Hacker News Reader

Comment by koolba | Hacker News Reader

> In other words, "don't think that because Hillary can get away with it, you can, too."

Seems like that's reinforced by this line as well (emphasis mine):

>> Although there is evidence of potential violations of the statutes regarding the handling of classified information, our judgment is that no reasonable prosecutor would bring such a case. Prosecutors necessarily weigh a number of factors before bringing charges. There are obvious considerations, like the strength of the evidence, especially regarding intent. Responsible decisions also consider the context of a person’s actions, and how similar situations have been handled in the past.

View on HN

>> how similar situations have been handled in the past

Has there been anything like this before? If I work for the government and forward confidential and secret emails through to a server I'm running myself I imagine I'd have criminal proceedings against me.

I believe yes. Similar things occurred with Colin Powell and Condoleezza Rice. The precedent being set is: if you're a government officer or official, you're exempt from the law. And even though that may not be the full truth, its the perception that the public is picking up on and it's very bad to be occurring. Depending on who you are, who your friends are, and who you know, if you have the connections you can rest not having to know the law(s). You and I? We must always be on alert, vigilant, and know all the laws at all times lest we be prosecuted. No wonder trust in government is eroding. We need to either a) actually enforce the laws on the books or b) remove the laws from the books we don't intend to faithfully enforce. Selective enforcement is a tragedy.

>Similar things occurred with Colin Powell

not even close. he had a personal aol account he used to test internet connections abroad. he had separate classified and personal lines going into his office, connected to separate devices.

There was classified email in Powell's personal, non-classified email account [1] [2] [3].

[1] http://www.nytimes.com/2016/02/05/us/politics/state-dept-cla...

[2] http://mediamatters.org/blog/2016/03/07/state-dept-concludes...

[3] http://www.politifact.com/truth-o-meter/statements/2016/mar/...

there were two emails, sent to him, that were retroactively marked as classified.

he personally reviewed them and said he has no idea why they are marked classified, and they shouldnt be.

sounds like politics to me.

I think there is a difference between administrative consequences and legal consequences. And Comey was running a criminal investigation. I think that she should not be able to get a security clearance for any unelected position. I don't really think that she escaped a criminal conviction because of who she is.

I also think that +50% of voters electing her president should override that concern if she wins this election. But that's not because I think the law shouldn't apply to her, its because I think the president needs access to classified material.

> the precedent being set is: if you're a government officer or official, you're exempt from the law.

And if you vote for HRC, you're endorsing this POV. Though, at this point I'm willing to believe that at least half the country has no problem with it.

The Reagan Administration sold arms to Iran and used it to fund the Nicaraguan Contras.

Bill Clinton got a blowjob and lied about it.

George W. Bush invaded a country that had nothing to do with 9/11 and created a 13 year mess that has culminated with the creation of ISIS.

Hillary Clinton mishandled some classified e-mails.

creation of ISIS is the result to Hillary's and Obama's policies.

Bill looks kinda odd in this list. i like the guy, he lived good life.

before you downvote, try to remember who invaded Lybia, which opened major can of jihady worms. maybe you also remember Bengazi. then think which president started mess in Syria (second major source of jihadies and home to ISIS). Bush was a moron, but it doesn't mean we should blame him for everything.

Who doesn't love the politics of consequentialism?

violating the terms of your security clearance agreement is not generally a criminal offense. You will almost certainly lose your clearance and your job but you have to have committed an actual crime to be prosecuted. If their is not evidence of classified material being leaked then there is no crime. My guess is that there is no evidence of a crime in this case. If she were still Sec. of State she would have bigger problems I imagine because she would lose her clearance at the very least and likely her job. Where things get interesting to me is that by being elected to office she is put in a position to require a clearance. A typical person (one that has had a clearance revoked) would not be granted a new clearance. I suspect the rules are different when you get elected president.

> Where things get interesting to me is that by being elected to office she is put in a position to require a clearance. A typical person (one that has had a clearance revoked) would not be granted a new clearance. I suspect the rules are different when you get elected president.

Being elected POTUS automatically gives you the highest ranking clearance, end of discussion. You could have been a convicted felon with your security clearance stripped and no chance of getting it back, the moment you become POTUS all of that becomes irrelevant for your term.

