26 ms·

NSA refused Clinton a secure BlackBerry like Obama, so she used her own

116 points by tortilla 11y ago

rrmm 11y ago
From my inside perspective, government IT is dumb. Not that that excuses her going off and using her own. The NSA should probably evaluate if the end result of their refusal was more security or less.
- barney54 11y ago
  But why would the NSA believe that she would set up her own server? Other Secretaries of State hadn't done anything like that.
  - Someone1234 11y ago
    The article kind of dropped that line randomly in. Her email server and this issue (Blackberry or Black Phone in the state's SCIF) are completely unconnected. I don't know how or why they're trying to connect the two. I find this issue interesting in its own right, but see it as nothing to do with her email server (which is already interesting but different).
    - culturestate 11y ago
      I took that to mean that she couldn't hook a civilian Blackberry to her official .gov account, so the personal email server was set up to service her personal Blackberry.
  - rrmm 11y ago
    Previous SoSs didn't make extensive use of it, or like Rice, got exceptions. If the security apparatus doesn't allow people to get their job done, people will find ways to solve their own problems. For example, you could certainly ban all internet use. It would render moot a huge amount of security problems, but people wouldn't abide it. So you have to find the trade off that the user and the security people find acceptable.
    - rrmm 11y ago
      I would like to point out that it doesn't excuse her action: You have to abide by the rules even when they are dumb. But it's a tension between rules and human nature that comes up often. It's like telling teenagers the only safe sex is no sex, and then not teaching them anything else about sex, because they shouldn't be having sex. You're going to have a bad time trying to make that work.
  - bbatha 11y ago
    > Other Secretaries of State hadn't done anything like that. They actually have, the FBI is auditing the last 4 Secretaries of State and has found similar use of private email servers [1]. Outside of the state department the Bush administration was rife with the use of private, RNC managed email servers [2]. 1. http://www.nytimes.com/2016/02/05/us/politics/state-dept-classified-data-found-ex-secretaries-personal-email-john-kerry-condeleezza-rice-colin-powell.html?_r=0 http://www.nytimes.com/2016/02/05/us/politics/state-dept-cla... 2. https://en.wikipedia.org/wiki/Bush_White_House_email_controversy https://en.wikipedia.org/wiki/Bush_White_House_email_controv...
    - barney54 11y ago
      None of these guys used their private email exclusively for government business. That is the key. They all had State Department email. Clinton did not. ALL of her email was on her private server.
- Someone1234 11y ago
  > The NSA should probably evaluate if the end result of their refusal was more security or less. They could but they'd conclude it was MORE secure. Her leaving the SCIF to use an insecure device is infinitely more secure than allowing insecure devices into the SCIF or giving out highly sensitive devices like candy (in particular as she wanted to use it for non-top secret email). Cellphones can be attacked and turned into bugs (e.g. baseband hacking). A bug in the SCIF is unacceptable, and having any wireless devices at all makes it much harder to detect bugging from other avenues. Additionally giving out the president's "Black Phone" to more people makes it easier to attack since they'd have more opportunities and potential mistakes. Plus what if the black phone was compromised? Now you've exposed the SCIF in state.
  - krapp 11y ago
    Every one of your justifications for denying a secure Blackberry to the Secretary of State work just as well to justify denying one to the President.
    - Someone1234 11y ago
      Except: > Additionally giving out the president's "Black Phone" to more people makes it easier to attack since they'd have more opportunities and potential mistakes. It is worth knowing that the US President himself has two phones. A black phone and a regular smartphone for everything else.
      - krapp 11y ago
        Giving one to the Secretary of State (which was, at one point, apparently acceptable) isn't really in the same class of risk as giving it to an intern. It's a risk, but why is it no longer an acceptable risk?
chris_wot 11y ago
This is literally the highest level example of Bruce Schneier's theory that people understand risks, but security people don't understand people. [1] Let's look at this classic case: they won't give Hillary Clinton access to a modified BlackBerry that Obama was using because it made security "unmanageable". Even though Clinton's position is literally one of the most important in the country, if not the world the NSA decided it was a security threat and so just didn't allow it to happen. So Clinton setup her own email server infrastructure and conducted all State business through that. So now those same security people caused a considerably greater threat to national security. Someone should find who denied Clinton access to a secure BB, then they should be removed from any security related work. I almost feel sorry for them if Clinton becomes President, because their days will hopefully be numbered. But I don't feel sorry, because their short-sightedness caused a greater risk to U.S. National Security. 1. https://www.schneier.com/essays/archives/2009/08/people_understand_ri.html https://www.schneier.com/essays/archives/2009/08/people_unde...
