7 ms·

How Clinton’s email scandal took root

73 points by whbk 11y ago

harry8 11y ago
So exactly who is to blame for the US state department having the worst opsec imaginable? I dislike Hilary but even if I think the absolute worst of her behaviour here she's kind of down the list of guilt. She's not a technology security expert and she's driving how her tech is set up while she's secretary of state without literally the best tech advise available to the most powerful nation on earth? Really? They can't provide her with a secure device. That's the Secretary of State of the United States of America who they can't provide with a secure device and so they leave her, literally to her own devices. Apparently nobody reviewed how she was communicating and advise her directly about her own behaviour. "Much less, ok what do you need? We'll design a system that does that with the best security we can manage. We'll tell you exactly what not to do. Mr/Madam Secretary." Whoever the secretary of state is. Fire them all and start again. You can't do worse than this can you? No matter who you've got in power you're selling them and US State Department policy. Hillary, yeah, to hell with her, but that's entirely beside the point and totally a sideshow in this story. I can't think of a single politician who would know and understand the security implications of electronic communication without being directly advised in the most clear and emphatic fashion possible. Does anyone care to speak up for the competence on display here?
- mattnewton 11y ago
  I got the impression, but perhaps this was tainted by the media, that Hillary did it her way over the objection of the state department's policy. http://mashable.com/2016/03/17/clinton-nsa-blackberry/#IoWUNxrk3aqy http://mashable.com/2016/03/17/clinton-nsa-blackberry/#IoWUN...
  - dogma1138 11y ago
    Doesn't matter why she did it, she broke at least one federal law by doing it.
- saboot 11y ago
  After the OPM information leak disaster, it's pretty clear that there exists a serious disconnect between the extremely technical areas of govt (NSA) and others. The BlackBerry part is interesting. At civilian sites (Natl labs) you can easily get an encrypted blackberry, and even take it into classified areas. You are just required to power it off before viewing or discussing any material. Apparently the Dept of State can't even manage what we already do throughout the country.
  - ghshephard 11y ago
    Any modifications required to the Blackberry before being taken into classified areas - such as removal/destruction of microphones and/or any cameras? I can't imagine, "Just power it off" as a security mechanism, and can only imagine that compliance is somewhat less than 100%. Also - I can imagine there are different levels of classification, and that the Secretary of State may be in places where the rules might be somewhat more strict.
    - saboot 11y ago
      The blackberries are provided by the national lab, so not personal ones. Though you would likely also be able to check personal emails also. For laptops they do remove cameras / microphones as a policy. I wouldn't be surprised if a camera was disabled (obviously not a microphone for a phone) but I'm not sure.
  - mter 11y ago
    Are your civilian labs SCIFs?
    - saboot 11y ago
      There are SCIF areas.
- deleted 11y ago
  [deleted]
- deleted 11y ago
  [deleted]
- apalmer 11y ago
  i dont really know the story other than this article... but seems she was given a awkward but approved secure email methodology. she was repeatedly told that what she was doing was insecure. she more or less just chose to take this approach because it was more convenient... at least according to this article. just seemed like she had really bad communication discipline and didnt believe it was that big a deal. did get the impression that there really wasnt anyone who really wanted to step up and forbid her to do certain things not sure if there is a role who has authority to do that
  - jacobolus 11y ago
    It seems to me like their procedures and systems were established in an era of telephones, paper memos, and (barely) desktop computers, and that workflow was horribly painful for someone with several years experience doing all communications on a Blackberry. I can understand where Clinton is coming from. If I took a new job and they told me I had to use the ed editor to write code, and could only send patches by fax, I would either demand to keep using my networked laptop, a version control system, and preferred editor, or quit on the spot. It’s ridiculous that the NSA, the White House, and the State Department couldn’t work out some kind of secure mobile device solution for Clinton.
    - x0x0 11y ago
      To reiterate harryh's point, the sitting US secretary of state couldn't get a working email solution out of the nsa or state dept internal IT. Simply amazing. And where did everyone who fucking emailed her the entire duration of her employment think emails addressed to HDR22@clintonemail.com were going, exactly?
      - Natsu 11y ago
        She was told she could use a secure laptop or desktop. She was not without secure e-mail, she was without secure e-mail on a device she preferred. The new spins on this story continue to amaze me. There was a lot of discussion some time ago when essentially the same story hit Slashdot: https://news.slashdot.org/story/16/03/17/2242233/emails-show-nsa-rejected-hillary-clintons-request-for-secure-smartphone https://news.slashdot.org/story/16/03/17/2242233/emails-show... EDIT: Lest I forget, this also happened after she'd set up the home email server...
- julie1 11y ago
