During her tenure as the United States secretary of state, Hillary Clinton used a private email server for official public communications rather than using official State Department email accounts maintained on federal servers. After a years-long FBI investigation, it was determined that Clinton's server did not contain any information or emails that were clearly marked classified. Federal agencies did retrospectively determine that 100 emails contained information that should have been deemed classified at the time they were sent, including 65 emails deemed "Secret" and 22 deemed "Top Secret". An additional 2,093 emails were retroactively designated confidential by the State Department. "From the group of 30,000 e-mails returned to the State Department, 110 e-mails in 52 e-mail chains have been determined by the owning agency to contain classified information at the time they were sent or received. Eight of those chains contained information that was Top Secret at the time they were sent; 36 chains contained Secret information at the time; and eight contained Confidential information, which is the lowest level of classification." "Separately, it is important to say something about the marking of classified information. Only a very small number of the e-mails containing classified information bore markings indicating the presence of classified information."
Some experts, officials, and members of Congress contended that Clinton's use of a private email system and a private server violated federal law, specifically 18 U.S. Code § 1924, regarding the unauthorized removal and retention of classified documents or materials, as well as State Department protocols and procedures, and regulations governing recordkeeping. Clinton claimed that her use complied with federal laws and State Department regulations, and that former secretaries of state had also maintained personal email accounts (however Clinton was the only secretary of state to use a private server). News reports by NBC and CNN indicated that the emails discussed "innocuous" matters that were already public knowledge. At the time, conducting official business on private email systems was common among federal officials; John Kerry was the first Secretary of State to primarily use an official state.gov account, and previous administrations—including senior Bush officials who used private RNC servers—frequently relied on non-governmental systems.
The controversy was a major point of discussion and contention during the 2016 presidential election, in which Clinton was the Democratic nominee. In May, the State Department's Office of the Inspector General released a report about the State Department's email practices, including Clinton's. In July, FBI director James Comey announced that the FBI investigation had concluded that Clinton had been "extremely careless" but recommended that no charges be filed because Clinton did not act with criminal intent, the historical standard for pursuing prosecution.
On October 28, 2016, eleven days before the election, Comey notified Congress that the FBI had started looking into newly discovered emails. On November 6, Comey notified Congress that the FBI had not changed its conclusion. Comey's timing was contentious, with critics saying that he had violated Department of Justice guidelines and precedent, and prejudiced the public against Clinton. The controversy received more media coverage than any other topic during the presidential campaign. Clinton argues that the reopening of the investigation was one of the reasons for her loss in the election. Comey said in his 2018 book A Higher Loyalty that his decision may have been unconsciously influenced by the fact that he considered it extremely likely that Clinton would become the next president.
On June 14, 2018, the Department of Justice's Office of the Inspector General released its report on the FBI's and DOJ's handling of Clinton's investigation, finding no evidence of political bias and lending support for the decision to not prosecute Clinton. A three-year State Department investigation concluded in September 2019 that 38 individuals were "culpable" in 91 instances of sending classified information that reached Clinton's email account, though it found "no persuasive evidence of systemic, deliberate mishandling of classified information". Yet a September 2022 "Fact Checker" analysis by The Washington Post, which followed a tweet by Clinton claiming, "I had zero emails that were classified", also quotes the same 2019 State Department report as having noted, "None of the emails at issue in this review were marked as classified."
Background
Clinton's use of BlackBerrys
Prior to her appointment as Secretary of State in 2009, Clinton and her circle of friends and colleagues communicated via BlackBerry phones. State Department security personnel suggested this would pose a security risk during her tenure. The email account used on Clinton's BlackBerry was then hosted on a private server in the basement of her home in Chappaqua, New York, but that information was not disclosed to State Department security personnel or senior State Department personnel.
Setting up a secure desktop computer in her office was suggested, but Clinton was unfamiliar with their use and opted for the convenience of her BlackBerry, not the State Department and government protocol of a secured desktop computer. Efforts to find a secure solution were abandoned by Clinton, and she was warned by State Department security personnel about the vulnerability of an unsecured BlackBerry to hacking. She affirmed her knowledge of the danger, and was reportedly told that the Bureau of Diplomatic Security had obtained intelligence about her vulnerability while she was on a trip to Asia, but continued to use her BlackBerry outside her office.
