Clinton ran own computer system for her official emails
news.yahoo.com
news.yahoo.com
But I am genuinely curious about this. It doesn't seem like wrongdoing per se, or even anything unethical. But I don't like the trend of losing documents from the historical record. And I think that (while her email security is probably better than State Dept. as a whole) it probably would have been better as the leader to hold herself to the same standards as everyone in the organization as a general principle.
Curious to hear if anyone here has .gov experience and can give useful insight into the story.
This. Recall that only a few weeks ago, the leading republican candidate was falling all over himself announce that he was publishing all his emails from his time in office. In the seemingly desperate rush to make a spectacle of it, he didn't even redact the emails [1], and released a big pile of private data as a result.
Also, given the state of the State Department's computer network [2], who can blame her? But the most telling part is that she wasn't even the first Secretary of State to do this, she was the last.
I don't say this because I'm a supporter, it just seems like obvious political theater being run by the rival camp and merits being called out. Personally I'm disappointed that both the Clinton and Bush campaigns aren't being laughed off the stage. Political aristocracy is repugnant and has no place in this country.
[1] http://www.theverge.com/2015/2/10/8013531/jeb-bush-florida-e...
[2] http://gizmodo.com/state-department-computer-systems-hit-by-...
Obviously there are political motivations. But any time a law is broken by a candidate or official, it's hard to argue that it's not honest news. May be blown out of proportion, etc., but still legitimate news.
If a law wasn't broken, it might look like she's hiding something, but I agree that it's probably going to be quickly forgotten.
Also, the political motivations might not be partisan. Partisans would choose timing carefully for maximum effect, and this doesn't seem like bad timing for Democrats. If the story blows up huge, they can nominate someone else; and if not, they nominate Clinton and this is forgotten by the time of the general election.
If you don't believe that, then you are probably a liberal democrat.
So, to call this news story about a politician acting in a premeditated, unscrupulous/unethical manner a "hit job" shows your deep political bias.
To turn it around, would you feel it was a "hit job" if a politician whose ideas and agendas you disagree with, set up an outside email server for the express purpose of discussing official government business so that it wouldn't/couldn't be easily tracked? I don't think you would.
Didn't Cheney have a man-sized safe in his office or something? I don't remember anyone on the left screaming about that.
I'm sufficiently well developed to separate my feelings about a politician from their political party, and in turn from my own feelings about an abstract ethical scenario. And none of this is to say anything about my political beliefs, which are personal and none of anyones beeswax.
This isn't abstract either, as some other poster mentioned, this is widespread, bipartisan behavior. I think that if there is evidence of malfeasance, then they should be required to produce their email (privately served or not) via subpoena. I can see the loophole about having people policing their own email archiving, but I honestly do not know if that is illegal, hence why I asked if any experts here knew if this violated any laws or policies.
EDIT: also, you assume this is sourced from a conservative or Republican group? Primaries happen before generals.
The only two reasons I can think of why she would choose private over government issued is ease of use and control over access. If it is too bothersome for her to use a government account, then she shouldn't be in the position. If she's afraid she'll leave incriminating evidence, we don't need her.
"No SPF records found"
Looks pretty spoofable.
> Hoteham was listed as the customer at Clinton's $1.7 million home on Old House Lane in Chappaqua in records registering the Internet address for her email server since August 2010.
Does that sound like the information you get from running whois on an IP address or on a domain name?
> Clinton's private email server was reconfigured again to use a Denver-based commercial email provider, MX Logic
How the fuck would anybody know how her private server was reconfigured unless they're talking about mx records?
I took "Internet Records" to mean MX record for her domain. I'm assuming there are people keeping track of DNS changes publicly that one can view somewhere. Someone will probably respond to this post with a link.
Similar to the trend of government setting rules for everyone that they conveniently exempt themselves from.
For the most part people use a 2+ factor authentication and their smart cards have private keys. EX: http://www.cac.mil/common-access-card/
After it's set up Outlook then let's people encrypt with a simple click. The recipient then needs their card + PIN to decrypt.
PS: This is one of those cases where the US Government seems to be significantly ahead of the private sector in terms of actual adoption and use.
