Devastating: 12 Key Quotes from WaPo's Email Scandal Deep Dive

On Feb. 17, 2009, less than a month into Clinton’s tenure, the issue came to a head. Department security, intelligence and technology specialists, along with five officials from the National Security Agency, gathered in a Mahogany Row conference room. They explained the risks to Cheryl Mills, Clinton’s chief of staff, while also seeking “mitigation options” that would accommodate Clinton’s wishes. “The issue here is one of personal comfort,” one of the participants in that meeting, Donald Reid, the department’s senior coordinator for security infrastructure, wrote afterward in an email that described Clinton’s inner circle of advisers as “dedicated [BlackBerry] addicts.” Clinton used her BlackBerry as the group continued looking for a solution. But unknown to diplomatic security and technology officials at the department, there was another looming communications vulnerability: Clinton’s Black­Berry was digitally tethered to a private email server in the basement of her family home, some 260 miles to the north in Chappaqua, N.Y., documents and interviews show. Those officials took no steps to protect the server against intruders and spies, because they apparently were not told about it.

Investigations were begun by congressional committees and inspector general’s offices in the State Department and the U.S. Intelligence Community, which referred the case to the FBI in July for “counterintelligence purposes” after determining that the server carried classified material. The FBI is now trying to determine whether a crime was committed in the handling of that classified material. It is also examining whether the server was hacked. One hundred forty-seven FBI agents have been deployed to run down leads, according to a lawmaker briefed by FBI Director James B. Comey. The FBI has accelerated the investigation because officials want to avoid the possibility of announcing any action too close to the election.

From the earliest days, Clinton aides and senior officials focused intently on accommodating the secretary’s desire to use her private email account, documents and interviews show. Throughout, they paid insufficient attention to laws and regulations governing the handling of classified material and the preservation of government records, interviews and documents show. They also neglected repeated warnings about the security of the BlackBerry while Clinton and her closest aides took obvious security risks in using the basement server. Senior officials who helped Clinton with her BlackBerry claim they did not know details of the basement server, the State Department said, even though they received emails from her private account. One email written by a senior official mentioned the server.

The new president was making broad promises about government transparency that had a bearing on Clinton’s communication choices. In memos to his agency chiefs, Obama said his administration would promote accountability through the disclosure of a wide array of information, one part of a “profound national commitment to ensuring an open government.” That included work emails. One year earlier, during her own presidential campaign, Clinton had said that if elected, “we will adopt a presumption of openness and Freedom of Information Act requests and urge agencies to release information quickly.” But in those first few days, Clinton’s senior advisers were already taking steps that would help her circumvent those high-flown words, according to a chain of internal State Department emails released to Judicial Watch, a conservative nonprofit organization suing the government over Clinton’s emails. Leading that effort was Mills, Clinton’s chief of staff. She was joined by Clinton adviser Huma Abedin, Undersecretary Patrick Kennedy and Lewis Lukens, a senior career official who served as Clinton’s logistics chief. Their focus was on accommodating Clinton.

Few knew the details behind the new clintonemail.com address. But news about her choice to use her own BlackBerry spread quickly among the department’s diplomatic security and “intelligence countermeasures” specialists. Their fears focused on the seventh floor, which a decade earlier had been the target of Russian spies who managed to plant a listening device inside a decorative chair-rail molding not far from Mahogany Row. In more recent years, in a series of widely publicized cyberattacks, hackers breached computers at the department along with those at other federal agencies and several major corporations. The State Department security officials were distressed about the possibility that Clinton’s BlackBerry could be compromised and used for eavesdropping, documents and interviews show.

After the meeting on Feb. 17 with Mills, security officials in the department crafted a memo about the risks. And among themselves, they expressed concern that other department employees would follow the “bad example” and seek to use insecure BlackBerrys themselves, emails show. As they worked on the memo, they were aware of a speech delivered by Joel F. Brenner, then chief of counterintelligence at the Office of the Director of National Intelligence, on Feb. 24 at a hotel in Vienna, Va., a State Department document shows. Brenner urged his audience to consider what could have happened to them during a visit to the recent Beijing Olympics. “Your phone or BlackBerry could have been tagged, tracked, monitored and exploited between your disembarking the airplane and reaching the taxi stand at the airport,” Brenner said. “And when you emailed back home, some or all of the malware may have migrated to your home server. This is not hypothetical.” At the time, Clinton had just returned from an official trip that took her to China and elsewhere in Asia. She was embarking on another foray to the Middle East and Europe. She took her BlackBerry with her.

