Judge orders CDC to stop deleting emails of departing staff: 'likely unlawful' | Hacker News Reader

Judge orders CDC to stop deleting emails of departing staff: 'likely unlawful'

politico.com

287 pointskoolba126 comments

Don't they use a time based legal discovery archive? I'm not sure when a government org is allowed to expunge old records though, maybe never? Still filing / dividing / partitioning it by at least year and month would speed up searches with time windows.

The article says that the judge wrote that in order to comply with protocol they were required to hold onto emails for longer than they did, he did not say that they could never be deleted.

Hah. They almost definitely do.

Not sure how it works at the federal level, but in Illinois here we have the Local Records Act, which requires that retention policies be created for all documents/records.

When I FOIA'd for all of the retention policies they initially told me that my request was too difficult, because they were all digital files -- but he was going on vacation the next day so he told me to expect an unduly burdensome denial. I got it the next day from whoever took over.

Anywho -- Most of the retention policies are older than me. That, and the question of whether third party data that's shared with a gov agency should fall under a retention policy or not.. is clearly an open ended question. Edit: found it: https://www.muckrock.com/foi/illinois-168/retention-policies....

Also at one point had to FOIA-sue the White House OMB for their email metadata when they said that they don't routinely use powershell. But they were sued years before where the nearly identical question came up, where they showed that powershell was used. And that's for data that they're legally required to collect for NARA archiving.

Point being -- lol it's a shit show.

Just wondering, what's the issue with PowerShell here? Is it because 5.1 is closed source?

I think they mean they couldn't automate the retrieval so getting the required data would be too onerous?

Nah, it ended up being just a single line of powershell to complete the FOIA.

It was largely about what FOIA compels an agency to do. They were arguing that what we were asking for was way outside of what is normally done. It was a strange argument.

it's 28 days at the FAA.

I wonder what factors led to the CDC Office of the Inspector General (OIG) missing this. Will the IG be auditing them on this in the future?

Not reported or not caught in spot checks (audits). You'd need a list of "lower level" (whatever that means) employees who had left more than 90 days prior to catch this.

Also, many audits are somewhat optimistic in their approach. Ask for some portion of the archives. See a few hundred employees here (perhaps all GS-13 and up) who left 4 years or so ago and are still in the archives. Great! They don't dig into who the employees are to notice that lower ranked employee emails are gone and everything looks compliant. This isn't the only audit they need to do this week so this is as far as they go.

It’d be a mistake to assume a compliance process exists at all if it’s never been triggered.

Presumably CDC's records retentions policies go back many years, and the GRS 6.1 Capstone rules were promulgated in 2019, so (a) the policy discrepancy is pretty recent and (b) the douchebags-of-liberty† challenging it only had an opportunity to do so after the previous Republican administration left office --- they themselves being right-wing partisans.

† a technical term, see Colbert

I had to look up that technical term. Presumably from Jon Stewart, actually:

<https://creativeloafing.com/content-211263-rip-douchebag-of-...>

It doesn't really even sound like they "missed" it. I.e. from the article:

> The judge said the CDC, along with all other Department of Health and Human Services agencies, had adopted a National Archives protocol known as Capstone that calls for senior officials’ emails to be preserved permanently and sets retention periods of between three and seven years for messages in the accounts of lower-level employees. CDC maintained it only signed on to part of the Capstone approach, but Contreras said the agency appeared to have embraced the whole plan and then abandoned part of it without permission.

That is, there seems to be enough ambiguity there, especially in that last sentence, suggesting the CDC reasonably thought they were acting lawfully.

Many years ago, I worked for a contractor at a civil agency. Simply to make the email system function, we needed to keep retention at two or three weeks. The only persons for whom email was to be held were political appointees. What I saw was that they would take most of their last couple of weeks as vacation, and that there was almost never anything but department-wide announcements.

It would have been possible to retrieve a point-in-time snapshot from a monthly backup, and that did happen a couple of times.

