Cavalier disregard for cyber security

“…no evidence that the Secretary requested or obtained guidance or approval to conduct official business via a personal email account on her private server.”

— Office of Inspector General of US State Department on Hilary Clinton’s use of private email server to conduct official business.

As if her tormentor and Republican rival Donald Trump’s poisonous taunts weren’t enough, the US Democratic presidential-aspirant Hillary Clinton has a severe internal problem that is ballooning by the day. Her use of a private e-mail server to handle most of her official correspondence as Secretary of State —an office she held during 2009-13 — was no doubt irregular by itself.

But what is now being held out against her more is her alleged duplicity in shifting positions to defend herself in the matter. The report of State Department Office of Inspector-General (OIG) — a body that is looked upon as an internal government watchdog — released on May 25 bares it all.

Contradicting Clinton’s earlier stand that she had sought the administration’s approval for using a private server, the OIG is categorical that she never sought such permission, and even if she had, she would never have got it. The rules in force were so strict!

Although the controversy has been simmering for nearly a year, the OIG’s clear disapproval of the practices during Clinton’s occupancy of office seems to have sealed it. The FBI is still investigating whether she had caused a security breach in resorting to a private email system while in a sensitive office. Given its reputation for independence, one won’t know what the FBI’s conclusions are going to be, and what that would mean to her candidacy. A few of her staff have already been quizzed by FBI, and Clinton may also be summoned soon.

Trump must be watching the developments with great glee. He is bound to exploit the OIG report by trying to tell the electorate that this was proof enough that honesty and consistency were not exactly Clinton’s strong points.

What's missing Truth is a major casualty in such a controversy which has acquired heavy political overtones. In a bitterly fought election campaign, both candidates and the media contribute to this situation.

The impression that is sought to be disseminated is that Clinton alone was being probed. Actually, the tenure and practices of five Secretaries of State — beginning with Madeleine Albright — were audited recently by the inspectorate for any cyber breaches. It was only Clinton who refused to be interviewed by the OIG.

This shade of intransigence revealed a certain indifference towards the exercise, something that has not gone well with the officialdom or the public. One of her predecessors — Colin Powell — was also guilty of the same misdemeanour for which Clinton is now being hauled over the coals.

The difference was that Powell used a personal email account but not a private server. The OIG investigation also revealed that scores of federal employees had been indiscriminately using private mail accounts to transact government business. This was especially in the period up to 2008.

The OIG observation that systemic weaknesses in the cyber security management of State Department were not new, and that they go back in years should normally be extenuating circumstances against which Clinton’s slip-up may have to be viewed. Her high profile and a general reluctance to admit mistakes — as was noted during the Benghazi House Select Committee hearings on the killing of US Ambassador Christopher Stevens in September 2012 — have possibly denied her a lofty view of the blunder in not treating cyber security with the seriousness it commands. In the OIG view, she had greater resources than any of her predecessors to upgrade security in her office.

There is evidence that Clinton was aware of what was happening in her office in the area of information security. When one of her staff pointed out the irregularity of hiring and using a private mail server, she simply brushed aside the objection.

Again, when asked to turn in all the traffic of electronic mail during her tenure as Secretary of State, she complied with the direction only partially. The suspicion is that she had withheld a fair proportion of the mails. This again showed her in poor light. Whether this was intentional or not, one won’t be able to speculate. There is a theory that the mails that were not produced pertained to the first two months of her office when she was still in transition, and that these had simply disappeared from the system.

Wrong ways Whatever be the case, such non-production of some mails appears grievously wrong when an investigation was on. It certainly provides grist to the mill. It is also the OIG’s finding that of the 50,000 pages of a hard copy of the mails handed over to OIG by the Clinton staff, 2000 pertained to confidential correspondence with a bearing on national security, for which it was not appropriate to use a private server.

All this is compounded by the admission of Clinton’s staff that there were in fact a few intrusions into the system somewhere around 2011, and these were not reported to the information security team in the State Department. Whether such suppression of significant events within the nerve centre of a sensitive wing of the administration was at the instance of Clinton or otherwise, is anybody’s guess.

What emerges however from some parts of the OIG report and otherwise is that Clinton was obsessed with fears that the confidentiality of her personal mail was at risk if she agreed to a system where her official and private mails were segregated by a system controlled by the State Department.

When pressed hard by her Deputy Chief of Staff in November 2010 to ponder and resolve the issues raised here, she is said to have quipped: “Let’s get separate address or device (for official correspondence), but I don’t want any risk of the personal being accessible.”

Security concerns What should cause consternation to the Clinton camp is the legal position that is being cited in some conversations. The Federal Records Act is clear that everyone in Federal government preserves and hands over all papers transacted during office, before he or she leaves government. Clinton did not do so, but surrendered them only in 2014, a year after she left State Department, that too only when demanded.

In the ultimate analysis Clinton may emerge from this scrape with only slight damage. The moral, however, is matters of cyber security are too complex and important to be handled unprofessionally. A political great will regret any casualness in this regard.

The analogy here is to dignitary protection, something that is better left to the men trained and accountable for it, such as the Secret Service in the US, and the Special Protection Group (SPG) in India. Any attempt to treat them like handymen and factotums, instead of as knowledgeable professionals, is fraught with great risk.

The writer is a former director of the CBI

COMMENT NOW