- tn13 11y ago
  It feel the same about these modern chip based credit cards. While giving a totally intangible security benefit these cards have brought great discomfort to everyone. A swipe takes around 1 second to register. Chip based cards take anywhere from 5 to 9 seconds with the message "do not remove card" flashing in between. Machines are designed such that you have to insert card in a slit you cant see, I have seen elderly people struggle to do that and cards falling out on floor creating more delays. I really wonder if the wasted human time is worth saving handful of frauds.
  - krinchan 11y ago
    To be honest: This is more based around the terminal designers, both hardware and software, than anything else. For far too long, the designers have been shit hardware and software while charging an insane premium. The cryptography required for processing chip transactions requires more horsepower yet the exact same hardware specs are being used. Furthermore, the chip is not only protecting from cloned cards, but also protecting from the vast malware breeches that occurred at Target, Home Depot, and more. The decision is right. The crap the processors are pulling with their terminal designs is not. The processing market is ripe for someone to break formation and accept smaller margins in return for a well designed and faster terminal.
joesmo 11y ago
I'm so glad people are finally, hopefully going to shut up about this soon. I'm surprised Clinton didn't just say this herself and end the scandal months ago. It's an extremely lame scandal because we're talking about unencrypted email anyways, email that could have been read by anyone and everyone and almost undoubtedly was. The irony that it was the NSA (as usual) that made things less secure instead of more secure is certainly not lost on me.
- moistgorilla 11y ago
  why would this in anyway end the scandal? so because the NSA didn't give in to your request you can go break security protocol and put people's lives at risk?
  - MisterBastahrd 11y ago
    If anyone put anyone's lives at risk, it was the NSA for refusing to do their jobs. There's no "scandal" here.
    - thrill 11y ago
      The NSA did do its job - it performed a cost/benefit analysis and said _NO_.
      - joesmo 11y ago
        Saying NO is exactly not doing their job when there are numerous alternatives to their provided computer. The secretary of state must be able to communicate with others, period. Since they couldn't figure out a proper solution (and from the article it sounds like they didn't even try/ignored her/insulted her) they left the secretary of state without a means to communicate. I'd say that's criminal, negligent, and certainly not doing their jobs.
  - atf104 11y ago
    Trump still poses a larger threat to the country (and the world) by measure. https://gfs.eiu.com/Article.aspx?articleType=gr&articleId=2866 https://gfs.eiu.com/Article.aspx?articleType=gr&articleId=28...
Someone1234 11y ago
This makes Clinton seem petty. She had a wired-computer she could check email on in the SCIF, but she refused and was only willing to read her email on a Blackberry, so her staff tried to get authorisation for one, failed, and then tried to get her a highly sensitive top level device just so she could check her unclassified email in the SCIF (she could use a standard Blackberry elsewhere). I'm siding with the NSA here. She should just buck up and learn to check her email on a wired PC like everyone else.
- res0nat0r 11y ago
  This is easy when you work in an office every day at the same location for your job. As Secretary of State travelling all of the time around the world this isn't realistic.
  - Someone1234 11y ago
    The SCIF is a fixed location, your point doesn't make sense/doesn't apply here. Nobody was stopping her from using a standard Blackberry outside of that facility (and she was, according to the article).
    - batbomb 11y ago
      Just because it's a fixed location doesn't mean employees in that fixed locations should be fixtures.
      - Someone1234 11y ago
        Then deploy RJ-45 into conference rooms and give staff laptops without WiFi. That maintains operational security and allows people to move around.
      - vonmoltke 11y ago
        Actually, the usual approach to information security in a SAPF/SCIF is that computing resources are fixtures.
fabulist 11y ago
This is a classic story that gets repeated again and again, and security professionals should take note; if you forbid your users from doing something, they will route around you to do it, and it will be end up being less secure than if you were involved. Haroon Meer says that saying "no" is a finite resource that security professionals are too willing to tap. If an organization comes to see your department as an obstacle that shoots down ideas and never contributes, you end up ignored. Chip in with ways to make bad ideas less bad, because we already know that deploying any vendor's software is a loss to security.