But I'm a bit confused. If government officials have the ability to easily encrypt their messages asymmetrically, AND they're supposed to store all of their messages in some kind of database, that sort of defeats the purpose of the encryption in the first place. Also, having a central store of all that information seems really risky and inherently less secure than a message encrypted asymmetrically.
And, for that matter, if they are supposed to encrypt messages with a private key, that means they're not using asymmetric encryption for private communication. I'm not a security expert, but that seems like a bad move.
Also, the government wants a back door. So, they keep a copy of the private key's and assign them to an employee. The goal is to prevent interception and or data breeches on a lost laptop, not to hide the information from everyone.
The same backdoor exits with full disk encryption so internal IT can help users who forgot their password etc.
E-Mail is universal in both business and government. Using TLS, it is sufficiently secure for most communications. For the rest, I'm sure the CIA and NSA know how to use PGP.
And yes, TLS will securely transmit your message securely from your client (whether it's Outlook or a web browser) to your e-mail server. But you don't have any guarantee that the various relays which transport your message will use TLS.
"And since the Secret Service was guarding Clinton’s home, an email server there would have been well protected from theft or a physical hacking."
[1] http://www.politico.com/story/2015/03/hillary-clinton-email-...
more: The press comments about the location of the server sure do sound a lot more like misunderstanding than they do careful research.
http://thedailybanter.com/2015/03/aps-bombshell-hillary-clin...
The initial AP article wasn't specific about the server location, but various media outlets omitted that sentence.
Later updates to the AP article do state that a business record related to the server has been traced to her home, but the various republished editions of the AP story swamp search, so it is difficult to find any actual analysis of the technical details.
A discussion here on HN is the best I've found:
https://news.ycombinator.com/item?id=9148730
The records for the mail server do point to an ip address from a provider in the area of her home. But there is no further evidence.
Edit: the current mx records are below:
;; ANSWER SECTION:
clintonemail.com. 5495 IN MX 10 clintonemail.com.inbound10.mxlogic.net.
clintonemail.com. 5495 IN MX 10 clintonemail.com.inbound10.mxlogicmx.net.(There is a mail provider using the mx domain, though. I don't recall its name.)
Ockham's razor tells me it's more likely the media is speculating based on a whois record or similar. Scanning the existing comments I don't see anything more definitive than that. Is there any actual reason to think the email server was physically in suburban NY?
More to the point I don't see any evidence at all that it was physically there besides speculation. If there is such evidence (like IP addresses or similar) floating around, that would be interesting.
The underlying fact is, she broke the LAW. That means she should be dragged through the punishment of the law.
Stop supporting her or making excuses. The society of today really stops caring so much about the rule of law, but rather what they have for an opinion. But I ask you if you if murder is against the law, do you support it?
We shouldn't be supporting this either way. It was plainly against the law and she broke that law. If you have a problem with it, then change the law. Stop sticking up for someone that blatantly broke the law.
I don't say that as support, I just haven't seen any clear explanation of that yet.
You said It was plainly against the law and she broke that law.
I was hoping you could explain more than the press articles have been, because you made it sound like you could.
Looks like bouncebacks were working yesterday, but have been disabled: http://www.zerohedge.com/news/2015-03-03/hdr22clintonemailco...
Edit:
I tried to telnet to the server:
telnet clintonemail.com 25
Trying 208.91.197.27...
telnet: Unable to connect to remote host: Connection timed out
There is absolutely no way she or anyone else that worked woth here didnt know your needed to archive emails. Subpoenas happened regularly, and everyone knew Emails = record. Years later after I left I landed a contract with a government contractor to recover thse tapes, against federal lawsuits, emails are records and the courts want them. Par for the course. I'd argue the Clinton whitehouse was the first administration to truly face electronic records retention effects with the courts. Nixon maybe being the first with audio tapes, the clintons got email Subpeonas.
So when I hear she was running her own email server and staying outside federal records retention requirements, I both nodded knowingly that I would expect nothing less from the wife of a man that learned first hand: keep no records, and then shook my head ruefully knowingly why she did it:
Keep no records.
