[untog]

Among the more disappointing things in all of this is that there is a rational, important conversation to be had about everyday awareness of security and government inflexibility. But there won't be, because she is Hillary Clinton and it is 2016.

Supposedly she got the server set up because the NSA refused to give a politician who travels frequently a secure smartphone. She (I personally believe) was likely ignorant of many of the security requirements of such a server (even one set up for unclassified e-mail), as was whoever set it up. And no-one on her staff either knew enough or was willing enough to say anything. She is also supposedly not the first Secretary of State to have an arrangement of this nature.

This feels like the very definition of systematic failure and clearly needs to change. But the conversation is almost exclusively based around a) her having nefarious motivations, because she is Hillary Clinton, or b) this all being a Republican plot to derail the Democratic candidate for President.

It's all very depressing.

[ctdonath]

Supposedly she got the server set up because the NSA refused to give a politician who travels frequently a secure smartphone.

Baloney. She was the second most powerful person in the US government. If she couldn't get them to provide modern secure communications, she had the ear of the one who could.

If it was as you say, and truly that systemic a problem, then indeed heads should politically roll - starting from the top, which means her.

Handling national secrets on a cheap generic PC in one's bathroom because a subordinate huge-budget agency won't cooperate is a sign of gross incompetence on many levels. If jail time is what it's going to take to motivate people to get this systemic problem solved, them so be it. The standards are obvious, and ominously violated to a dangerous degree.

[secabeen]

Here are the results from the FOIA request that underlie that statement. The NSA certainly pushed back. https://www.judicialwatch.org/press-room/press-releases/judi...

[mtgx]

I think the NSA wanted to give her a secure Windows Mobile (or whatever it was called back then) phone, which may have been better supported. They also mention security issues with Blackberry, presumably even if they tried to make it "secure" themselves.

If I remember correctly, they didn't want to allow Obama to use a Blackberry either back then, but he was a big fan of Blackberries and said he couldn't use the much uglier and brick-like alternatives. So I think they eventually compromised for the president. But I don't think they were just going to do it for everyone else, at least not at the time.

[rveeblefetzer]

The Blackberry alternative that was suggested to Obama was the Sectera Edge by General Dynamics, which made the F-16 before it was sold to Lockheed

http://www.networkworld.com/article/2234082/what-obama-won-t...

[cm2187]

That looks worse than an old nokia brick...

[eli]

Ever work in a really large oraganization and try to demand something from some far-flung other division? Not so easy.

She shouldn't have set up her own server. And the NSA should have been more sensitive to how important mobile email is to a modern diplomat.

[JonFish85]

"Ever work in a really large oraganization and try to demand something from some far-flung other division? Not so easy."

As someone reporting directly to the CEO, I bet it's not so hard... And "but it was really hard" isn't exactly a solid excuse for... anything?

[c_c_c]

The NSA isn't subordinate to the State Dept.

[therobot24]

>> She is also supposedly not the first Secretary of State to have an arrangement of this nature.

http://www.politifact.com/truth-o-meter/statements/2016/mar/...

Politifact rates this idea mostly false.

[jbooth]

They rated the statement 'my predecessors did the exact same thing' mostly false. Editorial choice -- they could have rated the statement 'none of my predecessors followed proper procedure for email either' and found it true.

Powell maintained his own email but without the server in his house, Rice claims she avoided all email, so we have exactly 0 secretaries of state who've handled email 'the right way' in 220-some-odd years of this fine country.

[gscott]

Colin Powell at the time many of the people he communicated with just didn't use email... He has had two of his emails marked as classified...

http://www.upi.com/Top_News/US/2016/02/05/Colin-Powell-Condo...

[hugh4]

I dunno, I'd say that everyone prior to nineteen-ninety-something handled it the right way.

[bhauer]

Indeed. I believe she should be investigated and prosecuted for this, but I nevertheless think it remains a mostly credible claim with respect to Powell. If I understand correctly, Politifact makes the argument that Powell used a personal e-mail address at an established service whereas Clinton installed her own mail server.