- danharaj 11y ago
  Another way of thinking about it is that the security team is supposed to help other people do what they want to do securely. If X is insecure, make it secure. Now, if you're an IT department at some corp, you probably don't have the budget or the manpower to do that, so you have to say no as much as you can get away with it. But when the Secretary of State wants to Do A Thing, and you're the NSA...
- talmand 11y ago
  I'm not sure I understand. Are you saying that security professionals should lower their standards because too many people don't want to follow the protocols that security professionals have determined to be the best course of action? Must be nice to have a high enough position in life to ignore security protocols at whim. If I did that I would be fired.
  - cmiles74 11y ago
    I think most companies (large and small) are unwilling to dismiss c-suite executives on the word of a security professional in their IT department.
    - talmand 11y ago
      And we wonder why we see so many companies and government agencies failing at security.
specialp 11y ago
I understand that is is very inconvenient to use the channels provided to transmit confidential information, but that goes with the job. It is also probably inconvenient to have a massive physical security detail follow you everywhere as well but that is also necessary as a high profile government official. Securing mobile communications on a massive scale according to SCI government specifications does not happen overnight, and is not very easy. So unfortunately she has to use the channels provided, however clunky they are. I am sure Mrs. Clinton wouldn't hop into her car to visit a friend without gathering a full security detail. Yes this curtails her life, and yes it is inconvenient, but it is necessary just like securing her communications is! It is like if I were working for a large bank, and I put in a back door VPN to the network since their VPN client only works on Windows, and I want to use Linux. Sure more convenient for me, but it is not my place to subvert security for my own personal convenience.
- rm_-rf_slash 11y ago
  I don't know why this comment was downvoted without explanation, because your point is correct: as a public servant, one is expected to live up to and follow the rules and laws dictated for that position. Security is something you never need until you need it the most.
  - kafkaesq 11y ago
    Security is something you never need until you need it the most. Yeah, we get that part. But it isn't about secure, or not secure. It's that she (or more specifically Donald Reid, her secure information technology coordinator) was never provided a legitimate explanation as to why this technology was available for the POTUS -- and for her predecessor -- but not for her. So it's understandable that they felt dissed.
    - massysett 11y ago
      As a public servant, "I felt dissed" is certainly no reason for me to break the law. I expect better, both from the Secretary of State and from the President of the United States.
cm2187 11y ago
I was rather impressed by Clinton's IT skills, managing her own mail server, using electronic communications extensively, and according to this even asking the NSA to provide a bberry. Then I read: > As I had been speculating, the issue here is one of personal comfort… [Secretary Clinton] does not use a computer. What?
- azinman2 11y ago
  She obviously didn't setup the email server herself.
  - deong 11y ago
    I might be more excited about voting for her if I thought she could commiserate with the pain of sendmail.cf files.
AcerbicZero 11y ago
Perhaps I'm overly cynical but I'm guessing she got caught with her phone in the SCIF more than a few times before she got the message to leave it outside.
johngalt 11y ago
A number of comments here blame the security people or government IT in general for not being accommodating. That may be appropriate in some cases, but anyone who has worked in IT for any length of time understands how this happens. Systems that you don't like are created by bad policies, not bad IT people. Bad policies are driven by overly centralized security responsibility. The security department that says no to <X> because they are responsible for whatever you manage to do with <X>. Think of a car accident. There is a diffusion of responsibility. The decisions both drivers made, road conditions, weather, speeds etc... You would only be concerned with the manufacturer of the car if one of the safety systems malfunctioned. Yet in the case of computer security we want to hang all the contributing factors/decions around one party: the security team. Imagine if General Motors was liable for every car accident; regardless of fault. Every time someone didn't put on their seatbelt, or drove through a flooded road etc... What kind of cars would be produced? Certainly not the kind you would enjoy driving. The day that we can have the security departments we want is the day we understand that we can't absolve ourselves of all security responsibility.
