Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Did the Clinton Email Server Have an Internet-Based Printer?

krebsonsecurity.com

Post reply on HN
Print view View original

161–170 of 259 posts

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#161

Post by gscott »

jbooth wrote: post #152
therobot24 wrote: post #123

Earlier quoted context omitted.

>> She is also supposedly not the first Secretary of State to have an arrangement of this nature. http://www.politifact.com/truth-o-meter/statements/2016/mar/... Politifact rates this idea mostly false.

They rated the statement 'my predecessors did the exact same thing' mostly false. Editorial choice -- they could have rated the statement 'none of my predecessors followed proper procedure for email either' and found it true. Powell maintained his own email but without the server in his house, Rice claims she avoided all email, so we have exactly 0 secretaries of state who've handled email 'the right way' in 220-some…

Colin Powell at the time many of the people he communicated with just didn't use email... He has had two of his emails marked as classified...

http://www.upi.com/Top_News/US/2016/02/05/Colin-Powell-Condo...

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#162

Post by karmacondon »

A rough analogy for this situation would be if a company had an "employees must use blackberries" policy, but the CFO of the company outright refused because he wanted to use his iPhone. Are they going to fire the CFO over that? Possible but not likely, especially if he is doing a good job otherwise.

In the same way, the Secretary of State can also refuse to comply with government policy (not law). You can't fire the Secretary of State for using the wrong email server. It just doesn't work that way. The fact that national security is involved does change things, but organizational politics is pretty much the same all over. If Clinton's email server contained the nuclear launch codes or the contents of Area 51 then the government would have handled it differently. It's unlikely that any lasting and serious security threats were exposed.

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#163

Post by fvargas »

mikegioia wrote: post #102
Jerry2 wrote: post #11

Here's some more details about the state of security of her private server [0]: > Outlook Web Access, or OWA, was running on port 80 without SSL (unencrypted) > Remote Desktop Protocol, port 3389, was exposed through the DMZ (open to anyone on the internet.) This, at the time it was being used, was open to critical vulnerabilities that would allow for remote execution of code. > VNC Remote Desktop, port 5900, was als…

This is, in my opinion, the worst part of the story. Anyone who has set up a web-server on the public net knows what happens when you leave ports accessible like this to old, well-known software. There's a good chance people would target her domain/IP looking for exploits and I'd be scared to question just how many people got access to that machine.

I wouldn't say "anyone". Most people, technical or not, have no idea what they're doing when it comes to computer security and don't care enough or take the time to research best practices.

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#164

Post by karmacondon »

engi_nerd wrote: post #19
gizmo wrote: post #8

Earlier quoted context omitted.

No nefarious plot. My understanding is that it went roughly like this. Back in 2009 Clinton requested a secure smartphone from the NSA. It's a custom made device (security by obscurity?). Anyway, the president gets one. As the secretary of state she has to travel a lot, and not being able to do email on the road is highly impractical. So she thought she should get one too. The NSA denied her request for a secure smar…

And those slipups should open her to prosecution under the Espionage Act. A number of security professionals (I mean security in the government, Information Assurance sense) have told me that if they or I were to do anything like what Secretary Clinton did, we would be liable to be prosecuted.

This is very true. But you aren't the Secretary of State. I'm sure there are people at a high enough level at wherever you work now that the normal rules don't apply to them. That's the nature of any organization. C-level executives, military generals and high level politicians can all decide not to follow certain rules if they choose, especially when it comes to IT policy. I'm not saying that what Clinton did was right or good, but this kind of thing does happen at a large number of organizations. It should not be surprising that an internationally famous figure would be treated differently than a mid level employee.

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#165

Post by csours »

csours wrote: post #107
at-fates-hands wrote: post #71

Earlier quoted context omitted.

She probably won't if Trump is elected. A lot of people are saying there's no way she gets indicted before the election. However, if Trump is elected, he's already said he's going to indict her and send her to prison. Therefore, I if you want to see her indicted, you're probably going to have to vote for Trump.

At best Trump can appoint a US Attorney General who will promise to try to indict.

/best/most/ - can't edit any more.

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#166

Post by zzzeek »

stillusingvb6 wrote: post #157
zzzeek wrote: post #154

Earlier quoted context omitted.

> prosecuted for this, feel free to name specific legal statues that were violated as well as which are misdemeanors or felonies.

18 U.S.C Sec. 793(f)

here's a great rebuttal to that:

http://lawnewz.com/high-profile/no-hillary-did-not-commit-a-...

using this statue to prosecute would not only violate the spirit and intent of the law but also be very unlikely, given precedent, to result in any conviction. Hence a competent prosecutor would likely not seek to prosecute based on this law, nor should they, as it would be a waste of taxpayer money not to mention the ill effect it would have on our electoral process (sudden unnecessary prosecution against particular candidates unlikely to lead anywhere).

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#167

Post by burfog »

argonaut wrote: post #104
gormo2 wrote: post #82

Earlier quoted context omitted.

>And the article lists various reasons why none of those would likely apply to her. I guess we have different definitions of "likely" since the only reasons given are: (1) Clinton and her aides have insisted that she didn't. They say none of her emails included material that was marked as classified at the time. (2) She says she didn't, and there's no known evidence that she did. (3) "If all she was doing was exchang…

1) That's because it's fact that none of her emails were marked as classified at the time. Not an opinion! 2) Her email exchanges are public. You would think they would have found proof of willful communication by now. They have not. 3) Requires intent, which is generally, objectively difficult to prove (see: libel laws).

"marked as classified" isn't what matters. It's misdirection.

The standard is that she had reason to believe that the email contained classified information.

Consider something obvious, like full details of an ICBM including plans for the nuclear warhead and decoys. You get a copy without markings. I hope you wouldn't imagine it to be unclassified just because it isn't "marked as classified at the time".

Some of her email contained information that she got from other government agencies; she knew it was classified and had no authority to declassify it. Some of her email actually was marked classified; we can assume she believed it to be classified. There is even a lovely case where she tells a subordinate to REMOVE THE MARKINGS and then send insecurely.

For issues with classified information, intent doesn't normally matter. This isn't libel. The rules are different. It's more like strict liability.

I don't know why you think proof has not been found. Is it because prosecution hasn't started? You can bet that many FBI and DOJ employees are struggling with the realization that prosecuting her would likely get them fired. The stress must be enormous.

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#168

Post by shkkmo »

salgernon wrote: post #156
engi_nerd wrote: post #19

Earlier quoted context omitted.

And those slipups should open her to prosecution under the Espionage Act. A number of security professionals (I mean security in the government, Information Assurance sense) have told me that if they or I were to do anything like what Secretary Clinton did, we would be liable to be prosecuted.

Well, why aren't they? Somehow I don't believe she sat there and edited her sendmail.cf by hand. She delegates the task, it gets done crapily, then it works so why change it. I'm currently working with a major health care center - top of the line everything - and they hand me my upcoming appointment schedule printed from "myfreecalendars.com" because their IT people haven't gotten printing working in their new schedu…

> I'm sure it's a HIPPA violation, but frankly I'm not going to complain because I need to get shit done too.

I'm sorry, but how is "I'm to busy to follow the law" a valid excuse?

Re: Did the Clinton Email Server Have an Internet-Based Printer?

#170

Post by [deleted] »

untog wrote: post #65

Among the more disappointing things in all of this is that there is a rational, important conversation to be had about everyday awareness of security and government inflexibility. But there won't be, because she is Hillary Clinton and it is 2016. Supposedly she got the server set up because the NSA refused to give a politician who travels frequently a secure smartphone. She (I personally believe) was likely ignorant…

[deleted]
Post reply on HN