  US intelligence by the means of agencies and external consultancies is using directly 1 millions IT workers with Top secret clearance. 1 out 100 of the working population. They could not find one to set hillary's mail correctly? Or they did not wished to? Or did Hillary refused to have an email set up by the government to protect her MI6/DGSE leaks? And when you read the story of snowden's, he was able to trigger all alarms and get away with it. And now NSA discover that too much data is a problem because informational entropy is growing so much it is hard to find the relevant data, even though informational entropy is a basic concept? (not to speak of false positive (innocent tagged terrorists) and false negative (missing the boston terrorist)). ELECTINT is living its last years at my opinion. And I am okay with it. It has created a growing gap of perception between governments and the people they govern. Sometimes failure are okay for me. To err is human, to persevere is evil, and no machine can notice when it errs. Relying to much on ELECTINT is the first part of incompetence here.
- poof131 11y ago
  The government issues government accounts for different levels of classification. You get a normal .gov or .mil for unclassified, another one for secret, and another one for top secret. All the communication is done on separate networks: nipr, sipr, etc. Around 2008, the military got hacked so bad that you couldn’t even put a thumb drive in a non-secure computer. If you did, you had to talk to a General/Admiral and could expect punishment. Secret, Top Secret, and SAP were a totally different matter. Cell phones and electronic devices don’t go in secure areas at all. Red lights flash when non-cleared people enter areas. Hillary wanted a Top Secret blackberry which no one except the president had from reading the articles. She wanted to avoid FOIA so she avoided using any government email addresses. This is totally non-standard and I imagine was only permitted because she was the boss. It isn’t remotely similar to what Powell did and while I agree that the government classifies too much shit, that isn’t the case here either. She went against protocol because she wanted to and she could, and she should own the consequences. I don’t blame incompetence at State here. If she’d used her government accounts and followed normal procedures this would have been a non issue.
  - marak830 11y ago
    Wait. She wanted to avoid FOIA? Is that allowed? If that is true, how the hell is she still running? (Non us citizen here btw)
    - apalmer 11y ago
      this is editorializing on his part. the rest of the post seems to be fact and not opinion, so i wish that sentence had been left out.
    - marcoperaza 11y ago
      Yes, this is the big elephant in the room. The only sane reason to have such an arrangement is to avoid oversight and accountability. The large number of deleted emails should also be a red flag as to what the real motive was.
      - marak830 11y ago
- cm2187 11y ago
  It's also a symptom that people in power are usually older generations and that we only start to see coming a generation of people who even use computers and emails. I guess previous Secretary of States must have used pen and paper. It's not exactly a vote of confidence that smartphones are so unsecure that the intelligence services will not even allow them within the walls of a secure building. Shouldn't that be the first problem on the list here?
  - DanBC 11y ago
    >It's not exactly a vote of confidence that smartphones are so unsecure that the intelligence services will not even allow them within the walls of a secure building. Shouldn't that be the first problem on the list here? It's not just that smartphones are insecure enough to allow external attackers. Smartphones would also make it easier for another Snowden to exfiltrate material. And some of this is abundance of precaution - GCHQ and NSA banned Furbies because they weren't sure what would or wouldn't be recorded. http://news.bbc.co.uk/1/hi/world/americas/254094.stm http://news.bbc.co.uk/1/hi/world/americas/254094.stm
    - cm2187 11y ago
      That must be heartbreaking for NSA employees not to be able to bring their Furbies at work
- mtgx 11y ago
  > She's not a technology security expert Which makes setting up her own server all the worse. > They can't provide her with a secure device. They did, but it wasn't a BlackBerry one. BlackBerry or Windows Mobile, I don't think either were that secure anyway. I agree with the general sentiment that digital security in the government is between catastrophic and terrible. It's now going towards just "terrible", so there' some progress, I suppose.
  - cyphar 11y ago
    > > She's not a technology security expert > Which makes setting up her own server all the worse. Obviously she didn't set up the server. She probably got one of her technical aids to do it. Probably not good either way, though. It's almost certainly unpatched. > > They can't provide her with a secure device. > They did, but it wasn't a BlackBerry one. BlackBerry or Windows Mobile, I don't think either were that secure anyway. > I agree with the general sentiment that digital security in the government is between catastrophic and terrible. It's now going towards just "terrible", so there' some progress, I suppose.
- basch 11y ago
  there are potentially two other possibilities, neither of which i necessarily believe 1) this exposes that Secretary of State is a figurehead to placate world leaders, a tool for diplomacy, but not highly respected or valued by the intelligence community. The position exists on the outskirts of what they care about locking down. 2) they left her to her own devices on purpose. it was a trap she fell right into. they knew she would make a bad decision and let her hoping it would lead her to her own demise.
- ArkyBeagle 11y ago
  I think you're stepping over the fact that during Bill Clinton's tenure as President, he was demonized and frankly slandered in a very hard-to-understand way. Last I checked, entire media empires were built on stories then that were simply made up out of whole cloth. Since Hillary Clinton was long expected to be a candidate in this years election, it's not too much trouble to use that as an explanation.
  - jazzyk 11y ago