junto 11y ago
I'm reading between the lines here, but is it suggesting that Clinton didn't trust the PC she had been assigned, and that she suspected she was being spied on? Was this the reason why she chose to run her own email server (not that it was secure but still)?
- grej 11y ago
  Maybe she did not want anyone in to be able to FOIA her correspondences. She has said she deleted about 30k emails off the server because she claimed they were "personal in nature". The problem is, that wasn't her call to make.
Glyptodon 11y ago
So basically she's even more guilty than previously realized, but perhaps a little more sympathetically so.
jsprogrammer 11y ago
The title seems incorrect. >And while Clinton's predecessor Condaleeza Rice had obtained waivers for herself and her staff to use BlackBerry devices, Clinton's staff was told that "use [of the BlackBerry] expanded to an unmanageable number of users from a security perspective, so those waivers were phased out and BlackBerry use was not allowed in her Suite," an e-mail from the NSA's senior liaison to the State Department noted. NSA says that they could not ensure the security of BlackBerry devices. That's not a refusal, just the facts. Is someone expecting the NSA to magically conjure unlimited, secure BlackBerries?
- hackinthebochs 11y ago
  Securing the blackberry is a red herring. What they wanted was a functionally equivalent mobile device. If providing such capabilities isn't exactly what the NSA should be doing, then they shouldn't exist.
grej 11y ago
Having dealt with classified work in a previous life, there's no doubt that if any normal joe without her political connections did anything remotely close to this type of thing, they'd wind up in prison. Clinton will probably skate. And yet she'll be the first person demanding that we try Snowden and keep Chelsea Manning locked up.
- jhayward 11y ago
  It's not crystal clear that she violated any laws. Agency heads determine policy for their department's classified information, and she was the most senior of the agency heads. She had explicit authority to classify and declassify information, and to say how it can be disseminated. There isn't that much statutory groundwork to support charges and what there is says an agency head "is assumed to be acting under executive authority", i.e. as the arm of the President. The Congressional Research Service wrote a rather helpful summary[1] of the myriad aspects of classification and law. [1] https://www.fas.org/sgp/crs/secrecy/RS21900.pdf https://www.fas.org/sgp/crs/secrecy/RS21900.pdf But yeah, if you or I were to do what she did, big difference - just not all because of politics.
  - grej 11y ago
    I hear you, although I would argue that someone with her position should have been the first person to know whether what they were sending needed a security designation or not. The fact that 10-15% or so of those emails needed a retroactive security classification demonstrates that she held either had a cavalier attitude toward guarding that information, or was simply incompetent in knowing what should and should not have been classified. Whether that rises to the level of a criminal act, I suspect, depends on whether any of the 30k+ emails she deleted, claiming they were personal, also contained classified material, because then the crime is lying to the FBI more so than the reckless handing of classified information.
    - snowwrestler 11y ago
      Information does not get de-classified just because it is publicly known. For example if one of Clinton's friends forwarded her a NYTimes story about CIA activity in Syria, and she forwarded that to a deputy, well, now she has both received and sent classified information from her email. And even though it might have been on the front page of a newspaper, a retrospective review would designate it as classified information. Would a staff-level person get fired in that situation? I don't know. So much stuff is classified these days, and yet the press is pretty good about ferreting out stories. Any regular reader of the major news operations is probably going to see classified info on a regular basis. How easy is it to keep track of which public, well-known news stories should be excluded from nonsecure email? I would guess, not that easy.
thedz 11y ago
Important bit from the article: > the solution supported by the NSA—its SME PED (Secure Mobile Environment Portable Electronic Device)—was hardly BlackBerry-like. SME PED devices are based on a secure version of Windows CE, and they're only rated up to "Secret" classification. And as Clinton was taking over at State, the SME PED was only just becoming available. It sounds like at the time that Clinton was moving into State, there was, literally, no good solution supported by the NSA for mobile email use. Which considering it was 2009, and mobile email was already prevalent with Blackberry, iPhones/Androids, etc, is well, maybe par for the course for government entities.