In early March, Assistant Secretary for Diplomatic Security Eric Boswell delivered a memo with the subject line “Use of Blackberries in Mahogany Row.” “Our review reaffirms our belief that the vulnerabilities and risks associated with the use of Blackberries in the Mahogany Row [redacted] considerably outweigh the convenience their use can add,” the memo said. He emphasized: “Any unclassified Blackberry is highly vulnerable in any setting to remotely and covertly monitoring conversations, retrieving e-mails, and exploiting calendars.” Nine days later, Clinton told Boswell that she had read his memo and “gets it,” according to an email sent by a senior diplomatic security official. “Her attention was drawn to the sentence that indicates (Diplomatic Security) have intelligence concerning this vulnerability during her recent trip to Asia,” the email said. But Clinton kept using her private BlackBerry — and the basement server.

The email system operated in those first two months without the standard encryption generally used on the Internet to protect communication, according to an independent analysis that Venafi Inc., a cybersecurity firm that specializes in the encryption process, took upon itself to publish on its website after the scandal broke. Not until March 29, 2009 — two months after Clinton began using it — did the server receive a “digital certificate” that protected communication over the Internet through encryption, according to Venafi’s analysis. It is unknown whether the system had some other way to encrypt the email traffic at the time. Without encryption — a process that scrambles communication for anyone without the correct key — email, attachments and passwords are transmitted in plain text. “That means that anyone could have accessed it. Anyone,” Kevin Bocek, vice president of threat intelligence at Venafi, told The Post. The system had other features that made it vulnerable to talented hackers, including a software program that enabled users to log on directly from the World Wide Web.

On Feb. 10, 2010, in an exchange with Sullivan, Clinton vented her frustration one day when she wanted to read a statement regarding José Miguel Insulza, then secretary general of the Organization of American States. Sullivan wrote that he could not send it to her immediately because the department had put it on the classified network. “It’s a public statement! Just email it,” Clinton shot back, just moments later. “Trust me, I share your exasperation,” Sullivan wrote. “But until ops converts it to the unclassified email system, there is no physical way for me to email it. I can’t even access it.” Early on June 17, 2011, Clinton grew impatient as she waited for “talking points” about a sensitive matter that had to be delivered via a secure line. “They say they’ve had issues sending secure fax. They’re working on it,” Sullivan wrote his boss. Clinton told him to take a shortcut. “If they can’t, turn into nonpaper w no identifying heading and send nonsecure,” she said. Clinton spokesman Fallon said she was not trying to circumvent the classification system.

Security remained a constant concern. On June 28, 2011, in response to reports that Gmail accounts of government workers had been targeted by “online adversaries,” a note went out over Clinton’s name urging department employees to “avoid conducting official Department business from your personal email accounts.” But she herself ignored the warning and continued using her BlackBerry and the basement server.

Powell’s circumstances also differed from Clinton’s in notable ways. Powell had a phone line installed in his office solely to link to his private account, which he generally used for personal or non-classified communication. At the time, he was pushing the department to embrace the Internet era and wanted to set an example...Powell conducted virtually all of his classified communications on paper or over a State Department computer installed on his desk that was reserved for classified information, according to interviews. Clinton never had such a desktop or a classified email account, according to the State Department.

Specialists interviewed by The Post said her practices fell short of what laws and regulations mandated. Some of those obligations were spelled out a few months before Clinton took office in National Archives and Records Administration Bulletin 2008-05, which said every email system was supposed to “permit easy and timely retrieval” of the records. The secretary of state’s work emails are supposed to be preserved permanently. In addition, rules also mandated that permanent records are to be sent to the department’s Records Service Center “at the end of the Secretary’s tenure or sooner if necessary” for safekeeping...Jason R. Baron, a former director of litigation at the National Archives and Records Administration, told the Senate Judiciary Committee last year he believed that Clinton’s server ran afoul of the rules. In a memo to the committee, Baron wrote that “the setting up of and maintaining a private email network as the sole means to conduct official business by email, coupled with the failure to timely return email records into government custody, amounts to actions plainly inconsistent with the federal recordkeeping laws.”