. She knew it wasn't secure and she's been very careful not to discuss any classified information over email at all. In a handful of cases she slipped up and some classified information ended up on email anyway.
I'm inclined to believe accounts like this: https://news.ycombinator.com/item?id=9149363
Perhaps she wasn't furtively planning to take over the world, but the evidence points to more than her just wanting to use a Blackberry - it really seems (to me) like she took significant measures to avoid keeping records.
Second, it seems to be your argument that she didn't get the IT support she wanted and so it's reasonable she did her own thing. This seems perfectly reasonable if you're trying desperately to give her the benefit of the doubt. Heck, we've all dealt with annoying IT departments!
Except, it's not like that. She was our top diplomat and 4th in line of succession to the presidency. It's a fact that classified information was discussed on the system.
I just can't believe that the best defense is "well, she didn't like the UI of Windows CE and she wanted a Blackberry, and it's not her fault the NSA wouldn't give her one -- so, she did what any of us would do -- she co-opted her husband's private server and paid a State Department employee under the table to manage it outside of the government infrastructure. She also made sure to order her subordinates to keep the email address out of the official State Dept. email registry because she didn't want to risk being forced to disclose anything. And, it's perfectly OK that when her email correspondence was subpoenaed during a FOIA lawsuit brought by Judicial Watch, the State Dept. didn't know to look on this server, and as such they didn't turn over all of the relevant materials until years later, when the private email address was made public and she felt it was OK to release hard copies of 30k emails (promising that among the 32k she deleted were only personal emails about yoga, Chelsea's wedding, etc.).
But, isn't that what we all do when the IT department is unreasonable?"
A number of security professionals (I mean security in the government, Information Assurance sense) have told me that if they or I were to do anything like what Secretary Clinton did, we would be liable to be prosecuted.
Following common sense here, her decision to ignore State Department regulations (which she lied about) and participate in classified communications (which she also lied about) on a private server immediately after she had made efforts to minimize public access to her communications, leads to the obvious conclusion that she put secrecy above transparency. If her narrative in private testimony matches the public one, then she likely perjured herself as well on the point of whether the State Department authorized the server, since they now say they did not (which again, she lied about).
The story I keep hearing is that she had this set up to make FOIA requests more difficult/impossible to fulfil.
The really out there stuff is that this was to hide any cash-for-favors exchanges that happened with relation to The Clinton Foundation.
http://arstechnica.com/information-technology/2016/03/this-i...
The level of misinterpretation of FOIA among FOIA officers, lack of domain knowledge, intentional delays and reject-if-possible mentality makes these things very difficult. Total incompetence.
Though, if you find yourself close to something juicy, you can bet your ass a lawyer will swoop in and find something technically wrong to prevent information from being released. Chicago did that to me eight months in by saying "We don't use VoIP, so your request is void." after the state's attorney general's office told Chicago to give me the info. I'd consider this mildly nefarious.
[0] As far as I'm concerned, "unduly burdensome" is just another way of saying "we're not clever enough to get that information, so you're going to have to come up with a clever way on your own, with 1% of the information we have".
Never underestimate the incompetence even by the largest of organizations.
In a sense I am sympathetic with her - this is the type of hacking the system we at HN tend to admire. Clinton is "Uber for Email" before it was cool - dislike the rules and current infrastructure - build your own.
Frankly, she doesn't sound any more incompetent than even a typical old company c. 2010: think Target, Sony, etc. It would be sad, given that her opponent will likely be Trump, if this scandal sinks her candidacy.
Donald won't catch a break from ANYONE, it will be good to have nearly every group riding the Administrations ass every single day. Let alone he really isn't bound to one party or another and likely will go down the middle and get more things fixed than a party centric politician.
tl;dr the real threat Clinton poses over Trump is that press, Congress, and activist, will be silent against her.
You are overestimating Trump and underestimating Hillary.
EDIT: Found it, yeap, Yahoo: http://thecaucus.blogs.nytimes.com/2008/09/17/palins-e-mail-...
And of course it also was hacked by, you guessed it, Guccifer.
I think the sniffing threat mentioned is overblown. As one of the commenters mentions, ISPs don't generally allow adjacent IPs to sniff traffic.
A bigger threat is that a vulnerability in the printer may have been exploited. E.g., for a long time most HP printers could have their firmware upgraded by sending them a print job. And so far the cursory look I've taken at various printer firmware has been really alarming – think thousands of calls to strcpy/memcpy and other unsafe friends.
Edit: Here's a reference for firmware upgrade via print job: http://www.internetsociety.org/sites/default/files/03_4_0.pd...
Edit2: Also, when I say "firmware upgrade" I mean arbitrary code – it wasn't verifying a digital signature or anything.
They constantly screw up the most basic of things. A good test of a network printer is to set it offline, send 20 print jobs to it (a test page is fine), then set it back online. Way too many printers will not print out all 20 print jobs, despite reporting success for all of them (This is true even of $30k printers).
I mean the current owner of clinton.com is some investment firm that could probably do just as well something like ClintonGroup.com or ClintonInvestments.com. If I was her, I would fight for the email address "hillary@clinton.com."
Then again, I'm a programmer, not a politician.
How does one "fight for an email address"?
Once you own a domain, you own it. It doesn't matter that it just so happens to be someone else's last name.
She would have had to pay most likely a large sum to the investment firm that already owns clinton.com... and perhaps they aren't interested in selling, or they value the domain too high.
1. Was it running RAID? If so, what level? Better not be RAID 5. Horrible write speed.
2. Let's REALLY dig into the DNS. What about reverse lookups and CNAMEs.
3. Any idea what the screensaver was? I'll reserve judgement until I have some confirmation.
4. NIC driver version: Hearing that she just ran a generic MS driver for the Intel dual network card. Unbelievable.
Wouldn't a better rendering of all of this be a video from Taiwanese animation?
In the same way, the Secretary of State can also refuse to comply with government policy (not law). You can't fire the Secretary of State for using the wrong email server. It just doesn't work that way. The fact that national security is involved does change things, but organizational politics is pretty much the same all over. If Clinton's email server contained the nuclear launch codes or the contents of Area 51 then the government would have handled it differently. It's unlikely that any lasting and serious security threats were exposed.