I almost don’t even bother reading my email anymore because almost all work happens over slack and zoom. Do they have the same retention requirements for all other non-email communication channels?

I started working in the entertainment industry several years ago.

If there's accountability on the line, bosses want it in an email so they can point the finger at someone when they try to slither their way out of a fuckup.

I work in a heavily regulated industry, and 'yes' is the answer for us, even going as far as mobile-first IM platforms. There's a very small number of vendors who pull in lots of money making UI hooks for things like WeChat and WhatsApp just so we can store the messages for the people in Risk and Compliance.

I can’t remember what the case was but I recently read an article where somebody was joking about a company doing something illegal and the response from the legal department in Slack was “ha ha shut up”

This is the norm at big companies.

During your Company Ethics training (when you learn about insider training and not bribing government officials) they also tell you "never comment on the legality of something unless you're a lawyer. But if you do, say it in a meeting and not digitally."

I would have assumed that everyone in this gov/enterprise space used an auditable email logging solution that keeps communications for whatever their applicable policy dictates.

I've been reading stories about US Gov agency dirs/mgmnt using private email for Gov business. Ostensibly because it went a long way dodge FOIA. The practice was widespread in every admin, from W until at least 2020.

That’s what the whole “Hillary’s emails” thing was about. Not that she had any damning emails, but that she was using a personal email account as Secretary of State to dodge FOIA requests.

>Not that she had any damning emails

Hard to say this since tons that were under subpeona were deleted

Edit: the best part is Hillary claiming the emails weren't work related and the press just mindlessly repeating that claim. No way to tell if the claim is true or not since they were, y'know, deleted: https://abcnews.go.com/Politics/hillary-clinton-deleted-3300...

She's such a nice and reputable person, it makes sense to take her claims at face value.

Trump and co. had four years of full power to get to the bottom of it, and yet they didn't.

How does "getting to the bottom of it" directly benefit Donald Trump ?

Why would Trump want to get to the bottom of anything?

Email is a two way street. If she sent a damning email, the recipient would have it. If she received a damning email, the sender would have a copy. Yet somehow no example of such an email has ever surfaced, despite it being something that would have carried a lot of weight when Trump was president.

Why would the counterparties surface emails they’d think were damning publically?

Damning of Hillary, not necessarily the recipient, after she lost the election and was pushed out of politics, and wanted by the new President Trump (their boss) who had an ego desperate for vindication. Doesn't the question answer itself?

If we posit the existence of emails indicative of a criminal conspiracy, maybe many of them were damning of both parties and it's reasonable to assume we never saw them. But every single email? That is incredibly unlikely.

More likely solution: Hillary did turn over all the emails having to do with her job when it was requested that she do so, and the ones she held back and deleted were conversations with family, online shopping, etc. that she didn't want distributed all over the public media. No criminal conspiracy emails have since shown up because there aren't any.

Ah. Well,

1) A criminal conspiracy would necessarily also indict the counterparty, since conspiracy is a crime and they’d just be as culpable. So they’d need to not delete their emails and let them out too, despite knowing this.

2) Yeah, I don’t expect she was doing anything actually very nefarious. Certainly not like the things that have been actively admitted to by Trump in full view of the Public.

I’ve personally always taken everything Trump has been ranting about as projection. It certainly holds up well to reality testing, eh?

What I don't understand is that the state agency I work for was VERY clear that if we use personal devices for work, they are immediately able to be subpoenaed in the event that happens.

Why would feds be different?

In theory they’re not above the law. In practice, they are.

Also says every gov employee and soldier who would get thrown in a cell in a hot minute for doing any of the things Trump has done re: government secret materiel.

Answer: you know why.

Also Biden right, storing them in his garage?

Ah, here we go. Poisoning the well of civil discussion, one thread at a time.

Compare the facts of the situations side by side, I’ll wait.

This is the only poison-ey comment. If you want to compare them, do so. Don't just name-call.