As someone who believes strongly in revitalizing self-hosting, I find focusing on Hillary's use of a personal mail server (and not on the fact that it was not an official e-mail account, full stop) to be unfairly marginalizing personal mail servers or personal servers in general. There's nothing wrong about running your own mail server. The problem is running your own mail server to give yourself a personal e-mail account to use in your job as Secretary of State. But the key part is using a personal e-mail account for your job that involves dealing with highly sensitive and classified materials—an action that would get most government employees fired if not imprisoned.

[zzzeek]

> prosecuted for this,

feel free to name specific legal statues that were violated as well as which are misdemeanors or felonies.

[stillusingvb6]

18 U.S.C Sec. 793(f)

[zzzeek]

here's a great rebuttal to that:

http://lawnewz.com/high-profile/no-hillary-did-not-commit-a-...

using this statue to prosecute would not only violate the spirit and intent of the law but also be very unlikely, given precedent, to result in any conviction. Hence a competent prosecutor would likely not seek to prosecute based on this law, nor should they, as it would be a waste of taxpayer money not to mention the ill effect it would have on our electoral process (sudden unnecessary prosecution against particular candidates unlikely to lead anywhere).

[stillusingvb6]

Jan 29th. Seems like the information released in the last few days points to her knowingly violating security protocol.

I doubt she will be prosecuted but this has sunk her campaign. It's over.

[tim333]

“Whoever, being an officer, employee, contractor, or consultant of the United States, and, by virtue of his office, employment, position, or contract, becomes possessed of documents or materials containing classified information of the United States, knowingly removes such documents or materials without authority and with the intent to retain such documents or materials at an unauthorized location shall be fined under this title or imprisoned for not more than one year, or both. “

Applying that to Hillary's case is a bit of a stretch. It's not like she was downloading all the confidential stuff at the White House and emailing it to herself. And anyone emailing to clintonemail.com would presumably guess that was going to the Clinton's email server.

[merpnderp]

I've almost entirely given up on conversations in HN threads, but the recent State Dept Inspector General's report concludes that after the server was found to be compromised, the staffers who found the issue were told to never speak of it again.

This wasn't just poor IT security, this was willful ignorance of the consequences of state secrets being in the open. It is incredibly likely she was targeted by foreign intelligence. And perhaps Russia found it useful that no one was talking about their impending invasion of Ukraine or Iran learned how desperate the administration was to cut a deal? There were a thousand ways this could have undercut US foreign policy, which has recently been disastrous (Like when Hillary hung up the phone on her Russian counterpart in 2012 when Russia was trying to negotiate a peaceful conclusion in Syria - according to the Wikileaks embassy cables).

[GVIrish]

> This wasn't just poor IT security, this was willful ignorance of the consequences of state secrets being in the open.

To be clear, this was unclassified email. Classified email is on a separate network.

Certainly having access to the Secretary of State's unclassified emails could yield valuable intelligence insights but these are not emails that are going to contain "secrets" per se.

[merpnderp]

That's absolutely not clear at all. Content from SIPRNet and JWICS both ended up in 1,340 of the emails on Hillary's server. The CIA has reviewed the emails and said that several of them contain partial content from their highly sensitive intelligence on human intelligence.

We won't know for sure until the FBI investigation is complete, but it is looking like this wasn't an accident but a cavalier attitude towards handling sensitive intelligence.

But given how no one seems to care how she handled Syria, Iraq, and N. Africa, it's obvious it doesn't much matter how she handled secret information.

[GVIrish]

Right, but State Department has Classnet for classified materials, this is not a case of Clinton plugging into Classnet with a private server.

The fact that other people sent information to her Opennet email address that contained information derived from classified documents is not necessarily damning for Clinton. If someone from DoD or any of the intelligence agencies pulled information from a classified document and sent it to a public email address, that spillage would be on the sender.

If Clinton realized that classified info came into her inbox then she would be responsible for getting that information off an unclassified machine. But if someone pasted an excerpt from a classified source into an unclassified email, the recipient of that email may not know that it was in fact classified information. Certain types of information should ring alarm bells for the recipient, but the classification of other types of information are not always going to be apparent if the information is not marked (secret, top secret, sbu, etc).