116 points by tortilla 11y ago

rrmm 11y ago

From my inside perspective, government IT is dumb. Not that that excuses her going off and using her own. The NSA should probably evaluate if the end result of their refusal was more security or less.

barney54 11y ago
But why would the NSA believe that she would set up her own server? Other Secretaries of State hadn't done anything like that.
- Someone1234 11y ago
  The article kind of dropped that line randomly in. Her email server and this issue (Blackberry or Black Phone in the state's SCIF) are completely unconnected. I don't know how or why they're trying to connect the two. I find this issue interesting in its own right, but see it as nothing to do with her email server (which is already interesting but different).
  - culturestate 11y ago
    I took that to mean that she couldn't hook a civilian Blackberry to her official .gov account, so the personal email server was set up to service her personal Blackberry.
- rrmm 11y ago
  Previous SoSs didn't make extensive use of it, or like Rice, got exceptions. If the security apparatus doesn't allow people to get their job done, people will find ways to solve their own problems. For example, you could certainly ban all internet use. It would render moot a huge amount of security problems, but people wouldn't abide it. So you have to find the trade off that the user and the security people find acceptable.
  - rrmm 11y ago
    I would like to point out that it doesn't excuse her action: You have to abide by the rules even when they are dumb. But it's a tension between rules and human nature that comes up often. It's like telling teenagers the only safe sex is no sex, and then not teaching them anything else about sex, because they shouldn't be having sex. You're going to have a bad time trying to make that work.
- bbatha 11y ago
  > Other Secretaries of State hadn't done anything like that. They actually have, the FBI is auditing the last 4 Secretaries of State and has found similar use of private email servers [1]. Outside of the state department the Bush administration was rife with the use of private, RNC managed email servers [2]. 1. http://www.nytimes.com/2016/02/05/us/politics/state-dept-classified-data-found-ex-secretaries-personal-email-john-kerry-condeleezza-rice-colin-powell.html?_r=0 http://www.nytimes.com/2016/02/05/us/politics/state-dept-cla... 2. https://en.wikipedia.org/wiki/Bush_White_House_email_controversy https://en.wikipedia.org/wiki/Bush_White_House_email_controv...
  - barney54 11y ago
    None of these guys used their private email exclusively for government business. That is the key. They all had State Department email. Clinton did not. ALL of her email was on her private server.
Someone1234 11y ago
> The NSA should probably evaluate if the end result of their refusal was more security or less. They could but they'd conclude it was MORE secure. Her leaving the SCIF to use an insecure device is infinitely more secure than allowing insecure devices into the SCIF or giving out highly sensitive devices like candy (in particular as she wanted to use it for non-top secret email). Cellphones can be attacked and turned into bugs (e.g. baseband hacking). A bug in the SCIF is unacceptable, and having any wireless devices at all makes it much harder to detect bugging from other avenues. Additionally giving out the president's "Black Phone" to more people makes it easier to attack since they'd have more opportunities and potential mistakes. Plus what if the black phone was compromised? Now you've exposed the SCIF in state.
- krapp 11y ago
  Every one of your justifications for denying a secure Blackberry to the Secretary of State work just as well to justify denying one to the President.
  - Someone1234 11y ago
    Except: > Additionally giving out the president's "Black Phone" to more people makes it easier to attack since they'd have more opportunities and potential mistakes. It is worth knowing that the US President himself has two phones. A black phone and a regular smartphone for everything else.
    - krapp 11y ago
      Giving one to the Secretary of State (which was, at one point, apparently acceptable) isn't really in the same class of risk as giving it to an intern. It's a risk, but why is it no longer an acceptable risk?