    Explanation, perhaps - justification, no. Interesting how people forget that our government is to serve its people, not its own career interests. Hillary Clinton chose to sacrifice the country's interests (major security lapse) in order to cover her ass and hide potentially unethical (perhaps even illegal) activity. All business conducted on behalf of the country should be made public as soon as it is safe to do so (no more than 5 years for classified material).
    - ArkyBeagle 11y ago
      The "career interest" I see in this thread are of the Computer Security Industrial Complex, which seem to have quite the bullet as a means of generating income these days. I have objection to this. They're dedicated professionals but sometimes they have big feet. IMO there is but one mode for computer security - lock and key, perhaps barbed wire, perhaps armed guards. And certainly no connection to the larger internet. That's me reading Bruce Scheiner. Probably badly - computer security bores me no end ( because I know of the one way to do it, you see... ) Bluntly, those who do not serve their own career interests simply won't be in government. The Anthropic Principle - it's not just for physicists. And that's rather beside the point. I'm by no means up on the details here, but it begins to look like there was no available solution that met requirements. This is straight up Dilbert "Mordac, Preventer of Information Services" nonsense. Was having email available optional for her? Probably not. And frankly, the entire narrative is that of imagined threats. I realize that's the mode de jour now but I still have the habits of looking for evidence not made up in the pursuit of political power. After seeing the Clinton-bashing effort outed completely ( but the rotting zombie corpse of it still in use as a political device - inexplicably ) I'm just not inclined to hold any other opinion. MY conspiracy has been proven and completely outed. I have little use for either of the Clintons, but there can be no explanation for the furor surrounding the American Spectator in that time except this one. Even when Neocon hit pieces were done on films like "The Power of Nightmares" they conveniently left out reference to the Clinton hit pieces, preferring to shore up the Neocon's evidence and other more tractable things. I simply find use of The Big Lie patently and irrevocably offensive.
davesque 11y ago
From the article: """ Clinton lawyer David Kendall later told the State Department that her “use of personal email was consistent with the practices of other Secretaries of State,” citing Powell in particular, according to a letter he wrote in August. But Powell’s circumstances also differed from Clinton’s in notable ways. Powell had a phone line installed in his office solely to link to his private account, which he generally used for personal or non-classified communication. At the time, he was pushing the department to embrace the Internet era and wanted to set an example. “I performed a little test whenever I visited an embassy: I’d dive into the first open office I could find (sometimes it was the ambassador’s office). If the computer was on, I’d try to get into my private email account,” Powell wrote in “It Worked for Me: In Life and Leadership.” “If I could, they passed.” Powell conducted virtually all of his classified communications on paper or over a State Department computer installed on his desk that was reserved for classified information, according to interviews. Clinton never had such a desktop or a classified email account, according to the State Department. """ ...sooooo. Colin Powell did the same thing as Clinton and all we have is his (and his staff's) claims that they didn't communicate classified information over inappropriate channels? So then what makes this situation any different or any more deserving of attention?
- gcommer 11y ago
  Wait, what? The 4 paragraphs you quoted seem to directly answer your question about how Powell and HRC acted differently ("Clinton never had such a desktop or a classified email account, according to the State Department.") Also, even if we now find out that Powell acted as poorly as HRC, that doesn't excuse either of them at all. It just means that they're both guilty, not that Hillary should get off the hook because previous Secretaries of State did it too.
  - davesque 11y ago
    So that's all we have that makes what Powell did okay? Either he or the WP is simply assuring us that he never sent any important emails through his private email account (which he liked to log into from random computers)? Furthermore, isn't the point here that, apparently (if the stories of Powell and Clinton are any indication), the government doesn't really try that hard to secure the communications of its cabinet members? The way I had imagined it is that, as soon as these people take office, they're given the best crypto tech in the world. They're not told to take a hike because only the POTUS gets the good stuff. What kind of sense does that make?
Glyptodon 11y ago
The way she seems so cavalier and reckless over an inconvenience makes me doubt I'd really want her to be president.
freewizard 11y ago
Just curious: what's the os and email server used in this "basement server"?
- mtgx 11y ago
  > He also identifies the server routed to and from mail.clintonemail.com as a " Windows Server 2008 R2 with a valid SSL certificate," but that server, according to Mayer, is located at managed services company Internap. > Clinton's private email server was reconfigured again to use a Denver-based commercial email provider, MX Logic, which is now owned by McAfee Inc., a top internet security company. Except MX Logic isn't a "commercial email provider," it's a service that offers spam and virus filtering for email, very similar to Google's own Postini service. One of my friends who runs an ISP offers both Postini and MX Logic to customers but recommends MX Logic because he says the spam management is better. http://www.zdnet.com/article/clintons-little-email-fuss-beyond-servers-in-the-basement/ http://www.zdnet.com/article/clintons-little-email-fuss-beyo...
