March 10, 2015: Hillary’s claim of private email correspondence with her husband Bill is contradicted by him.

Matt McKenna (Credit: The Associated Press)

Matt McKenna (Credit: The Associated Press)

In a press conference at the United Nations, one reason Hillary Clinton gives for deleting some of the emails from her private server is that they “contain[ed] personal communications from my husband and me.”

However, on the same day she says this, Matt McKenna, spokesperson for Bill Clinton, asserts that Bill still doesn’t use email himself. Although he does use Twitter sometimes, he has only sent two emails in his life, and both of them were when he was president in the 1990s. (The Daily Telegraph, 3/10/2015) (The Wall Street Journal, 3/10/2015)

March 10, 2015: Clinton falsely claims that her private server had “no security breaches.”

Clinton answers questions at a United Nations press conference on March 10, 2015. (Credit: The Associated Press)

Clinton answers questions at a United Nations press conference on March 10, 2015. (Credit: The Associated Press)

During her United Nations press conference, Clinton says about her private email server at her Chappaqua, New York, house: “The system we used was set up for President Clinton’s office. And it had numerous safeguards. It was on property guarded by the Secret Service. And there were no security breaches.”

However, in May 2016, a State Department inspector general’s report will detail hacking attempts on Clinton’s emails housed in the server. In January 2011, Justin Cooper, who helped manage the server, wrote in an email that he shut down the server because he suspected “someone was trying to hack us…” Later that day, he wrote, “We were attacked again so I shut (the server) down for a few min [minutes].” And in May 2011, Clinton told her aides that someone was “hacking into her email.”

Additionally, the Associated Press will later comment that “it’s unclear what protection her email system might have achieved from having the Secret Service guard the property. Digital security breaches tend to come from computer networks, not over a fence.” (The Associated Press, 5/27/2016)

Shortly After March 10, 2015 or Later: An employee of the company managing Clinton’s server comments that company employees are seeking to “cover our asses” due to news that Clinton’s emails were deleted.

In September 2016, a New York Post article will reveal details of a number of emails between Platte River Networks (PRN) employees, the company managing Clinton’s private server since June 2013.

In it, the Post will mention that PRN employees “frantically sought to ‘cover our asses’ when news broke that [Clinton’s] communications were deleted.” Unfortunately, the article won’t mention which PRN employee wrote the “cover our asses” quote or when that email was sent. (The New York Post, 9/18/2016)

However, the revelation that over 30,000 of Clinton’s emails were deleted occcurs in public comments by Clinton on March 10, 2015, so it seems probable the email is from shortly after that date, although this is not certain. The timing could be important, because the emails won’t actually be deleted from Clinton’s private server by PRN employee Paul Combetta until around March 31, 2015, three weeks after Clinton’s public claim that they were deleted.

March 11, 2015: A State Department inspector general report is released which refutes Clinton’s assertion made one day before.

Tom Blanton (Credit: NSA Archives / George Washington University)

Tom Blanton (Credit: NSA Archives / George Washington University)

On March 10, 2015, Clinton claimed that her decision to use a private email account “for convenience” didn’t interfere with the State Department’s ability to retrieve those emails later. But a March 11, 2015 inspector general report highlights how poorly the department has permanently archived emails. 

For instance, in 2011, only 61,156 department emails out of a billion were formally archived, a rate of far less than one percent. In 2013, the number—41,749—was even lower.

The report suggests that most employees “who did not use record emails as intended [said] they were usually unaware of what types of information should be saved as record emails. The department does not give employees adequate training to distinguish between information that should be preserved as records and information that may be discarded.” Furthermore, “Many interviewees expressed a fear that if participants in a debate knew that their opinions would be permanently recorded or accessible in searches, they would not express their opinions in an uninhibited manner.” (Politico, 3/11/2015)

Tom Blanton, director of the government’s National Security Archive, comments, “Just because [Clinton] sent to people at ‘state.gov’ addresses, it’s not at all a guarantee that it’s been preserved.” Additionally, “When an official leaves office, and most of her direct aides in fact have left the State Department, within 90 days the IT [information technology] folks at State wipe out their accounts unless there’s a special intervention.” (National Public Radio, 3/11/2015)

March 11, 2015: The Associated Press sues the State Department to force the release of Clinton’s documents that the department has failed to turn over.

The Associated Press made various Freedom of Information Act (FOIA) requests long before the Clinton email scandal became publicly known. In some cases, the requests were made five years earlier, as far back as May 2010, and still hadn’t been fulfilled. The requests don’t involve emails but are mostly for Clinton’s calendars and schedules. (The Associated Press, 3/11/2015) (The Associated Press, 8/7/2015) (The New York Times, 3/3/2015)

The Associated Press will finally get some of the documents in July 2016.  (The Associated Press, 6/24/2016)

March 11, 2015: Senator Rand Paul criticizes comments Clinton made about her email scandal.