chris_wot 11y ago

This is literally the highest level example of Bruce Schneier's theory that people understand risks, but security people don't understand people. [1] Let's look at this classic case: they won't give Hillary Clinton access to a modified BlackBerry that Obama was using because it made security "unmanageable". Even though Clinton's position is literally one of the most important in the country, if not the world the NSA decided it was a security threat and so just didn't allow it to happen. So Clinton setup her own email server infrastructure and conducted all State business through that. So now those same security people caused a considerably greater threat to national security. Someone should find who denied Clinton access to a secure BB, then they should be removed from any security related work. I almost feel sorry for them if Clinton becomes President, because their days will hopefully be numbered. But I don't feel sorry, because their short-sightedness caused a greater risk to U.S. National Security. 1. https://www.schneier.com/essays/archives/2009/08/people_understand_ri.html https://www.schneier.com/essays/archives/2009/08/people_unde...

tn13 11y ago
It feel the same about these modern chip based credit cards. While giving a totally intangible security benefit these cards have brought great discomfort to everyone. A swipe takes around 1 second to register. Chip based cards take anywhere from 5 to 9 seconds with the message "do not remove card" flashing in between. Machines are designed such that you have to insert card in a slit you cant see, I have seen elderly people struggle to do that and cards falling out on floor creating more delays. I really wonder if the wasted human time is worth saving handful of frauds.
- krinchan 11y ago
  To be honest: This is more based around the terminal designers, both hardware and software, than anything else. For far too long, the designers have been shit hardware and software while charging an insane premium. The cryptography required for processing chip transactions requires more horsepower yet the exact same hardware specs are being used. Furthermore, the chip is not only protecting from cloned cards, but also protecting from the vast malware breeches that occurred at Target, Home Depot, and more. The decision is right. The crap the processors are pulling with their terminal designs is not. The processing market is ripe for someone to break formation and accept smaller margins in return for a well designed and faster terminal.

joesmo 11y ago

I'm so glad people are finally, hopefully going to shut up about this soon. I'm surprised Clinton didn't just say this herself and end the scandal months ago. It's an extremely lame scandal because we're talking about unencrypted email anyways, email that could have been read by anyone and everyone and almost undoubtedly was. The irony that it was the NSA (as usual) that made things less secure instead of more secure is certainly not lost on me.

moistgorilla 11y ago
why would this in anyway end the scandal? so because the NSA didn't give in to your request you can go break security protocol and put people's lives at risk?
- MisterBastahrd 11y ago
  If anyone put anyone's lives at risk, it was the NSA for refusing to do their jobs. There's no "scandal" here.
  - thrill 11y ago
    The NSA did do its job - it performed a cost/benefit analysis and said _NO_.
    - joesmo 11y ago
      Saying NO is exactly not doing their job when there are numerous alternatives to their provided computer. The secretary of state must be able to communicate with others, period. Since they couldn't figure out a proper solution (and from the article it sounds like they didn't even try/ignored her/insulted her) they left the secretary of state without a means to communicate. I'd say that's criminal, negligent, and certainly not doing their jobs.
- atf104 11y ago
  Trump still poses a larger threat to the country (and the world) by measure. https://gfs.eiu.com/Article.aspx?articleType=gr&articleId=2866 https://gfs.eiu.com/Article.aspx?articleType=gr&articleId=28...

Someone1234 11y ago

This makes Clinton seem petty. She had a wired-computer she could check email on in the SCIF, but she refused and was only willing to read her email on a Blackberry, so her staff tried to get authorisation for one, failed, and then tried to get her a highly sensitive top level device just so she could check her unclassified email in the SCIF (she could use a standard Blackberry elsewhere). I'm siding with the NSA here. She should just buck up and learn to check her email on a wired PC like everyone else.

res0nat0r 11y ago
This is easy when you work in an office every day at the same location for your job. As Secretary of State travelling all of the time around the world this isn't realistic.
- Someone1234 11y ago
  The SCIF is a fixed location, your point doesn't make sense/doesn't apply here. Nobody was stopping her from using a standard Blackberry outside of that facility (and she was, according to the article).
  - batbomb 11y ago
    Just because it's a fixed location doesn't mean employees in that fixed locations should be fixtures.
    - Someone1234 11y ago
      Then deploy RJ-45 into conference rooms and give staff laptops without WiFi. That maintains operational security and allows people to move around.
    - vonmoltke 11y ago
      Actually, the usual approach to information security in a SAPF/SCIF is that computing resources are fixtures.