  - ryanlol 11y ago
    Wow, that's actually even worse than I'd first thought. They didn't even have physical control over the server? So anyone could've exploited internaps vulnerable ubersmith install and asked them to boot clintons box into recovery.
    - basch 11y ago
      sending classified state secrets through a third party spam filter? that almost makes the "server in a basement" a bit of a fib. her emails were flowing through some private companies network first.
mentat 11y ago
Though I'm not sure it's even worth trying to bring up in the opinion filled noise of these threads, there is no way to secure current generation mobile devices sufficiently to withstand nation-state attackers. Full stop. The processors, basebands, MMUs, all of them lack the tools necessary to create a chain of trust with also sufficient isolation at the application level to run normal applications. When everyone is saying "of course the FBI could get into the terrorist cellphone, just take it to TAO," this same thing applies to Blackberries and Android phones when applied by opposite numbers in China or Russia. It is not possible to secure a mobile device from a nation-state attacker due (at least) to gaps in the hardware capabilities
- visarga 11y ago
  Also, it's not ok to use a phone that doesn't get regular security updates, but that means you have to trust the phone manufacturer or set up a team of experts to monitor each and every update. Can't trust the hardware, can't trust the software. How can this device be ok to be used by a state official?
studentrob 11y ago
Wow I really wouldn't want to be the guy who set up her email server. He was just granted immunity in exchange for cooperation, but that has got to be stressful to testify at the national level, plus against a Presidential candidate. Yikes.
sdrothrock 11y ago
> Their fears focused on the seventh floor, which a decade earlier had been the target of Russian spies who managed to plant a listening device inside a decorative chair-rail molding not far from Mahogany Row. This is a throwaway tidbit in the article that I wish had a link to some more details. That one sentence hints at a very interesting longform article on its own. Edit: I found these, which offer a few details. Surprising that it's from 1999! http://edition.cnn.com/ALLPOLITICS/time/1999/12/13/spy.html http://edition.cnn.com/ALLPOLITICS/time/1999/12/13/spy.html http://www.wsj.com/articles/SB944783077407465290 http://www.wsj.com/articles/SB944783077407465290
deleted 11y ago
[deleted]
marcoperaza 11y ago
The elephant in the room, which the media only occasionally brings up, is her motive for this arrangement. Based on the large number of emails that she tried to delete when the existence of this server became public, and her failure to previously include these emails in requests for data by Congress, we can deduce that the goal was likely to escape oversight and avoid accountability. A totally logical move for someone who is no stranger to scandal. And pretty damning to anyone who cares about making government accountable.
venomsnake 11y ago
One thing I don't get and drives me mad - why didn't she insisted of using pgp, but sent them plaintext. A chimp could learn to use it in 2 hours. So I guess for a career politician it would take a week. But it is doable. What worries me is not the ethical part - I am yet too cynical, but the total disregard of basic security.
- DanBC 11y ago
  > A chimp could learn to use it in 2 hours. The chimp needs everyone else to be using PGP too. Since everyone else is using the already secure email networks they see no need to use PGP. And, really, PGP is not that easy to use. It's very easy for people to make mistakes with PGP.
  - venomsnake 11y ago
    If I am secretary of state, the only persons that I could not force to generate key and use enigmail are probably the president and the VP. A simple policy - I have tuned the server to discard any non encrypted and non signed email will force big chunk of the beltway elite to learn a new thing.
    - basch 11y ago
      enigmail works for blackberry? if you read the article, its pretty clear her entire team were blackberry users and refused to use anything else to communicate with each other.
saboot 11y ago
How does the voting system on HN work? This is the second article on this topic I've seen today removed from the front page now. It was there only an hour or so ago, and now isn't in the first ten pages on HN.
- studentrob 11y ago
  Maybe some stuff gets flagged to death? Not sure exactly. I've seen other controversial topics drop off the front page that have recent submission times, and a decent number of points and comments, while others with similar stats remain on the front. ¯\_(ツ)_/¯
- nkurz 11y ago
  The charts at hnrankings.com can give you an idea of what happened to it: http://hnrankings.info/11372264/ http://hnrankings.info/11372264/ Among the things that can cause big drops: User flagging. Administrative action. Staleness (some number of hours on front page) Flamewar detector (flurry of responses to responses) It's difficult to distinguish between these from the outside, but a polite email to Dan (hn@ycombinator.com) will probably get you a specific answer if you are interested. Based on asking about similar stories, this one would be a tossup between "Flamewar" and "User flags".
deleted 11y ago
[deleted]
throwaway284534 11y ago
How long do we have to hear about this debacle? Seriously, it's enough already. There's no new information to discuss.
selllikesybok 11y ago
https://en.m.wikipedia.org/wiki/Bush_White_House_email_controversy https://en.m.wikipedia.org/wiki/Bush_White_House_email_contr...
jakeogh 11y ago
To get a copy: https://github.com/wsjdata/clinton-email-cruncher https://github.com/wsjdata/clinton-email-cruncher