Indeed. If she were still SoS, she'd probably have to resign over this. But the idea that she could be denied a security clearance as president is kind of ludicrous - especially when you consider that the point of security clearance rules is not to protect the data, but rather to protect the nation. A president who couldn't see the data required to make sound decisions would be actively dangerous. It'd be like driving with a blindfold on.

Of course, this won't make much of a difference to her partisan detractors. Haters gonna hate, and the email scandal is not so much reason as excuse for most of the people who already oppose her. But if she is elected, of course she'll get full presidential security clearance. To do otherwise is stupid.

What matters most to me is that we make changes in both policy and process so this doesn't happen again - policy in that it becomes crystal clear that private email for public business is unacceptable, and process so that the "If you can do your job, we're not doing ours" vibe of the info security world doesn't make the Secretary of State (or anyone else) feel like they can't do their job properly using the official channels.

> the idea that she could be denied a security clearance as president is kind of ludicrous

Certainly so. I'm not sure the same is true of the idea that someone with a proven record of such a careless attitude toward security should be denied the presidency on that basis. That seems like a discussion worth having, although, given the modern political climate in the United States, not one likely to actually occur in any way that's even marginally useful to anyone.

I wouldn't call it a "careless attitude toward security". She's thinking in a different way than we do, because she's a diplomat, not an engineer.

There is no technical reason that a privately administrated email server would be inherently less secure than a government-administrated server (there are good arguments that it's likely to be more secure). However, a private email server is likely to be far more user-friendly and free of "security theater" constraints. Speaking from experience, the usual approach of government and other large organizations to "security" is to throw user experience out the window, forcing ugly/retro "proven" tech on users, requiring complicated and difficult administrative steps to use the system, slow approval and ticketing processes, etc.

The primary job of the Secretary of State is to communicate. Any time wasted on arbitrary tech hoop-jumping, any restrictions on how that communication happens, is keeping the SoS from doing their job. Can you imagine if we were in the middle of a political crisis and suddenly the Secretary of State is on hold with tech support while dealing with a forced password reset or something equally stupid? American lives at risk, and Lotus Notes is the only way to communicate? Etc. See the issue here?

To really resolve the problem, they would need a relentlessly service-oriented approach for whomever is responsible for email at the State Department. It would have to be as friction-free an experience for the user as possible, within the boundaries of security.

Until then, every Secretary of State is going to put their ability to communicate quickly and easily with the most important and powerful people in the world ahead of the kinds of technical wank that the average HN user thinks is important.

I absolutely do see the issue. But I'm not quite ready to concede that

> the kinds of technical wank that the average HN user thinks is important

includes whether or not the details of diplomatic communications at the highest level of our government are trivially available even to middle-tier private actors, to say nothing of potentially hostile states. Call it "technical wank" if you like, but information security exists for a reason, too. Can you imagine if we were in the middle of a political crisis and suddenly most of the Secretary of State's electronic communication is freely accessible to the same people with whom he's trying to negotiate an outcome favorable to the United States? See the issue here?

I totally get what you're saying with regard to user friendliness being a primary concern at this level, and I agree with it. I don't agree that the proper response to UX concerns, however difficult, is simply to throw security to the winds in the cause of easing communication - because security is a primary concern at this level, too.

I don't think of a well-secured email server as "trivially available". I'm presuming that the private server in question could be and was well-secured. Again, I'm asserting that there is no technical reason that a well-administrated private server cannot be every bit as secure as a government-managed server that provides the same access to the outside world. The suggestions of air gaps and other measures suggested here simply won't meet requirements. Remember, those "potentially hostile states" are exactly the kind of actors the SoS needs to be able to reach via email.

Moreover, the security of individual emails depends on the security of the recipient as well as that of the sender. Sensitive/classified emails sent to officials of non-US governments are subject to whatever security they might have. The only solution to this leak vector is to completely ban email as a means of communication - which gets right back to the core requirement that the Secretary of State must be able to communicate quickly and efficiently.

I'm not arguing to "throw security to the winds", and I don't think that's what was done here. Again, I'm asserting there's no reason to believe an email server administrated by the State Department would be any more secure than an email server administrated by skilled private admins.