I didn’t start the comparison, you should note. I merely asked for them to be DIRECT about it, instead of ‘whattaboutism’.

Is everyone really this easy to manipulate?

It's pretty simple - Biden wasn't president when it stored his records, Trump was. All classification authority emanates from the President, not senators or vice presidents.

To do so, Trump would have had to have done said declassification. Something he notably did not do. In fact, he also didn’t turn them over when explicitly asked when he left office.

He also lied repeatedly about keeping them, and kept them (and handled them) well after he was out of office and no longer president. He also explicitly directed employees of his which were not cleared for the material to move and handle those records.

He also kept them in a place easily accessible to folks who were paying him money (personally) at Mar-a-lago and went to some trouble it seems to destroy evidence related to who may have seen them (security tapes, etc) when the FBI came looking.

And that is ignoring the issues like a huge (and unprecedented) spike in CIA assets being killed/disappeared related to this material once he was in office, the Kushner loans from the Saudis that seems related to this material and other information, Kashoggi’s murder (right around the time of the Kushner loans from the Saudi’s BTw), and the whole fiasco with Flynn (appointed national security advisor by Trump) with Russian ties. And Trump’s repeated statements trying to shake down the Ukraine gov’t and explicit statements that he would direct US foreign policy against what are clear US interests and towards widely stated Russian interests. Like withdrawing from NATO, or removing US support for Ukraine.

In contrast, Biden appears to have kept some records at home in a location that was not widely accessible, and he returned them when asked, and as part of normal processes common to transitions. Not ideal.

But I’ve heard no accusations (not even flimsy ones), let alone seen any statements or actions from him, that even imply he is working against US national interests, or the nation has suffered any actual harm related to those actions.

So not even on the same planet as what Trump has admitted to doing, let alone what seems to be quite apparent that he has been doing flagrantly.

If Biden committed a meaningful crime? Impeach him, remove him from office, and lock him up.

Trump has been convicted of numerous felonies, not even counting Jan 6th and numerous other acts committed in full view of the public, and is still rattling around free as a bird and undermining US public interests.

Why is he not in jail? Why is he still out on bail, especially after making clear statements (before and after trial) that he has plans to flee the country?

Oh, and Biden, being president later, could have even gone back and declassified those records he had in his garage to cover his ass - but didn’t.

And more specifically that she unilaterally decided which emails were “official” and which were personal rather than deferring that decision to a third party. And then she had whatever she considered personal deleted, after being served with a subpoena for all the emails on their server.

Since SCOTUS just recently said that POTUS gets to make this decision, there's a good chance they think that the SoS does too.

Hillary's emails was more about the Presidential Records Act than FOIA. PRA requires documents of the president, vice president and their staff to be kept forever. It was enacted because of efforts by Nixon to destroy information.

Using private email services to avoid the PRA was only outlawed in 2014, which is after Hillary was no longer in the administration. However, it was obviously a pretty scummy thing to do before it was illegal.

Can we dive into this further?

Is the noncompliance with the presidential records Act, an illegal act?

Because that's what is suggested was true ,until 2014. Is that correct?

There were a lot of problems with Hillary’s email server. The major criminal liability was the fact that classified information had been sent and received in many of those emails, though Comey ultimately decided that this was not intentional on Hillary’s part.

There was also concerns about security and email retention. The retention issues were kind of funny; the official sequence of events was:

1. Hillary’s chief of staff and lawyers go through her emails and send all the work related ones to the State Department for archiving.

2. Hillary’s chief of staff then asks PRN (the company managing the server) to set a 60 day retention policy.

3. Months pass.

4. The server comes to public attention, and a Congressional committee investigating the Benghazi fiasco subpoenas Hillary’s emails.

5. The guy at PRN realizes he never actually turned on the retention policy so he panics and starts deleting emails with BleachBit.

This always shocked me because of how big of a red flag this would be at any private business larger than 10-100 employees.

> That’s what the whole “Hillary’s emails” thing was about.

You're not wrong but Hillary was 1 of 1000. Nearly everyone angry about Hillary cared nothing about all the other agency mgmt doing the same.

Because ~0% cared about the the issue in a meaningful way, nothing got done and the practice carried on after she went away.

One of the top aides for Fauci admitted that Fauci and he used private email addresses to do government business. He even admitted ways he would use to avoid detection from FOIA.

Who? When?

I'm actually shocked that you don't know this. It was big news a few months ago.

https://www.nbcmontana.com/news/nation-world/fauci-advisor-b...

https://oversight.house.gov/release/new-covid-select-memo-de...

https://thehill.com/video/top-fauci-aide-david-morens-caught...

Let say that's true. If someone is angry about Fauci but give a pass to the many, many other agency directors doing the same thing - that someone isn't really angry about the issue are they? It's just something to exploit and then forget about.

https://www.nbcmontana.com/news/nation-world/fauci-advisor-b...

If I recall correctly, FOIA says "in the course of government business." Doesnt matter what system you use unless that system is destroying emails...which is illegal.

Sure but someone has to care enough to pursue action. Whoever that is, their boss and their boss' boss are doing it too.

My guess is that you did not read the article (and, from reading most of the other comments, you are not alone). They were using "auditable email logging solution that keeps communications for whatever their applicable policy dictates." The issue is that the CDC had a policy where lower level employees had their emails deleted after 90 days (and there was nothing secret about this, it was their standard procedure), but there is disagreement over how long these lower level employees have to have their emails retained due to the CDC agreeing to a "Capstone" records retention program from the National Archives. The article has the details.

Issue being, the headline is written in a way that deliberately makes it sound like something nefarious is going on, where it sounds like an underlying disagreement over the interpretation of how long records were required to be retained due to this signing on to the Capstone program.

Regardless, this is the Internet, so I'm sure everyone with an axe to grind will read this as "WhaT tHe CDC doEsn'T wAnT yOu to Seeeee!!!!"

> Issue being, the headline is written in a way that deliberately makes it sound like something nefarious is going on, where it sounds like an underlying disagreement over the interpretation of how long records were required to be retained due to this signing on to the Capstone program.

From the article, it seems there was a dispute over which of two scenarios applied (1) the CDC agreed to implement the whole of the Capstone program but then unilaterally decided to stop applying it to lower-level employees; (2) the CDC agreed to implement it for senior employees only and never agreed to implement it for lower-level employees. Plaintiffs claimed the situation was (1), the CDC claimed it was (2), the judge decided based on the evidence (1) was more likely. The plaintiffs are GOP-aligned and the judge is an Obama appointee, so one must assume the judge is ruling based on the evidence, not partisan bias. Given that, it definitely makes the CDC and the DOJ look bad - if the judge’s ruling is correct, then they were presenting a false narrative to the Court

My point exactly. They may have been using a logging solution but whoever made the decision to keep communications for only 90 days was derelict in their duty, incompetent, or, deliberately trying to protect the agency from scrutiny.

Do you have any evidence that something nefarious wasn’t happening? That’s the point of communication through approved channels keeping records of said comms.

All the emails are still in other people's inbox/sent. Completely discoverable.

Not if most of them are to other CDC employees.

Likely? It is.

Fortunately for those within our legal system, they have to be a little more rigorous than simple assertions.

I guess they had to delete the emails because they weren't smart enough to use secret gmail addresses to avoid oversight like their leaders do.

That tactic is strongly recommended against. If there is an indication that someone is evading discovery by using their private email, then the private email becomes discoverable. Judges take avoidance antics very poorly, generally.

> then the private email becomes discoverable. Has this happened in the case in question?

Yes.

Yes - the right way to avoid discovery is in-person meetings, telephone calls, and discussions with your lawyer cced.

I find it pretty understandable that politicians would end up with the personal and professional blurred together to be honest - it's not really a job that lends itself to a clear distinction between the two. You can't really separate the Obama Presidency from Obama.

