Saturday, August 22, 2015

Hillary's Email Server Journey


As a former Air Force member with Top Secret Clearance, and a technologist with several decades experience, Hillary's email issues, prompted my journey to understand what happened.

How did it start?

Step 1 - When President Clinton left office he had an email server installed in his Chappaqua, New York home. Since Secret Service was guarding Clinton's home, an email server there would have been well protected from theft or a physical hacking. The former President paid out of his own pocket for the email server setup and hired two people, one of them, Eric Hothem, a former aide to Hillary Clinton when she served as First Lady, to set it up, and maintain it. Hothem is associated with a email server, presidentclinton.com, and a non-functioning website, wjcoffice.com, using the former president's full name, William Jefferson Clinton.

Step 2 - When Hillary started working at the State Department, she learned President Obama would not allow private emails to be accessed on the government supplied phones. So she had to make the decision to use the governments email system or have multiple devices, the government supplied, and one with a private email system like Hotmail or Gmail. She asked and was allowed to have her own email server and to use one device for all her emails. By forwarding and copying messages to department employees at their government addresses, she was told her emails would be preserved in the State Department Archive system.

Question: Who approved this waiver?

Step 3 - The computer server that transmitted and received Hillary Clinton's emails traces back to an Internet service registered to her family's home in Chappaqua, New York. Internet business records show that the domain clintonemail.com was registered Jan. 13, 2009, a week before she was sworn in as Secretary of State (SOS). The domain was registered to Justin Cooper, a longtime adviser to former President Bill Clinton. Hillary would go on to use the email, hdr22@clintonemail.com.

Step 4 - The President's staff did not want Hillary to use their email server and she was told their computer server wasn't using the latest trusted Web certificates, but gave in, and she also hired Eric Hothem to set up and someone to maintain her private email system on the President's server. Hothem was listed as the customer in Chappaqua registering the Internet address for her email server. Kevin Bocek, a Vice President at the Internet security company Venafi, said the Hillary's server was encrypting data it sent and received as of March 29, 2009, about two months after she took office.

Step 5 - In November 2012, after the hurricane Sandy took down the home server, Hillary's private email account was reconfigured to use Google's servers as a backup in case her own personal email server failed, according to Internet records.

Question: What information might be on the Google's backup? What backup process was used on the home email server and where is it?

Step 6 - Hillary left the State Department on February 2013. Then, in July 2013, four months after she resigned, her private email server was reconfigured again to use a Denver-based commercial email provider, MX Logic, which is now owned by McAfee Inc., a top Internet security company. The physical server was moved to Platte River Networks in Denver, Colorado. The server data was copied to another server and the original server was disconnect from the WWW. It is the emails from her old server that was given to the State Department, personal emails were deleted, the server scrubbed, and given to the FBI.

Question: What information was copied to the new server in Denver?

Step 7 - In 2014, after Clinton stepped down as SOS, the domain registration was changed to Perfect Privacy, a proxy company that allows domain users to shield their identities. It's a common practice among domain owners who don't want their personal information listed on a public database.

It was difficult to gather from my review of available information what the exact path of this journey took. So this is my attempt at walking the path.

Classified Email Issue
The classifying of documents is always a department "eye of the beholder" issue. Especially when documents are being reviewed for Freedom of Information Act (FOIA) requests. I have been told some departments classify everything to play it safe. So I will hold my opinion until more details come out.

On August 21, 2015, Washington, D.C. lawyer David Kendall, in a letter sent to the State Department's Undersecretary for Management, "Secretary Clinton's use of personal e-mail was consistent with the practice of other Secretaries of State and was permissible under State Department policy in place during her tenure," Kendall writes. In his letter, Kendall quotes from a memoir by former Secretary of State Colin Powell who wrote that he used his personal email account for messages to "principal assistants, to individual ambassadors, and increasingly to his foreign-minister colleagues." Clinton's use of her personal account was also permitted by Federal regulations, Kendall says, including rules issued by the National Archives to implement a Federal law on record preservation. In 2009, Kendall says, the rule explained the practice to be followed when Federal agencies "allow employees to send and receive electronic mail messages using a system not operated by the agency." In that event, the employee must ensure that a record of the email is obtained in a government system. "Secretary Clinton followed that regulation through her practice of communicating with other Department officials on their state.gov e-mail accounts," Kendall's letter says. By forwarding and copying messages to department employees at their government addresses, her emails were preserved in the State Department system, he said.

In March 2015, the Government Accounting Office found that the State Department's archiving system was seriously flawed and that only a small percentage of e-mails were actually saved during the period in question.

UPDATE
On Aug 25, 2015, the State Department spokesman John Kirby said, “We have said in the past, that there was no policy prohibiting the use of a private email account here at the State Department, and that is still a fact. Now, obviously, we have policies in place now that highly discourage that, and you are supposed to use your government account so that there is a constant, permanent record of it, but at the time she was not violating policy."

I know there are holes in this journey. So let me know what you have found.











NYC Wins When Everyone Can Vote! Michael H. Drucker
Digg! StumbleUpon

No comments: