There's no winning here for 18f. Either their sites are archaic disasters and they are criticized for not being up to par with the top tier consumer sites. Or they spend some money to bring them up to par and its "OMG! An $800 toilet seat!"
Google can spend ten billion dollars changing their logo because they're profitable and they answer to their board & shareholders. I don't remember anyone asking me if I wanted to contribute money to a government tech startup.
Security wasn't the goal, evasion of oversight was.
Even if it was granted that security was the goal, you would expect the private server to be at least as secure as the @state.gov mail servers, otherwise you're wasting your time. Furthermore, James Comey's statement in July made clear that the private server wasn't as secure as GMail, the kind of email server an "ordinary person" might use. GMail may be centralized, but it's supported SSL from its public release in 2004. The server Hillary Clinton used didn't support SSL until the spring of 2009, months into her tenure as Secretary of State.[0]
The truth is we actually know very little about the operational security of the server because all but one of the IT folks in charge of running it plead the 5th before congress and only spoke privately with the FBI under conditions of immunity. Justin Cooper was the only one to actually testify regarding the specifics of the server, but his role was more administrative than technical.[1]
There's no credible defense for the SoS running a private server to provide email accounts which are less secure than the standard accounts used by the rest of the State Department. The diplomatic role of the SoS inherently requires a high level of OPSEC to carry out its most basic function of communicating with international leaders. Hillary Clinton avoided using the security available to her in order to thwart federal regulations regarding the preservation of public records. That action is no example that any member of the public should be holding in high regard as something worthy of emulation.
[0]: http://www.thompsontimeline.com/191/2009/03/29/for-the-first... [1]: http://www.thompsontimeline.com/tag/justin-cooper/
And what do you propose doing about people who use arguments of the form: "Can you believe this government $thing? It looks like an archaic disaster. Government can't do anything right. Therefore..."
Presumably because they are trying to be a "startup", they are copying the business style of startups. It's easy to look back afterwards and say "that was a complete waste", but it's possible that at the time it was seen as justified. It's easy to say we'll just take the good aspects of startups and the good aspects of government agencies and reject the bad", but it's not always apparent what is the good and bad in each, as they are both fundamentally systems whose ultimate behavior is emergent from all their aspects. It's very easy to accidentally break something useful by tweaking or removing something that appears completely unrelated in systems like that.
That said, I think the more interesting question is should we be trying to emulate a startup in government, given that the vast majority of startups fail? In that light, it should be absolutely no surprise that 18F is failing. It was the likely outcome.
One thing that bothers me about government websites is the boosterism of whoever is in office. Secretary of State websites are particularly bad in this regard. Usually you go to the SoS website to do something related to licensing, like the DMV. Both Illinois and California have had headshots of the Secretary of State displayed prominently in the header. It is labeled/named something long winded like "Secretary of State Joe Blow's Department of Motor Vehicles Website". Is it on a .com or a .gov or a .(state).us domain for any given state? The generic "(welcome and platform) message from the Secretary of State" is often front and center.
Really, who the Secretary of State is is so secondary to the actual services being provided, all this does is serve to tell everyone who is responsible for this crap website.
If there was consistent branding, and that branding was strong and recognizable, citizens would be better served. You wanna toot your horn, put some metrics up like the last 6 months of turn-around time on license approval, website and phone service response time, help topics researched, costs to provide the services, etc, and show me how access to state services are improving over time, which is the SoS's actual job. Government agencies usually have weak branding because it gets upset based on term lengths (except for services like the IRS, which has pretty consistent branding and methodologies).
This isn't just a website problem either - the DMV in Illinois is really the Jesse White center based on the amount of branding and pictures you run into there.
[1] http://www.businessinsider.com/guess-how-long-overnight-succ...