CC'ing the lawyer is popular, but probably counter productive. Just including your lawyer in the email chain doesn't make the email privileged and it's a good signal that there is something in the email you don't want found.

Copying your lawyer on an email with a third party does not make that email privileged communication subject to attorney client privilege.

> and discussions with your lawyer cced.

That one weird trick which does not really work

The only way to avoid discovery is to not get caught. Pretty much everything else can be used against you.

>Yes - the right way to avoid discovery is in-person meetings, telephone calls, and discussions with your lawyer cced.Yes - the right way to avoid discovery is in-person meetings, telephone calls, and discussions with your lawyer cced.

Hey, Joey, we still gonna whack that guy tonight? CC'ing my lawyer here like I always do when we're planning to murder guys.

This doesn't work. As an example:

> As for “flagrant misuse of the attorney-client privilege,” that refers to Google’s “Communicate with Care” initiative. Google trained its employees to add its in-house lawyers on “any written communication regarding Rev Share [RSA] and MADA.” ... It also instructed that, when “dealing with a sensitive issue” via email, to “ensure the email communication is privileged” employees could add a “lawyer in [the] ‘to’ field,” “mark ‘Attorney/Client Privileged,” and “ask the lawyer a question.” ... Google employees assiduously followed that advice... As a result, Google’s outside counsel in this case initially withheld tens of thousands records on the grounds of privilege, which ultimately were rereviewed, deemed not privileged, and produced to Plaintiffs... This creation of faux privileged materials, Plaintiffs contend, “demonstrates that Google intended to harm competition through its contracting practices and its supposed procompetitive justifications were simply pretext.” ...

UNITED STATES OF AMERICA v. GOOGLE LLC (1:20-cv-03010) (citations omitted)

Recommended against, sure, but does that actually matter?

I had to sue the City of Chicago because one of the Mayor's main policy consultants was using gmail for most of their work. Sure the judge frowned on it and I won the case.... but well over a year later after litigation ended and the relevant reporting already came out. Didn't notice until a couple months after litigation ended that a full year was missing from the doc, and we'd have had to litigate again.

Doesn't matter if it becomes discoverable. They'll just wipe it and claim it was done in the past since it's outside the audit/archive systems.

Private email discovery is a very much “it depends” situation. Specifically the legal context.

For example, in NJ Board of Ed members are elected officials. If they conduct board business in their personal phones or other devices or accounts, they are discoverable.

However, a judge ruled that, to protect their privacy, if this arises then Open Public Records Act (or State version of FOIA) request search on private phones can only be done by the phone’s owner, not the OPRA administrator.

So suddenly you have to trust individual board members to actually search their phones properly and not just lie.

In my case a board member was in this situation and just said “I deleted those texts”.

Which maybe is a technical violation of OPRA, but the penalties are a slap on the wrist here in NJ.

Using private email servers is quaint at this point, you may as well be using private carrier pigeons. These days all the smart malfeasants in office are using encrypted messaging apps with disappearing messages[1][2].

The wildest part is that in the case of the January 6 plotters, they were instructed to use Signal:

> In the declaration from the Department of Homeland Security, filed under penalty of perjury, DHS claims that following a data breach in December 2020, Wolf and Cuccinnelli were given temporary phones and instructed to use Signal to communicate in December 2020 and January 2021. DHS claims the agency retained the Signal messages, but given that one of Signal’s selling points is its “disappearing messages” feature, the accuracy of this claim may be questionable.

[1] https://www.splinter.com/why-did-jared-kushner-download-an-e...

[2] https://www.citizensforethics.org/reports-investigations/cre...

Injecting "Trump-allied legal group" is an incredible way to taint the news story and get people to take sides.

FOIA is a blessing, and does more for investigative journalist than almost anything else, but it doesn't work when our government is allowed to illegally covers its tracks.

Somehow it's refreshing to me that a "Trump-allied legal group" can sometimes do something that seems good to me.