You're conflating a well-secured email server administered in conjunction with State's infosec team - which I agree would be perfectly reasonable from a security perspective - and what actually obtained in the case at hand.

You're also conflating the responsibilities of State Department personnel with regard to information classified by the government they've sworn to serve, and the responsibilities of other nations' diplomatic personnel with regard to information originating in the government of a state foreign to them.

Neither seems especially conducive to a useful discussion of the matter at hand.

It's not especially conductive to the dream of charging Hillary Clinton, I suppose. But it's a good point.

More to the point, shadow IT exists for a reason. Taken out of the context of the State Department and the political sphere, this was classic shadow IT. I've used shadow IT, and I've provided shadow IT, because I've worked a lot in large, sluggish bureaucracies, and that's How Things Get Done sometimes. "Security" becomes a catch-all excuse for laziness and cowardice.

If she felt like she could do her job with the existing State Department tools, she wouldn't have set up a shadow IT operation, period. It's not like she's completely ignorant of either operational security or political ramifications. To do this, she must have felt thoroughly hampered by the existing system.

I'm sure she did. Perhaps that's a mitigation, and perhaps it's not. Assuming you're right about the extent to which using blessed IT would have made it impossible for Clinton to discharge her diplomatic office, she might have resigned, rather than choose between being derelict in her duty and being derelict in the responsibility she accepted with her oath of office. A high-profile resignation like that, in a preeminent department like State, might have been a cause for real change. Or it might not; we'll never know. In any case, it would've been the principled thing for anyone in such a position to do.

Sticking around at the expense of her oath of office doesn't seem to have worked out all that poorly for her, since she's still apparently a serious contender for the presidency. Should she end up in it, one hopes she'll take that oath a little more seriously than she did the last one.

So she spent four years doing a job she loved, building her credibility for the job she dreamed of probably since childhood, and she did it very well (or as you call it (derelict in her duty and expense of her oath of office). She ran shadow IT so she could do her job efficiently. The cost of it politically was a partisan outrage-scandal that didn't actually change anyone's opinion - those who hate on her would have hated on her anyway, and those who don't aren't interpreting this as treason.

I'd say she won.

Couple of considerations.

There are technical reasons that SIPR and JWICS communications are more secure than a private server. Mostly related to air-gaps and physical key infrastructures.

Secondly, the correspondence in review is internal and not so much related to the external communication role of the SoS. In this specific circumstance, the SoS chose to forgo the security apparatus for internal classified communication for something more user friendly.

An air gap would mean her private email could not reach computers on SIPR and JWICS which implies the SOC's email is not on those networks.*

*baring some sort of store and forward.

You are exactly right. Those systems are closed loop for a reason. The store/forward in this specific case was most likely a human, with a scanner or just retyping documents from those networks on to a unclass network and then sending to the private address. How that is not deliberate we will never know.

Interesting article about the CNI, having a suspended clearance.

https://www.washingtonpost.com/news/checkpoint/wp/2016/01/27...

Wow, that's incredible! Hard to believe he hasn't just been sacked... clearly cannot do his job fully?

Losing her clearance may not mean losing her job - https://www.washingtonpost.com/news/checkpoint/wp/2016/01/27...

I found that one, but I was looking for a case with an Army General had lost his clearance but kept his job...

I'm not sure what clearance the Sec. State gets, but as President she wouldn't need any clearance as the power to classify material stems from her office.

Yeah, I think that being president requires access to classified material. And I believe that the voters electing someone president should be enough to get them access to that material.

Yes, go get digital copies of Stars and Stripes for the last ten years, and you will see many cases where Enlisted and Officers are brought up on charges, court martialed, and convicted, for things like this.

Is the SoS subject to the UCMJ?

No, but it's reasonable to wonder why sauce for the goose isn't sauce for the gander in this case.

> No, but it's reasonable to wonder why sauce for the goose isn't sauce for the gander in this case.

Simple. Because politicians transfer from the legislative branch to the executive branch. They (generally) don't entered the armed forces. If they did, I'm sure they'd make sure they have equal protections there as well.