Senator Rand Paul (Credit: Lexington Herald Leader)

Senator Rand Paul (Credit: Lexington Herald Leader)

Paul (R) says, “She says she didn’t transfer classified information; her schedule is classified. Like if you want to know when she goes to yoga, that’s really benign, but what if you’re a terrorist? That would be an important item to know… So when her schedule is transferred via email, it should go through a secure device. When she says, ‘Oh, I for convenience sake I didn’t want to use two phones,’ well one, someone should inform her you can put two email apps on one phone. But the other thing is that her convenience shouldn’t trump national security. If she’s having a conversation with the president via email, which she admits that she did, do you think if you wanted to read it, if you did a Freedom of Information Act, do you think they’ll give it to you? They’ll say it’s classified. Yet she’s saying ‘I didn’t do anything classified.’” (The Today Show, 3/11/2015) 

Paul will run for president later in 2015, but will drop out early.

March 17, 2015: Clinton didn’t sign an oath that she turned over all official records before leaving office.

State Department spokesperson Jen Psaki claims the department cannot find Clinton’s form OF-109 which contains the oath, and perhaps Clinton never signed it, despite rules requiring all departing employees to. However, Psaki also notes that it appears Clinton’s secretary of state predecessors Colin Powell and Condoleezza Rice also didn’t sign the form.

Raj Shah, research director at the Republican National Committee (RNC), says, “With her exclusive use of private email from a server in her own home, it’s easy to see why Clinton didn’t bother to sign the form.” (The Washington Post, 3/17/2015)

March 18, 2015: The DIA’s former chief technology officer says: “I have no doubt in my mind that [Clinton’s server] was penetrated by multiple foreign powers.”

Bob Gourley (Credit: public domain)

Bob Gourley (Credit: public domain)

He adds, “To assume otherwise is to put blinders on.” This is according to Bob Gourley, who was the chief technology officer at the DIA [Defense Intelligence Agency] from 2005 to 2008 and is the founder of Cognitio, a cybersecurity consulting firm. (Bloomberg News, 3/18/2015)

March 18, 2015: Clinton’s private server was not protected against hackers who might impersonate her identity.

A security evaluation of Clinton's server. (Credit: Bloomberg View)

A security evaluation of Clinton’s server. (Credit: Bloomberg View)

Bloomberg News reports, “According to publicly available information, whoever administrated [Clinton’s private server] didn’t enable what’s called a Sender Policy Framework, or SPF, a simple setting that would prevent hackers sending emails that appear to be from clintonemail.com. SPF is a basic and highly recommended security precaution for people who set up their own servers.”

Bob Gourley, who was the chief technology officer at the DIA [Defense Intelligence Agency] and is the founder of his own cybersecurity consulting firm, says: “If [an SPF] was not in use, [hackers] could send an email that looks like it comes from her to, say, the ambassador of France that says, ‘leave the back door open to the residence a package is coming.’ Or a malicious person could send an email to a foreign dignitary meant to cause an international incident or confuse US foreign policy.” This also would have made it easy for hackers to launch “spear phishing” attacks from Clinton’s account. Other government officials could have thought they were getting a real email from Clinton and then be tricked into having their own accounts breached.

Clinton’s spokesperson claims there is no evidence her account was ever successfully exploited in this manner. But Bloomberg News points out, “The problem with such confidence is that if hackers exploited the SPF vulnerability, Clinton’s office would likely never have known her domain name…was being used surreptitiously.” (Bloomberg News, 3/18/2015)

March 18, 2015: Clinton’s team won’t answer basic questions about the security of her private server.

John A. Lewis (Credit: John Hopkins University)

John A. Lewis (Credit: John Hopkins University)

Clinton spokesperson Nick Merrill claims that when Clinton set up her private email server, “Robust protections were put in place and additional upgrades and techniques were employed over time as they became available. There was never evidence of a breach, nor any unauthorized intrusions.”

However, Merrill declines to say who exactly was in charge of maintaining the server and ensuring its security. Furthermore, it’s unclear what sort of security vetting that person or persons received, if any. Additionally, Merrill won’t reveal if other departments that protect government communications, such as the FBI or the NSA, were ever told of the server’s existence, and if so, if they helped provide security for it.