73 points by whbk 11y ago

So exactly who is to blame for the US state department having the worst opsec imaginable? I dislike Hilary but even if I think the absolute worst of her behaviour here she's kind of down the list of guilt. She's not a technology security expert and she's driving how her tech is set up while she's secretary of state without literally the best tech advise available to the most powerful nation on earth? Really? They can't provide her with a secure device. That's the Secretary of State of the United States of America who they can't provide with a secure device and so they leave her, literally to her own devices. Apparently nobody reviewed how she was communicating and advise her directly about her own behaviour. "Much less, ok what do you need? We'll design a system that does that with the best security we can manage. We'll tell you exactly what not to do. Mr/Madam Secretary." Whoever the secretary of state is. Fire them all and start again. You can't do worse than this can you? No matter who you've got in power you're selling them and US State Department policy. Hillary, yeah, to hell with her, but that's entirely beside the point and totally a sideshow in this story. I can't think of a single politician who would know and understand the security implications of electronic communication without being directly advised in the most clear and emphatic fashion possible. Does anyone care to speak up for the competence on display here?

mattnewton 11y ago
I got the impression, but perhaps this was tainted by the media, that Hillary did it her way over the objection of the state department's policy. http://mashable.com/2016/03/17/clinton-nsa-blackberry/#IoWUNxrk3aqy http://mashable.com/2016/03/17/clinton-nsa-blackberry/#IoWUN...
- dogma1138 11y ago
  Doesn't matter why she did it, she broke at least one federal law by doing it.
saboot 11y ago
After the OPM information leak disaster, it's pretty clear that there exists a serious disconnect between the extremely technical areas of govt (NSA) and others. The BlackBerry part is interesting. At civilian sites (Natl labs) you can easily get an encrypted blackberry, and even take it into classified areas. You are just required to power it off before viewing or discussing any material. Apparently the Dept of State can't even manage what we already do throughout the country.
- ghshephard 11y ago
  Any modifications required to the Blackberry before being taken into classified areas - such as removal/destruction of microphones and/or any cameras? I can't imagine, "Just power it off" as a security mechanism, and can only imagine that compliance is somewhat less than 100%. Also - I can imagine there are different levels of classification, and that the Secretary of State may be in places where the rules might be somewhat more strict.
  - saboot 11y ago
    The blackberries are provided by the national lab, so not personal ones. Though you would likely also be able to check personal emails also. For laptops they do remove cameras / microphones as a policy. I wouldn't be surprised if a camera was disabled (obviously not a microphone for a phone) but I'm not sure.
- mter 11y ago
  Are your civilian labs SCIFs?
  - saboot 11y ago
    There are SCIF areas.
deleted 11y ago
[deleted]
deleted 11y ago
[deleted]
apalmer 11y ago
i dont really know the story other than this article... but seems she was given a awkward but approved secure email methodology. she was repeatedly told that what she was doing was insecure. she more or less just chose to take this approach because it was more convenient... at least according to this article. just seemed like she had really bad communication discipline and didnt believe it was that big a deal. did get the impression that there really wasnt anyone who really wanted to step up and forbid her to do certain things not sure if there is a role who has authority to do that
- jacobolus 11y ago
  It seems to me like their procedures and systems were established in an era of telephones, paper memos, and (barely) desktop computers, and that workflow was horribly painful for someone with several years experience doing all communications on a Blackberry. I can understand where Clinton is coming from. If I took a new job and they told me I had to use the ed editor to write code, and could only send patches by fax, I would either demand to keep using my networked laptop, a version control system, and preferred editor, or quit on the spot. It’s ridiculous that the NSA, the White House, and the State Department couldn’t work out some kind of secure mobile device solution for Clinton.
  - x0x0 11y ago
    To reiterate harryh's point, the sitting US secretary of state couldn't get a working email solution out of the nsa or state dept internal IT. Simply amazing. And where did everyone who fucking emailed her the entire duration of her employment think emails addressed to HDR22@clintonemail.com were going, exactly?
    - Natsu 11y ago
      She was told she could use a secure laptop or desktop. She was not without secure e-mail, she was without secure e-mail on a device she preferred. The new spins on this story continue to amaze me. There was a lot of discussion some time ago when essentially the same story hit Slashdot: https://news.slashdot.org/story/16/03/17/2242233/emails-show-nsa-rejected-hillary-clintons-request-for-secure-smartphone https://news.slashdot.org/story/16/03/17/2242233/emails-show... EDIT: Lest I forget, this also happened after she'd set up the home email server...
julie1 11y ago
US intelligence by the means of agencies and external consultancies is using directly 1 millions IT workers with Top secret clearance. 1 out 100 of the working population. They could not find one to set hillary's mail correctly? Or they did not wished to? Or did Hillary refused to have an email set up by the government to protect her MI6/DGSE leaks? And when you read the story of snowden's, he was able to trigger all alarms and get away with it. And now NSA discover that too much data is a problem because informational entropy is growing so much it is hard to find the relevant data, even though informational entropy is a basic concept? (not to speak of false positive (innocent tagged terrorists) and false negative (missing the boston terrorist)). ELECTINT is living its last years at my opinion. And I am okay with it. It has created a growing gap of perception between governments and the people they govern. Sometimes failure are okay for me. To err is human, to persevere is evil, and no machine can notice when it errs. Relying to much on ELECTINT is the first part of incompetence here.
poof131 11y ago