No. The SoS is not subject to UCMJ.

I don't know about the exact situation, but plenty of times intelligence has been leaked accidentally. In fact, while I was in Military Intelligence we use to get regular briefings on call such and such number if you hear some dudes at the bar talking about classified information. I've had briefings on what to do if I discover classified material left at a bar. I've had a lot of briefings about classified material being leaked because something happened at a bar... It's a very real issue...

It pretty much boils down to contact FBI CI (https://www.fbi.gov/about-us/investigate/counterintelligence) or the CI agents on base (if it happened on a military instillation.

And one of the big problems (doesn't seem to be the case here) is where aggregated information is at a higher [EDIT: classification] than individual pieces.

For instance, you can know any two of the following and it might only be FOUO (for official use only):

  When a military deployment will happen
  Where it will be to
  Who will be going

But all three, together, are considered classified. (Trivial case, usually not this small a data set, but this is the concept.)

The result is that someone gets apparently safe information from several sources. They put this into a briefing, or talk about it at the bar. The accumulated information is now considered Confidential (or higher), but was developed entirely from non-Confidential (or higher) sources.

>>When a military deployment will happen

>>Where it will be to

>>Who will be going

Having all three aggregated is not classified, but it is critical information (AR530-1, para 1-5, section b(2) [1]). An entire deploying unit is given those 3 bits on information, but the entire unit rarely is 100% on security clearances. EXAMPLE: when 2BCT,25ID deployed in 2004 the entire unit was told when they were deploying and for how long, where they were going, and who units/personnel were going; everyone including that fresh 18y/o 11B PVT that graduated BCT 1 week prior were told.

But yes I agree with you on the first statement about information aggregation.

[1]https://fas.org/irp/doddir/army/ar530-1.pdf

Fair, it was a bad example, just the one that popped into my head. I couldn't remember exactly how it changed when you aggregated those details, but it seemed like a relatively easy example to relate.

Go get some political connections and/or $$ in order to join the next tier of our justice system.

> Has there been anything like this before? If I work for the government and forward confidential and secret emails through to a server I'm running myself I imagine I'd have criminal proceedings against me.

Unlikely. You would lose your job for sure, but typically for a criminal prosecution to result there has to be an element of willful unauthorized disclosure of classified info, or very high impact of the disclosure of classified info.

In practice this means that the people who get prosecuted have almost always been people intentionally sharing secrets with foreign entities (spying).

I only know of one case where charges were brought against someone who was not doing that. It was when the feds retaliated against Thomas Drake for whistleblowing against the NSA. Even then the charges got dropped.

Kristian Saucier - https://www.google.com/search?safe=strict&q=kristian+saucier

He took photos of a sub he was stationed on, apparently just for his own use, with no intention of "spying" He's going to jail for a few years.

Might want to edit that link to:

https://www.google.com/search?safe=strict&q=kristian+saucier

or flag it NSFW - when I clicked it, SafeSearch bounced me to the one I just posted. I'm actually at work, so don't intend to investigate, but my guess is "Kristen Saucier" is a different person in a different line of work.

Done - thanks.

In that situation, the military may sometimes be stricter than a civilian agency would be for the same infraction. Anything dealing with nuclear tech has a higher chance of turning into a much bigger deal. The other thing is that he tried to destroy evidence, which usually makes matter worse.

Be that as it may, cases like Saucier's are fairly rare. It happens, but it's the exception rather than the rule.

Petreaus was just in "similar circumstances" and was sanctioned and fined.

Petraeus worked for Defense, not State.

Actually, by the time they went after him, he had retired from the DoD and was the Director of the CIA, a civilian agency.

Get selected to be a Presidential nominee and that problem will just go away.

Her direct predecessor, and their direct predecessor back through five people also used private emails. So, it was practically policy at that point.

Also, it's not like it was secret at the time. Refuge in audacity may seem like an odd defense, but for stuff like this it's actually relevant. I mean if they did try and prosecute it would come off as completely politically motivated.

PS: If you disagree feel free to comment why.

I disagree because "practically policy" is not policy.

http://www.logicalfallacies.info/presumption/tu-quoque/

Reply on news.ycombinator.com