To date there doesn't seem to be anyone claiming there was intentional spillage on Clinton's part, or that she personally took classified information and put it on an unclassified system. There may yet be more revealed but right now it doesn't look like she did anything meriting prosecution.

[ChuckMcM]

I agree with this, but the failure is one of the government to "train" its appointed/elected members adequately. It should never be acceptable for STATE to conduct official business over private email, that just just be the rule. And while previous secretaries have also "worked around it" it is something the FBI should intervene on and enforce. The pressure of it being hard to do can lead to better funding/resources on making it easier to use, but the going in position should be "You shall not ... and if you do we're coming after you."

[tomohawk]

"And no-one on her staff ... was willing to say anything

Doesn't seem to square with:

http://www.computerworld.com/article/3075347/government-it/s...

[themartorana]

What's the rationale for not giving everyone secure smartphones? And I mean high-ranking officials, SoS certainly ranks considering how much she/he is in foreign countries with foreign leaders. Can someone in the know explain why the NSA would deny such requests?

[untog]

Difficult to know for sure. Obama had one, Rice previously used one, but:

The NSA refused to give Clinton a device similar to the one used by Obama: a modified BlackBerry 8830 World Edition with additional cryptography installed. And while Clinton's predecessor Condaleeza Rice had obtained waivers for herself and her staff to use BlackBerry devices, Clinton's staff was told that "use [of the BlackBerry] expanded to an unmanageable number of users from a security perspective, so those waivers were phased out and BlackBerry use was not allowed in her Suite,"[1]

This being Clinton there are probably conspiracy theories (the NSA is out to get her!) but I suspect they simply didn't want to have to deal with it, and had the ability to say no. So they did.

[1] http://arstechnica.com/information-technology/2016/03/nsa-re...

[snappy173]

>Clinton's staff was told that "use [of the BlackBerry] expanded to an unmanageable number of users from a security perspective

if you don't provide a secure way to get shit done, motivated individuals will figure out how to get shit done, security be damned. happens every time. that's what happened here.

[ryanlol]

They offered her a non-blackberry alternative. That's not what happened here.

[_dominic]

You could rephrase it, "if you don't provide [an easy and] secure way to get shit done, motivated individuals will figure out how to get shit done, security be damned. happens every time. that's what happened here."

[ryanlol]

To be fair, the device she was offered doesn't look that bad. It even comes with a blackberry style keyboard.

[ams6110]

They refused to give her a highly customized hardened BlackBerry. She could have used a laptop or other device. There is no way they don't have a standard secure remote email capability, she just wanted what Obama had, and they said no, we aren't supporting any more bespoke devices for individuals. Which is totally rational from a security standpoint.

[CRConrad]

Idunno, this might be a little spellOCD of me, but I find it hard to take an article seriously that not once, but at least twice -- judging just from the quote here plus the lede, not even having read the article yet -- misspells the name of a Secretary (albeit a former one) of State.

[basseq]

In all fairness, Obama's use of a smartphone was unprecedented. I read (but cannot find a reasonable source now) that Obama's Blackberry was tethered to a private base station, not any kind of public network, cellular or otherwise. So "secure smartphone" is a term that really means "secure infrastructure".

That infrastructure simply isn't scaleable.

[Edit: See this HN comment for sources. https://news.ycombinator.com/item?id=11306380]

[Crespyl]

Supposedly his phone is also locked down to just ~10 other similarly secure numbers, while Clinton wanted to be able to use her secure phone to call her entire staff. That would've required dozens or hundreds more devices, which is a problem when every possible loss or compromise of any device is such a huge deal.

[rdiddly]

I liked where I _thought_ you were going with that. Why not give ALL OF US secure smartphones. Indeed. Indeed.

[themartorana]

The NSA is already in my smartphone. If they gave me a secure smartphone, I'd still feel pretty much like I do now.