The government issues government accounts for different levels of classification. You get a normal .gov or .mil for unclassified, another one for secret, and another one for top secret. All the communication is done on separate networks: nipr, sipr, etc. Around 2008, the military got hacked so bad that you couldn’t even put a thumb drive in a non-secure computer. If you did, you had to talk to a General/Admiral and could expect punishment. Secret, Top Secret, and SAP were a totally different matter. Cell phones and electronic devices don’t go in secure areas at all. Red lights flash when non-cleared people enter areas. Hillary wanted a Top Secret blackberry which no one except the president had from reading the articles. She wanted to avoid FOIA so she avoided using any government email addresses. This is totally non-standard and I imagine was only permitted because she was the boss. It isn’t remotely similar to what Powell did and while I agree that the government classifies too much shit, that isn’t the case here either. She went against protocol because she wanted to and she could, and she should own the consequences. I don’t blame incompetence at State here. If she’d used her government accounts and followed normal procedures this would have been a non issue.
- marak830 11y ago
  Wait. She wanted to avoid FOIA? Is that allowed? If that is true, how the hell is she still running? (Non us citizen here btw)
  - apalmer 11y ago
    this is editorializing on his part. the rest of the post seems to be fact and not opinion, so i wish that sentence had been left out.
  - marcoperaza 11y ago
    Yes, this is the big elephant in the room. The only sane reason to have such an arrangement is to avoid oversight and accountability. The large number of deleted emails should also be a red flag as to what the real motive was.
    - marak830 11y ago
cm2187 11y ago
It's also a symptom that people in power are usually older generations and that we only start to see coming a generation of people who even use computers and emails. I guess previous Secretary of States must have used pen and paper. It's not exactly a vote of confidence that smartphones are so unsecure that the intelligence services will not even allow them within the walls of a secure building. Shouldn't that be the first problem on the list here?
- DanBC 11y ago
  >It's not exactly a vote of confidence that smartphones are so unsecure that the intelligence services will not even allow them within the walls of a secure building. Shouldn't that be the first problem on the list here? It's not just that smartphones are insecure enough to allow external attackers. Smartphones would also make it easier for another Snowden to exfiltrate material. And some of this is abundance of precaution - GCHQ and NSA banned Furbies because they weren't sure what would or wouldn't be recorded. http://news.bbc.co.uk/1/hi/world/americas/254094.stm http://news.bbc.co.uk/1/hi/world/americas/254094.stm
  - cm2187 11y ago
    That must be heartbreaking for NSA employees not to be able to bring their Furbies at work
mtgx 11y ago
> She's not a technology security expert Which makes setting up her own server all the worse. > They can't provide her with a secure device. They did, but it wasn't a BlackBerry one. BlackBerry or Windows Mobile, I don't think either were that secure anyway. I agree with the general sentiment that digital security in the government is between catastrophic and terrible. It's now going towards just "terrible", so there' some progress, I suppose.
- cyphar 11y ago
  > > She's not a technology security expert > Which makes setting up her own server all the worse. Obviously she didn't set up the server. She probably got one of her technical aids to do it. Probably not good either way, though. It's almost certainly unpatched. > > They can't provide her with a secure device. > They did, but it wasn't a BlackBerry one. BlackBerry or Windows Mobile, I don't think either were that secure anyway. > I agree with the general sentiment that digital security in the government is between catastrophic and terrible. It's now going towards just "terrible", so there' some progress, I suppose.
basch 11y ago
there are potentially two other possibilities, neither of which i necessarily believe 1) this exposes that Secretary of State is a figurehead to placate world leaders, a tool for diplomacy, but not highly respected or valued by the intelligence community. The position exists on the outskirts of what they care about locking down. 2) they left her to her own devices on purpose. it was a trap she fell right into. they knew she would make a bad decision and let her hoping it would lead her to her own demise.
ArkyBeagle 11y ago
I think you're stepping over the fact that during Bill Clinton's tenure as President, he was demonized and frankly slandered in a very hard-to-understand way. Last I checked, entire media empires were built on stories then that were simply made up out of whole cloth. Since Hillary Clinton was long expected to be a candidate in this years election, it's not too much trouble to use that as an explanation.
- jazzyk 11y ago
  Explanation, perhaps - justification, no. Interesting how people forget that our government is to serve its people, not its own career interests. Hillary Clinton chose to sacrifice the country's interests (major security lapse) in order to cover her ass and hide potentially unethical (perhaps even illegal) activity. All business conducted on behalf of the country should be made public as soon as it is safe to do so (no more than 5 years for classified material).
  - ArkyBeagle 11y ago
    The "career interest" I see in this thread are of the Computer Security Industrial Complex, which seem to have quite the bullet as a means of generating income these days. I have objection to this. They're dedicated professionals but sometimes they have big feet. IMO there is but one mode for computer security - lock and key, perhaps barbed wire, perhaps armed guards. And certainly no connection to the larger internet. That's me reading Bruce Scheiner. Probably badly - computer security bores me no end ( because I know of the one way to do it, you see... ) Bluntly, those who do not serve their own career interests simply won't be in government. The Anthropic Principle - it's not just for physicists. And that's rather beside the point. I'm by no means up on the details here, but it begins to look like there was no available solution that met requirements. This is straight up Dilbert "Mordac, Preventer of Information Services" nonsense. Was having email available optional for her? Probably not. And frankly, the entire narrative is that of imagined threats. I realize that's the mode de jour now but I still have the habits of looking for evidence not made up in the pursuit of political power. After seeing the Clinton-bashing effort outed completely ( but the rotting zombie corpse of it still in use as a political device - inexplicably ) I'm just not inclined to hold any other opinion. MY conspiracy has been proven and completely outed. I have little use for either of the Clintons, but there can be no explanation for the furor surrounding the American Spectator in that time except this one. Even when Neocon hit pieces were done on films like "The Power of Nightmares" they conveniently left out reference to the Clinton hit pieces, preferring to shore up the Neocon's evidence and other more tractable things. I simply find use of The Big Lie patently and irrevocably offensive.