They are like diodes. Won't work when the shoe is on the other foot. But, yes.

To call America First Legal "Trump-aligned" is putting it mildly, and it would be incredible not to mention it:

> Stephen Miller, the former senior advisor to president Donald Trump, is the organization's founder and president. The vice president is Gene Hamilton, a Department of Justice official under Trump, and the executive director is Matthew Whitaker, the acting U.S. attorney general under Trump following Jeff Sessions's resignation. America First Legal's board of directors includes Whitaker and former chief of staff for Trump, Mark Meadows.

The name itself is even derived from a Trump campaign slogan.

https://en.wikipedia.org/wiki/America_First_Legal

> and it would be incredible not to mention it:

Does that have something to do with this lawsuit or the merits of it?

Of course. It's explaining who the organization is that is filing it. That's basic journalism, right? It would seem a huge oversight to not mention it.

a fundamental point of the US legal system is to unbind the merits of a legal proposal from the proponents of it, no?

Knowing who the proponents are is reasonable and unrelated to that concept.

That fundamental point of the legal system is not also a fundamental point of the industry of journalism, and I’m skeptical it could be

Of course it could be, nobody is compelling publishers. The question is should it be, and the answer has traditionally been: depends, is it relevant? Which brings us back to the original question of merit.

It also depends a lot on the standards of the publisher versus the expectations of the readership. Personally, I agree with your implication: I can't think of any papers today who wouldn't choose to include this information—as red meat is an important part of the modern news diet—but hey, in a world of unprejudiced readers who weighed legal matters solely on the basis of evidence, I can certainly imagine it not being brought up, and those readers still being well-informed.

> That's basic journalism, right?

If it doesn't have a bearing on the story then it's the opposite of journalism.

> It would seem a huge oversight to not mention it.

I don't see how it would have any implications on the basic situation described, which is an internal CDC issue concerning their handling of documents during employee transition.

I think what you're basically saying is "it would otherwise be a missed opportunity to fling political mud." Which, to me, is _not_ journalism.

The article doesn't fling any political mud.

You mean except this part:

> “The Biden-Harris Administration was actively destroying the records of federal employees at the CDC in blatant violation of the law — and we are pleased that the U.S. District Court for the District of Columbia has ordered a stop to their illegal conduct,” America First Legal’s executive director Gene Hamilton said in a statement. “The Biden-Harris Administration’s politicization of records management must end.”

Even though the decision shows that CDC has likely been doing this since at least 2016.

That's Gene Hamilton, executive director of America First Legal, flinging political mud.

The article doesn't.

That quote is actually in the article and so part of its context and substance. Maybe you meant to point out it was not the author that made the statement?

I used to believe left leaning reporting was more free of bias and manipulation until I realized they often use this tactic. They will not say something themselves, but find someone to quote that makes the point they want made.

They also use build up, where they go back in time and recant the past before moving to the present where they then show the reader what to see through the framing they want them to see it. Some outlets/journailists are better than others, and sometimes it's not what I'm describing. But this method of manipulating public perception of issues and events exists.

At least with sources on the right they are blatant and obvious, easy to pick out and pick apart what they are wrong about.

If you've seen promos for GroundNews recently, I'd highly recommend it. It doesn't solve the bias problem, but as an individual it starts uncovering the ways our news media put their fingers on the scales of society.

>That quote is actually in the article and so part of its context and substance. Maybe you meant to point out it was not the author that made the statement?

Correct; the article/author/Politico isn't flinging any mud it/themselves so long as it/they is/are simply quoting or journaling verbatim what someone said or what happened.

That's "America First Legal’s executive director Gene Hamilton" as is pointed out in the section you quoted.

It's not the article writer, who is bringing it up in a section about how "America First Legal challenged the CDC’s recordkeeping practices"

Yeah, they shouldn't have waited until paragraph 9 to name the group.

Divided we fall

That ship sailed a long time ago.

Reply on news.ycombinator.com