James A. Lewis, who held senior technology posts at the White House and State Department, comments that emails “that run on commercial services are vulnerable to collection. […] I don’t think people realize how much of this information is available to foreign intelligence services.” (Bloomberg News, 3/18/2015)

Contrary to Merrill’s claim, a May 2016 State Department inspector general report will reveal that there were hacker attacks on Clinton’s server.

March 20, 2015: The House Benghazi Committee formally requests that Clinton turn over her private email server.

In a letter to Clinton’s lawyer David Kendall, the committee says Clinton should give her server to the State Department’s inspector general or to a neutral party in order to determine which of her emails were work-related and which ones were personal. (The New York Times, 3/20/2015) Several day later, Kendall replies that turning over the server would be pointless since no emails remain on it. (The New York Times, 3/31/2015)

Clinton will keep her server until a copy is given to the FBI in August 2015. It will later be reported that the FBI recovers most if not all of the deleted emails on the server.

March 25, 2015: A conference call precedes the permanent deletion of Clinton’s “personal” emails.

Platte River Networks (PRN), the computer company managing Clinton’s server, holds a conference call with some members of former President Bill Clinton’s staff. This is according to a later FBI report, but the FBI has not revealed who exactly takes part in the conference call or what is discussed.

The four “President Clinton” aides who had access to the private server were from left to right, Justin Cooper, Doug Band, Jon Davidson, and Oscar Flores. (Credit for all photos: public domain)

PRN employee Paul Combetta will later say that in the days just after this call, between March 25 and 31, 2015, he suddenly remembers that he did not make changes to the email retention policy to Clinton’s email account, as one of Clinton’s lawyers (and her former chief of staff) Cheryl Mills requested him to do back in December 2014. He will then proceed to do so, resulting in the permanent deletion of all of Clinton’s emails that had been deemed personal.

PRN only has two employees involved in managing Clinton’s server, so it seems highly likely Combetta takes part in the conference call. (Federal Bureau of Investigation, 9/2/2016)

Between March 25 and 31, 2015: A Platte River Networks employee allegedly deletes all of Clinton’s emails and then wipes them to prevent their recovery, despite apparently having no clear order to do so.

Platte River Networks (PRN) is managing Clinton’s private server, and two PRN employees are occasionally working on it. Around December 2014, PRN employee Paul Combetta was told by one of Clinton’s lawyers (and her former chief of staff) Cheryl Mills to delete all copies of Clinton’s emails off Mills’ computer and the computer of another lawyer working for Clinton, Heather Samuelson. He did so. But he says he was also told by Mills to change the email retention policy on Clinton’s clintonemail.com email account so that Clinton’s unwanted “personal” emails would be deleted after 60 days, and he forgot to do that.

Combetta will be interviewed by the FBI on February 18, 2016. At that time, he will say that after a conference call between PRN and the staff of former President Bill Clinton on March 25, 2015, roughly between March 25 and 31, 2015, he will realize he forgot to make the change, but then will tell the FBI that he didn’t do anything about it.

However, Combetta will be interviewed by the FBI again on May 3, 2016, and his answers will change. This time, he will say he had what told the FBI was “an ‘oh shit’ moment.” Then, sometime between March 25 and 31, 2015, he deleted the Clinton archive mailbox from Clinton’s server. Furthermore, he used BleachBit to delete the exported .pst files he had created on the server system containing Clinton’s emails.

150326PlatteMontage

There are six employees leading PRN in 2015. From left to right they are Brent Allshouse, David DeCamillis, Treve Suavo, Sam Hickler, Craig Papke, and Dave Robinson (not pictured). (Credit: Linked In and Platte River Networks)

An FBI report will explain, “BleachBit is open source software that allows users to ‘shred’ files,” as well as other functions. “BleachBit’s ‘shred files’ function claims to securely erase files by overwriting data to make the data unrecoverable.”

Additionally, the FBI investigation will later find “evidence of these deletions and determined the Datto backups of the [Clinton’s] server were also manually deleted during this timeframe.” However, the FBI will not mention if they figured out who deleted the Datto back-ups, whether it is Combetta or someone else.

150326BleachBitSystemCleaner1.8

BleachBit System Cleaner 1.8 (Credit: BleachBit)

Note that Combetta was only asked by Mills to change the deletion policy on Clinton’s account, which would have deleted only her “personal” emails 60 days later. He actually immediately deleted all of her emails, including her work-related ones, and then used a program to make their later recovery impossible. It is not clear if anyone told him to do this, and if so who, or if he did it on his own.