davesque 11y ago

From the article: """ Clinton lawyer David Kendall later told the State Department that her “use of personal email was consistent with the practices of other Secretaries of State,” citing Powell in particular, according to a letter he wrote in August. But Powell’s circumstances also differed from Clinton’s in notable ways. Powell had a phone line installed in his office solely to link to his private account, which he generally used for personal or non-classified communication. At the time, he was pushing the department to embrace the Internet era and wanted to set an example. “I performed a little test whenever I visited an embassy: I’d dive into the first open office I could find (sometimes it was the ambassador’s office). If the computer was on, I’d try to get into my private email account,” Powell wrote in “It Worked for Me: In Life and Leadership.” “If I could, they passed.” Powell conducted virtually all of his classified communications on paper or over a State Department computer installed on his desk that was reserved for classified information, according to interviews. Clinton never had such a desktop or a classified email account, according to the State Department. """ ...sooooo. Colin Powell did the same thing as Clinton and all we have is his (and his staff's) claims that they didn't communicate classified information over inappropriate channels? So then what makes this situation any different or any more deserving of attention?

gcommer 11y ago
Wait, what? The 4 paragraphs you quoted seem to directly answer your question about how Powell and HRC acted differently ("Clinton never had such a desktop or a classified email account, according to the State Department.") Also, even if we now find out that Powell acted as poorly as HRC, that doesn't excuse either of them at all. It just means that they're both guilty, not that Hillary should get off the hook because previous Secretaries of State did it too.
- davesque 11y ago
  So that's all we have that makes what Powell did okay? Either he or the WP is simply assuring us that he never sent any important emails through his private email account (which he liked to log into from random computers)? Furthermore, isn't the point here that, apparently (if the stories of Powell and Clinton are any indication), the government doesn't really try that hard to secure the communications of its cabinet members? The way I had imagined it is that, as soon as these people take office, they're given the best crypto tech in the world. They're not told to take a hike because only the POTUS gets the good stuff. What kind of sense does that make?

Glyptodon 11y ago

The way she seems so cavalier and reckless over an inconvenience makes me doubt I'd really want her to be president.

freewizard 11y ago

Just curious: what's the os and email server used in this "basement server"?

mtgx 11y ago
> He also identifies the server routed to and from mail.clintonemail.com as a " Windows Server 2008 R2 with a valid SSL certificate," but that server, according to Mayer, is located at managed services company Internap. > Clinton's private email server was reconfigured again to use a Denver-based commercial email provider, MX Logic, which is now owned by McAfee Inc., a top internet security company. Except MX Logic isn't a "commercial email provider," it's a service that offers spam and virus filtering for email, very similar to Google's own Postini service. One of my friends who runs an ISP offers both Postini and MX Logic to customers but recommends MX Logic because he says the spam management is better. http://www.zdnet.com/article/clintons-little-email-fuss-beyond-servers-in-the-basement/ http://www.zdnet.com/article/clintons-little-email-fuss-beyo...
- ryanlol 11y ago
  Wow, that's actually even worse than I'd first thought. They didn't even have physical control over the server? So anyone could've exploited internaps vulnerable ubersmith install and asked them to boot clintons box into recovery.
  - basch 11y ago
    sending classified state secrets through a third party spam filter? that almost makes the "server in a basement" a bit of a fib. her emails were flowing through some private companies network first.