[hobs]

Probably because they know how to pwn all of them, and are certain they are insecure or an absolute nightmare to secure.

[na85]

No doubt whatever mods they make for the POTUSberry are resource- and time-intensive.

[exabrial]

Actually no, we're fortunate this isn't happening in 2017, or 2018. We can still keep her out of office, and we should, on moral grounds, not party grounds.

Unfortunately, the alternatives to her aren't that great either. I'm hedging my bets until November, hoping some sort of miracle happens. Hoping this election invokes the 12th amendment and goes to the house. I feel none of the current candidates would be eligible and we'd get a fresh start.

[coredog64]

Sweet Meteor of Death 2016!

[heurist]

The house would be the opposite of a fresh start, and would likely hand it to Trump (or whatever right-leaning 'independent' might happen to show up).

[exabrial]

They are very displeased with him actually, remember Trump has alienated all the establishment in his party. And the house can nominate whomever they want.

[Torgo]

>Supposedly she got the server set up because the NSA refused to give a politician who travels frequently a secure smartphone.

She didn't want the one they offered her, which was an older-style Windows Mobile phone. As the emails frequently note, she is not a "computer person", she knew how to work one kind of device for accessing email and refused to use anything different. They offered her a secure computer with a dedicated outside line even inside State, but her handlers thought she wouldn't even be able to deal with the concept of accessing her email on a PC rather than a Blackberry. I am not bashing Clinton here, I am just reading back the stuff from the emails that was on JudicialWatch.

What's "depressing" to me is that I have had to handle classified material in the past and there's zero doubt what would happen to me if I handled this shit like her and her staff did, but there's going to be zero material consequences for her. I kind of feel like there's two sets of law books, ones for peons like me, and ones for special people like her.

[Crespyl]

If our Secretary of State and would-be President can't be bothered to learn how to read email on a PC, even (especially) for the sake of information security, I think that deserves a little bashing.

[panglott]

They're too busy to make an appointment with their desk to read emails, and the government can't supply a secure smartphone to anyone less high up than the President himself? Even the Secretary of State? Just bizarre.

[mason240]

>Supposedly she got the server set up because the NSA refused to give a politician who travels frequently a secure smartphone.

I have a very hard time believing that the 3rd (possibly 2nd) highest person in the US government couldn't get their IT requests fulfilled.

[GVIrish]

The NSA is not beholden to the State Department so they could very easily have told her no. Even between different branches of the Armed Forces there is limited ability to force the issue if another branch doesn't want to do something.

[sandworm101]

It's not A or B. They are not mutually exclusive. She can be evil and the subject of a plot. In fact, given that she is a politician, A is a most certainly true. And given that she is a candidate for president, so is B.

[magoon]

> She is also supposedly not the first Secretary of State to have an arrangement of this nature.

Careful with the phrasing - it has been said others have used "private e-mail" but that is, to me, not the same as setting up a server and using it exclusively.

Do you know anybody with their own home email server?

[NDizzle]

Maybe it was rhetorical but I know dozens of people with home email servers. I set up my first one, personally, in 1997.

[dragonwriter]

In context, that was implicitly "any previous US Secretary of State", not "any human being on Earth".

And I think the OIG report expressly said that Clinton was the only one to have done so.

OTOH, one could argue that a third party non-government, non-sanctioned, email system that the official does not control is potentially worse in many ways than a personal email server, as in the latter case the official at least in principal had control of retention and access and other aspects of the behavior of the system.

[mc32]

I think it's one thing to have run your own email server back in the early 2000's and doing the same in the mid teens. There is much more sophistication in terms of adversarial means and methods as well as sheer number of adversaries --as well as "education" about security.

[maratd]

> This feels like the very definition of systematic failure and clearly needs to change.

> It's all very depressing.

Not at all.

Because of this fiasco, every clown with political aspirations will be using an approved and encrypted system instead of rolling their own garbage.

[chatmasta]

What about the threat of the agency who secures the system simulateously compromising it in order to gain blackmail material on its user?