fabulist 11y ago

This is a classic story that gets repeated again and again, and security professionals should take note; if you forbid your users from doing something, they will route around you to do it, and it will be end up being less secure than if you were involved. Haroon Meer says that saying "no" is a finite resource that security professionals are too willing to tap. If an organization comes to see your department as an obstacle that shoots down ideas and never contributes, you end up ignored. Chip in with ways to make bad ideas less bad, because we already know that deploying any vendor's software is a loss to security.

danharaj 11y ago
Another way of thinking about it is that the security team is supposed to help other people do what they want to do securely. If X is insecure, make it secure. Now, if you're an IT department at some corp, you probably don't have the budget or the manpower to do that, so you have to say no as much as you can get away with it. But when the Secretary of State wants to Do A Thing, and you're the NSA...
talmand 11y ago
I'm not sure I understand. Are you saying that security professionals should lower their standards because too many people don't want to follow the protocols that security professionals have determined to be the best course of action? Must be nice to have a high enough position in life to ignore security protocols at whim. If I did that I would be fired.
- cmiles74 11y ago
  I think most companies (large and small) are unwilling to dismiss c-suite executives on the word of a security professional in their IT department.
  - talmand 11y ago
    And we wonder why we see so many companies and government agencies failing at security.

specialp 11y ago

I understand that is is very inconvenient to use the channels provided to transmit confidential information, but that goes with the job. It is also probably inconvenient to have a massive physical security detail follow you everywhere as well but that is also necessary as a high profile government official. Securing mobile communications on a massive scale according to SCI government specifications does not happen overnight, and is not very easy. So unfortunately she has to use the channels provided, however clunky they are. I am sure Mrs. Clinton wouldn't hop into her car to visit a friend without gathering a full security detail. Yes this curtails her life, and yes it is inconvenient, but it is necessary just like securing her communications is! It is like if I were working for a large bank, and I put in a back door VPN to the network since their VPN client only works on Windows, and I want to use Linux. Sure more convenient for me, but it is not my place to subvert security for my own personal convenience.

rm_-rf_slash 11y ago
I don't know why this comment was downvoted without explanation, because your point is correct: as a public servant, one is expected to live up to and follow the rules and laws dictated for that position. Security is something you never need until you need it the most.
- kafkaesq 11y ago
  Security is something you never need until you need it the most. Yeah, we get that part. But it isn't about secure, or not secure. It's that she (or more specifically Donald Reid, her secure information technology coordinator) was never provided a legitimate explanation as to why this technology was available for the POTUS -- and for her predecessor -- but not for her. So it's understandable that they felt dissed.
  - massysett 11y ago
    As a public servant, "I felt dissed" is certainly no reason for me to break the law. I expect better, both from the Secretary of State and from the President of the United States.

cm2187 11y ago

I was rather impressed by Clinton's IT skills, managing her own mail server, using electronic communications extensively, and according to this even asking the NSA to provide a bberry. Then I read: > As I had been speculating, the issue here is one of personal comfort… [Secretary Clinton] does not use a computer. What?

azinman2 11y ago
She obviously didn't setup the email server herself.
- deong 11y ago
  I might be more excited about voting for her if I thought she could commiserate with the pain of sendmail.cf files.

AcerbicZero 11y ago

Perhaps I'm overly cynical but I'm guessing she got caught with her phone in the SCIF more than a few times before she got the message to leave it outside.

johngalt 11y ago

A number of comments here blame the security people or government IT in general for not being accommodating. That may be appropriate in some cases, but anyone who has worked in IT for any length of time understands how this happens. Systems that you don't like are created by bad policies, not bad IT people. Bad policies are driven by overly centralized security responsibility. The security department that says no to <X> because they are responsible for whatever you manage to do with <X>. Think of a car accident. There is a diffusion of responsibility. The decisions both drivers made, road conditions, weather, speeds etc... You would only be concerned with the manufacturer of the car if one of the safety systems malfunctioned. Yet in the case of computer security we want to hang all the contributing factors/decions around one party: the security team. Imagine if General Motors was liable for every car accident; regardless of fault. Every time someone didn't put on their seatbelt, or drove through a flooded road etc... What kind of cars would be produced? Certainly not the kind you would enjoy driving. The day that we can have the security departments we want is the day we understand that we can't absolve ourselves of all security responsibility.

junto 11y ago

I'm reading between the lines here, but is it suggesting that Clinton didn't trust the PC she had been assigned, and that she suspected she was being spied on? Was this the reason why she chose to run her own email server (not that it was secure but still)?

grej 11y ago
Maybe she did not want anyone in to be able to FOIA her correspondences. She has said she deleted about 30k emails off the server because she claimed they were "personal in nature". The problem is, that wasn't her call to make.