Domain names and email server
At the time of Senate confirmation hearings on Hillary Clinton's nomination as Secretary of State, the domain names clintonemail.com, wjcoffice.com, and presidentclinton.com were registered to Eric Hoteham, with the home of Clinton and her husband in Chappaqua, New York, as the contact address. The domains were pointed to a private email server that Clinton (who never had a state.gov email account) used to send and receive email, and which was purchased and installed in the Clintons' home for her 2008 presidential campaign.
The email server was located in the Clintons' home in Chappaqua, New York, from January 2009 until 2013, when it was sent to a data center in New Jersey before being handed over to Platte River Networks, a Denver-based information technology firm that Clinton hired to manage her email system.
The server itself runs a Microsoft Exchange 2010 server with access to emails over the internet being delivered by Outlook Web App. The web page is secured with a TLS certificate to allow information to be transmitted securely when using the website. However, for the first two months of its use—January 2009 through March 29, 2009—the web page was reportedly not secured with a TLS certificate, meaning that information transmitted using the service was unencrypted and may have been vulnerable to interception.
Initial awareness
As early as 2009, officials with the National Archives and Records Administration (NARA) expressed concerns over possible violations of normal federal government record-keeping procedures at the State Department under then-Secretary Clinton.
In December 2012, near the end of Clinton's tenure as Secretary of State, a nonprofit group called Citizens for Responsibility and Ethics in Washington, or CREW, filed a FOIA request seeking records about her email. CREW received a response in May 2013: "no records responsive to your request were located." Emails sent to Clinton's private clintonemail.com address were first discovered in March 2013, when a hacker named "Guccifer" widely distributed emails sent to Clinton from Sidney Blumenthal, which Guccifer obtained by illegally accessing Blumenthal's email account. The emails dealt with the 2012 Benghazi attack and other issues in Libya and revealed the existence of her clintonemail.com address.
Blumenthal did not have a security clearance when he received material from Clinton that has since been characterized as classified by the State Department.
In the summer of 2014, lawyers from the State Department noticed a number of emails from Clinton's personal account, while reviewing documents requested by the House Select Committee on Benghazi. A request by the State Department for additional emails led to negotiations with her lawyers and advisors. In October, the State Department sent letters to Clinton and all previous Secretaries of State back to Madeleine Albright requesting emails and documents related to their work while in office. On December 5, 2014, Clinton lawyers delivered 12 file boxes filled with printed paper containing more than 30,000 emails. Clinton withheld almost 32,000 emails deemed to be of a personal nature. Datto, Inc., which provided data backup service for Clinton's email, agreed to give the FBI the hardware that stored the backups.
As of May 2016, no answer had been provided to the public as to whether 31,000 emails deleted by Hillary Clinton as personal have been or could be recovered.
A March 2, 2015 New York Times article broke the story that the Benghazi panel had discovered that Clinton exclusively used her own private email server rather than a government-issued one throughout her time as Secretary of State, and that her aides took no action to preserve emails sent or received from her personal accounts as required by law. At that point, Clinton announced that she had asked the State Department to release her emails. Some in the media labeled the controversy "emailgate."
Use of private server for government business
According to Clinton's spokesperson Nick Merrill, a number of government officials have used private email accounts for official business, including secretaries of state before Clinton, but none have set up their own private domain to house their private email account.
State Department spokesperson Marie Harf said that: "For some historical context, Secretary Kerry is the first secretary of state to rely primarily on a state.gov email account." John Wonderlich, a transparency advocate with the Sunlight Foundation, observed while many government officials used private email accounts, their use of private email servers was much rarer. A notable exception was during the George W. Bush administration, when dozens of senior White House officials conducted government business via approximately 22 million emails using accounts they had on a server owned by the Republican National Committee.