mentat 11y ago

Though I'm not sure it's even worth trying to bring up in the opinion filled noise of these threads, there is no way to secure current generation mobile devices sufficiently to withstand nation-state attackers. Full stop. The processors, basebands, MMUs, all of them lack the tools necessary to create a chain of trust with also sufficient isolation at the application level to run normal applications. When everyone is saying "of course the FBI could get into the terrorist cellphone, just take it to TAO," this same thing applies to Blackberries and Android phones when applied by opposite numbers in China or Russia. It is not possible to secure a mobile device from a nation-state attacker due (at least) to gaps in the hardware capabilities

visarga 11y ago
Also, it's not ok to use a phone that doesn't get regular security updates, but that means you have to trust the phone manufacturer or set up a team of experts to monitor each and every update. Can't trust the hardware, can't trust the software. How can this device be ok to be used by a state official?

studentrob 11y ago

Wow I really wouldn't want to be the guy who set up her email server. He was just granted immunity in exchange for cooperation, but that has got to be stressful to testify at the national level, plus against a Presidential candidate. Yikes.

sdrothrock 11y ago

> Their fears focused on the seventh floor, which a decade earlier had been the target of Russian spies who managed to plant a listening device inside a decorative chair-rail molding not far from Mahogany Row. This is a throwaway tidbit in the article that I wish had a link to some more details. That one sentence hints at a very interesting longform article on its own. Edit: I found these, which offer a few details. Surprising that it's from 1999! http://edition.cnn.com/ALLPOLITICS/time/1999/12/13/spy.html http://edition.cnn.com/ALLPOLITICS/time/1999/12/13/spy.html http://www.wsj.com/articles/SB944783077407465290 http://www.wsj.com/articles/SB944783077407465290

deleted 11y ago

[deleted]

marcoperaza 11y ago

The elephant in the room, which the media only occasionally brings up, is her motive for this arrangement. Based on the large number of emails that she tried to delete when the existence of this server became public, and her failure to previously include these emails in requests for data by Congress, we can deduce that the goal was likely to escape oversight and avoid accountability. A totally logical move for someone who is no stranger to scandal. And pretty damning to anyone who cares about making government accountable.

venomsnake 11y ago

One thing I don't get and drives me mad - why didn't she insisted of using pgp, but sent them plaintext. A chimp could learn to use it in 2 hours. So I guess for a career politician it would take a week. But it is doable. What worries me is not the ethical part - I am yet too cynical, but the total disregard of basic security.

DanBC 11y ago
> A chimp could learn to use it in 2 hours. The chimp needs everyone else to be using PGP too. Since everyone else is using the already secure email networks they see no need to use PGP. And, really, PGP is not that easy to use. It's very easy for people to make mistakes with PGP.
- venomsnake 11y ago
  If I am secretary of state, the only persons that I could not force to generate key and use enigmail are probably the president and the VP. A simple policy - I have tuned the server to discard any non encrypted and non signed email will force big chunk of the beltway elite to learn a new thing.
  - basch 11y ago
    enigmail works for blackberry? if you read the article, its pretty clear her entire team were blackberry users and refused to use anything else to communicate with each other.

saboot 11y ago

How does the voting system on HN work? This is the second article on this topic I've seen today removed from the front page now. It was there only an hour or so ago, and now isn't in the first ten pages on HN.

studentrob 11y ago
Maybe some stuff gets flagged to death? Not sure exactly. I've seen other controversial topics drop off the front page that have recent submission times, and a decent number of points and comments, while others with similar stats remain on the front. ¯\_(ツ)_/¯
nkurz 11y ago
The charts at hnrankings.com can give you an idea of what happened to it: http://hnrankings.info/11372264/ http://hnrankings.info/11372264/ Among the things that can cause big drops: User flagging. Administrative action. Staleness (some number of hours on front page) Flamewar detector (flurry of responses to responses) It's difficult to distinguish between these from the outside, but a polite email to Dan (hn@ycombinator.com) will probably get you a specific answer if you are interested. Based on asking about similar stories, this one would be a tossup between "Flamewar" and "User flags".

deleted 11y ago

[deleted]

throwaway284534 11y ago

How long do we have to hear about this debacle? Seriously, it's enough already. There's no new information to discuss.

selllikesybok 11y ago

https://en.m.wikipedia.org/wiki/Bush_White_House_email_controversy https://en.m.wikipedia.org/wiki/Bush_White_House_email_contr...

jakeogh 11y ago

To get a copy: https://github.com/wsjdata/clinton-email-cruncher https://github.com/wsjdata/clinton-email-cruncher