Glyptodon 11y ago

So basically she's even more guilty than previously realized, but perhaps a little more sympathetically so.

jsprogrammer 11y ago

The title seems incorrect. >And while Clinton's predecessor Condaleeza Rice had obtained waivers for herself and her staff to use BlackBerry devices, Clinton's staff was told that "use [of the BlackBerry] expanded to an unmanageable number of users from a security perspective, so those waivers were phased out and BlackBerry use was not allowed in her Suite," an e-mail from the NSA's senior liaison to the State Department noted. NSA says that they could not ensure the security of BlackBerry devices. That's not a refusal, just the facts. Is someone expecting the NSA to magically conjure unlimited, secure BlackBerries?

hackinthebochs 11y ago
Securing the blackberry is a red herring. What they wanted was a functionally equivalent mobile device. If providing such capabilities isn't exactly what the NSA should be doing, then they shouldn't exist.

grej 11y ago

Having dealt with classified work in a previous life, there's no doubt that if any normal joe without her political connections did anything remotely close to this type of thing, they'd wind up in prison. Clinton will probably skate. And yet she'll be the first person demanding that we try Snowden and keep Chelsea Manning locked up.

jhayward 11y ago
It's not crystal clear that she violated any laws. Agency heads determine policy for their department's classified information, and she was the most senior of the agency heads. She had explicit authority to classify and declassify information, and to say how it can be disseminated. There isn't that much statutory groundwork to support charges and what there is says an agency head "is assumed to be acting under executive authority", i.e. as the arm of the President. The Congressional Research Service wrote a rather helpful summary[1] of the myriad aspects of classification and law. [1] https://www.fas.org/sgp/crs/secrecy/RS21900.pdf https://www.fas.org/sgp/crs/secrecy/RS21900.pdf But yeah, if you or I were to do what she did, big difference - just not all because of politics.
- grej 11y ago
  I hear you, although I would argue that someone with her position should have been the first person to know whether what they were sending needed a security designation or not. The fact that 10-15% or so of those emails needed a retroactive security classification demonstrates that she held either had a cavalier attitude toward guarding that information, or was simply incompetent in knowing what should and should not have been classified. Whether that rises to the level of a criminal act, I suspect, depends on whether any of the 30k+ emails she deleted, claiming they were personal, also contained classified material, because then the crime is lying to the FBI more so than the reckless handing of classified information.
  - snowwrestler 11y ago
    Information does not get de-classified just because it is publicly known. For example if one of Clinton's friends forwarded her a NYTimes story about CIA activity in Syria, and she forwarded that to a deputy, well, now she has both received and sent classified information from her email. And even though it might have been on the front page of a newspaper, a retrospective review would designate it as classified information. Would a staff-level person get fired in that situation? I don't know. So much stuff is classified these days, and yet the press is pretty good about ferreting out stories. Any regular reader of the major news operations is probably going to see classified info on a regular basis. How easy is it to keep track of which public, well-known news stories should be excluded from nonsecure email? I would guess, not that easy.

thedz 11y ago

Important bit from the article: > the solution supported by the NSA—its SME PED (Secure Mobile Environment Portable Electronic Device)—was hardly BlackBerry-like. SME PED devices are based on a secure version of Windows CE, and they're only rated up to "Secret" classification. And as Clinton was taking over at State, the SME PED was only just becoming available. It sounds like at the time that Clinton was moving into State, there was, literally, no good solution supported by the NSA for mobile email use. Which considering it was 2009, and mobile email was already prevalent with Blackberry, iPhones/Androids, etc, is well, maybe par for the course for government entities.