Dan Metcalfe, a former head of the Justice Department's Office of Information and Privacy, said this gave her even tighter control over her emails by not involving a third party such as Google and helped prevent their disclosure by Congressional subpoena. He added: "She managed successfully to insulate her official emails, categorically, from the FOIA, both during her tenure at State and long after her departure from it—perhaps forever," making it "a blatant circumvention of the FOIA by someone who unquestionably knows better."
According to Harf, use by government officials of personal email for government business is permissible under the Federal Records Act, so long as relevant official communications, including all work-related emails, are preserved by the agency. The Act (which was amended in late 2014 after Clinton left office to require that personal emails be transferred to government servers within 20 days) requires agencies to retain all official communications, including all work-related emails, and stipulates that government employees cannot destroy or remove relevant records. NARA regulations dictate how records should be created and maintained, require that they must be maintained "by the agency" and "readily found," and that the records must "make possible a proper scrutiny by the Congress." Section 1924 of Title 18 of the United States Code addresses the deletion and retention of classified documents, under which "knowingly" removing or housing classified information at an "unauthorized location" is subject to a fine, or up to a year in prison.
Experts such as Metcalfe agree that these practices are allowed by federal law assuming that the material is not supposed to be classified, or at least these practices are allowed in case of emergencies, but they discourage these practices, believing that official email accounts should be used.
Jason R. Baron, the former head of litigation at NARA, described the practice as "highly unusual" but not a violation of the law. In a separate interview, he said, "It is very difficult to conceive of a scenario—short of nuclear winter—where an agency would be justified in allowing its cabinet-level head officer to solely use a private email communications channel for the conduct of government business." Baron told the Senate Judiciary Committee in May 2015 that "any employee's decision to conduct all email correspondence through a private email network, using a non-.gov address, is inconsistent with long-established policies and practices under the Federal Records Act and NARA regulations governing all federal agencies."
May 2016 report from State Department's inspector general
In May 2016, the Department's Office of the Inspector General Steve A. Linick released an 83-page report about the State Department's email practices. The Inspector General was unable to find evidence that Clinton had ever sought approval from the State Department staff for her use of a private email server, determining that if Clinton had sought approval, Department staff would have declined her setup because of the "security risks in doing so." Aside from security risks, the report stated that "she did not comply with the Department's policies that were implemented in accordance with the Federal Records Act." Each of these findings contradicted what Clinton and her aides had been saying up to that point. The report also stated that Clinton and her senior aides declined to speak with the investigators, while the previous four Secretaries of State did so.
The report also reviewed the practices of several previous Secretaries of State and concluded that the department's record keeping practices were subpar for many years. The Inspector General criticized Clinton's use of private email for Department business, concluding that it was "not an appropriate method" of document preservation and did not follow department policies that aim to comply with federal record laws. The report also criticized Colin Powell, who used a personal email account for business, saying that this violated some of the same Department policies. State Department spokesman Mark Toner said the report emphasized the need for federal agencies to adapt "decades-old record-keeping practices to the email-dominated modern era" and said that the Department's record-retention practices had been improved under the President Obama's second Secretary of State John F. Kerry, Clinton's successor. The report also notes that the rules for preserving work-related emails were updated in 2009.
Inspector General Linick wrote that he "found no evidence that staff in the Office of the Legal Adviser reviewed or approved Secretary Clinton's personal system," and also found that multiple State employees who raised concerns regarding Clinton's server were told that the Office of the Legal Adviser had approved it, and were further told to "never speak of the Secretary's personal email system again."
Clinton campaign spokesman Brian Fallon issued a statement saying: "The report shows that problems with the State Department's electronic record-keeping systems were long-standing" and that Clinton "took steps that went much further than others to appropriately preserve and release her records." However, the Associated Press said, "The audit did note that former Secretary of State Colin Powell had also exclusively used a private email account. ... But the failings of Clinton were singled out in the audit as being more serious than her predecessor." The report stated that "By Secretary Clinton's tenure, the department's guidance was considerably more detailed and more sophisticated, Secretary Clinton's cybersecurity practices accordingly must be evaluated in light of these more comprehensive directives."