When public leaders avoid record keeping requirements, this prevents public scrutiny, and that means they no longer work for you because they aren't accountable to you. Maybe you agree with her, but you'll never know what she did in your name. Hillary knew what she was doing. I have no doubt of this, as I said I would expect nothing less. I would be shocked if she didn't do this. Stunned really. I'm still paranoid about what I put in written form (text, email, etc.) to this day.
This was calculated, to keep her unaccountable and off the record.
The rule of security is to make the attack more expensive than it's worth to your adversary. How much are the U.S. Secretary of State's emails worth? Certainly they are worth billions, and I'd guess even trillions of dollars; the information could make existential differences, for example to security of entire nations. In addition, the money you could make with foreknowledge of U.S. policies, for example in oil markets, seems astronomical.
I expect that foriegn intelligence services, with billions in reources and highly skilled personnel, had access to her mail. I expect some private interests also did.
Security doesn't mean everything is inaccessible, it means you control who, when, and where the data can be utilized. Obviously not all of the Secretary of State's email should be publicly accessible, but 1) the law as implemented by the government, and not a private individual, should control access, 2) someone needs to ensure control is maintained and prevent unauthorized access, and a private individual probably doesn't have the resources to do it.
1) they are accountable to the people. Granted this is a principle. At some point in the future, everything the federal government did will become open knowledge.
2) It must be possible to get them in front of the justice system. This is a basic principle of a separation-of-powers democracy. The justice system is, by law, entitled to access any and all documents, emails, everything any agency has (just so we're clear : not talking about the judge down the street, although they have some access, but the supreme court has full, unquestionable, access)
3) FOIA (freedom of information act). Citizens and others can petition the justice system to make government documents public. Unless the justice system and the federal government agree something can not be made public, it is made public.
This is extremely prominently mentioned on every computer system anywhere near the federal government. Record keeping requirements this, email archival that.
Ms. Hillary Clinton did not miss these requirements. She knowingly violated the law and conducted official government business in an illegal manner. Ms. Clinton knowingly, and with the aid of dozens of people working for her on the public's dime violated the law. In theory the minimum punishment for this is to become unelectable for 5 years, but "somehow" I doubt that will happen. Also there seems little doubt that the emails she will make public will be a filtered version of the original.
This is comparable to fraud (though technically not fraud) : if you did this as a CEO of a publicly traded company, it would be considered fraud, and you could very well go to jail for that.
However, I do think it would be cool if people had a turn-key solution to host their own email solutions on a cloud provider or something. :)
Secondly, I think your last sentence answers the question. Running one's own email server isn't "normal" these days; email-as-a-service is such an over-solved problem for the average (security-unconscious) user, that going to the hassle and risk of running one's own is generally the purview of people who have something to prove, something to protect, or something to hide.
You also need to take steps to ensure that your email will get to where it is going. That means configuring authentication protocols like SPF, and taking steps like using a fresh IP address for your mail server, and warming it up so remote ISPs begin to trust it. For most email providers, the default status of new sending IPs is "suspect." You can't just stand up an email server and expect your emails to hit everyone's inbox.
This does not even get into the security aspects that apply to running any server on the Internet.
Legal protections are one of the only reasons to bother that I can think of. When your email is hosted by Google, Google can provide it to legal authorities without telling you. When it lives in your home or business, you will know if someone is asking for it.
We moved servers to a new block of IP addresses, and after a couple hours we found ourselves on Microsoft's spam list. Took about 20 phone calls and almost 48 hours to get off of that thing. The other big lists didn't make a peep.
But... it's a really good idea. Hell, I used to run my own back in the day before my ISP started prohibiting it (around 2003ish?)
So I'm conflicted.
(At least not in this regard. You may or may not have other unrelated things to feel guilty about.)
Personally I think that it is great that a high profile public servant went and ran their own personal server from their house.
It suggests a level of competency and it encourages other people to try and set up their own servers from home.
https://www.eff.org/deeplinks/2013/08/dea-and-nsa-team-intel...
It's still possible that they could be handed over from her personal account, but this bypasses the various controls that are supposed to be in place to ensure the fullest possible disclosure.