[lazyjones]

In that case, I'd worry about the user doing unlawful/immoral things they can be blackmailed with. Agencies have made up accusations and set up traps for politicians in the past (and worse: see FBI vs. Martin Luther King, Jr.). If they can blackmail a person with the truth, chances are that others can do it too (criminals e.g.).

[glasz]

conspiracy theory.

[chatmasta]

Isn't one of the main arguments against dragnet surveillance the possibility for the surveiling agency to blackmail the politicians who write the laws limiting its power?

The same argument surely applies to targeted surveillance...

[glasz]

sure. i was aiming to poke people citing occam's razor when controversial matter comes up because cognitive dissonance or whatever their problem is. sheep like to chose the easy path of denying things like you suggest ... until snowden gives up his life. and still they go about their useless business.

but after all, it _is_ a conspiracy theory because there would be at least two parties involved conspiring to blackmail. sheep also don't get what the term actually means.

[cookiecaper]

Isn't it possible that there is sometimes conspiracy fact? That something is a conspiracy theory doesn't automatically invalidate it.

[glasz]

correct. you've got it.

[stillusingvb6]

She knew what she was doing

[foxylad]

No, she didn't, on many levels. Her underlings should have known better, but if a 68-year-old politician knew anything about internet security practices, I'd vote for them!

[stillusingvb6]

Her underlings were speaking up and were promptly silenced.

"The first query was dismissed by Clinton’s deputy chief of staff, claiming that the requirement to use two devices for official and personal e-mail “didn’t make a lot of sense.” Staffers raised concerns again the next January, but were told by a director that Clinton had received approval for her private server, even though she never requested it. Furthermore, the same official “instructed the staff never to speak of the Secretary’s personal e-mail system again.”

http://finance.yahoo.com/news/now-know-hillary-lied-multiple...

[elif]

So, after a bogus real estate fraud investigation lead to the revelation of one of Bill's affairs and his subsequent impeachment, and then congress created committees to pour through her records for dirt, you know "on many levels" that she is accidentally keeping her records private. right.

[atf104]

This is really the crux of the case no one is talking about. There seems to be this notion she set out to do this evil deceptive thing. She had no idea, if anything her underlings were to blame. It was a colossal error, and she's terrible at articulating just about anything, let alone this failure.

Our choices this cycle are extremely poor, but I'll take her finger on the button any day of the week over the real estate oompa loompa.

[stillusingvb6]

She knew. People spoke up. She lied. There is a reason she is getting hit from every major news org.

http://finance.yahoo.com/news/now-know-hillary-lied-multiple...

[atf104]

Ok she sucks, but she's still the lesser of the two evils imho.

[stillusingvb6]

Not sure I'd agree. Seems like her voting record aligns more with neocons than liberals (war, traditional marriage, super predators, etc)

[facetube]

There are three options left. The democratic party has not nominated a candidate yet.

[curiousgal]

>It's all very depressing.

It's not if you don't think about it. And given how it's not personal, that can be done.

[a3n]

> Supposedly she got the server set up because the NSA refused to give a politician who travels frequently a secure smartphone.

That would have made it more difficult for the NSA to spy on her. I know this sounds cynical, but really, do you think the NSA doesn't spy on our government officials?

[mikecb]

This isn't about a secure smartphone, because you can't use a secure smartphone on insecure networks, like with regular email.

[nickpsecurity]

Re smartphone NSA refused to let her use a specific phone. There were several smartphones and certified solutions available. Hillary only wanted Blackberry. Quite opposite of your statement.

Re nefarious motivations. The server and its location weren't just used for diplomatic stuff. There are nefarious things going on. She worked hard to block any FOIA requests or supeonas that would enlighten us more. The mark of an honest politician or nonprofit. ;)

[GunboatDiplomat]

Ignorance of the law is not a defense.

[glasz]

much has been said and what comes to mind first is: sheep are sheep.

[dang]

Please stop posting unsubstantive comments.

[glasz]

please don't insult me.

[atf104]

So does this make Trump a more qualified candidate now?

[untog]

No?