Furthermore, Combetta took these actions even though Mills sent him (and others at PRN) an email on March 9, 2015, which mentioned how the House Benghazi Committee had requested to Clinton’s lawyers that all of Clinton’s emails should be preserved. In his first FBI interview, he will deny being aware of this. But in his second FBI interview, according to the FBI, at the time he made the deletions, “he was aware of the existence of the preservation request and the fact that it meant he should not disturb Clinton’s email data on [Clinton’s] server.” (Federal Bureau of Investigation, 9/2/2016)

March 27, 2015: Blumenthal sent Clinton intelligence apparently based on NSA wiretapping of top European leaders.

Angela Merkel (Credit: The Associated Press)

Angela Merkel (Credit: The Associated Press)

Gawker reveals that Sid Blumenthal’s emails to Clinton appear to contain information from highly classified NSA intercepts of German Prime Minister Angela Merkel. It is not stated when, but one of Blumenthal’s emails details conversations between Merkel and her finance minister Wolfgang Schäuble about French President Francois Hollande (who was elected in 2012). Blumenthal marked the email with a warning: “THIS INFORMATION COMES FROM AN EXTREMELY SENSITIVE SOURCE.” (Gawker, 3/27/2015) 

In 2013, whistleblower Edward Snowden revealed that the NSA had tapped Merkel’s phone for many years. In July 2015, it will be revealed that the phones of Germany’s ministers were tapped by the NSA as well. (The Guardian, 7/1/2015) It is not clear how Blumenthal gets such intelligence, since he is a private citizen with no security clearance at the time.

March 27, 2015: Clinton is not willing to hand over her private server to see if emails were improperly deleted.

Clinton’s personal lawyer David Kendall reveals this in a letter to the House Benghazi Committee. On March 20, 2015, the committee had suggested that an independent party could review it to see if any work-related emails remained. Kendall states, “There is no basis to support the proposed third-party review of the server… To avoid prolonging a discussion that would be academic, I have confirmed with the secretary’s IT [information technology] support that no emails… for the time period January 21, 2009 through February 1, 2013 reside on the server or on any back-up systems associated with the server.” (Politico, 3/27/2015) 

Clinton will give the server to the FBI in August 2015. (The Washington Post, 8/12/2015) One month later, it will be reported that deleted emails have been recovered from the server, and some of them are work-related. (Bloomberg News, 9/2/2015)

March 27, 2015: It is unclear if Clinton still has copies of her deleted emails.

Clinton speaks during a news conference in New York, March 10, 2015. (Credit: Mike Segar / Reuters)

Clinton speaks during a news conference in New York, March 10, 2015. (Credit: Mike Segar / Reuters)

The New York Times reports that while it is known Clinton deleted over 31,000 emails from her server due to alleged personal content, it is unknown if she still retains copies of them elsewhere. “At a news conference this month, Mrs. Clinton appeared to provide two answers about whether she still had copies of her emails. First, she said that she ‘chose not to keep’ her private personal emails after her lawyers had examined the account and determined on their own which ones were personal and which were State Department records. But later, she said that the [contents of the] server… ‘will remain private.’” (The New York Times, 3/27/2015)

March 27, 2015: There allegedly is a “massive” FBI investigation of Guccifer’s hack into Blumenthal’s emails.

Cody Shearer (Credit: Vimeo)

Cody Shearer (Credit: Vimeo)

In March 2013, Clinton confidant Sid Blumenthal’s email account was broken into by the Romanian hacker nicknamed Guccifer, and some emails between Blumenthal and Clinton were publicly revealed. Cody Shearer was a business partner with Blumenthal in a company called Osprey Global Solutions that is sometimes mentioned in the hacked emails.

When contacted by Gawker for a comment about such emails, Shearer says that “the FBI is involved and told me not to talk. There is a massive investigation of the hack and all the resulting information.”

Nothing else is known about this investigation, presuming it exists. Shearer is also described by Gawker as “a longtime Clinton family operative.” (Gawker, 3/27/2015)

March 31, 2015: A Platte River Networks employee talks to two of Clinton’s lawyers shortly after deleting and wiping all of Clinton’s emails from her server.

Platte River Networks (PRN) is a computer company managing Clinton’s private server. PRN employee Paul Combetta will later admit to the FBI that he deleted all of Clinton’s emails from her server and then used the computer program BleachBit to permanently eliminate the emails. This is despite the fact that he claims he had only been told by one of Clinton’s lawyers (and her former chief of staff) Cheryl Mills back in December 2014 to change the email retention policy on Clinton’s account.

On March 25, 2015, there was a conference call between PRN employees and members of former President Bill Clinton’s personal staff. On March 31, 2015, there is another conference call. Combetta will later say he made the deletions at some point between the two calls.

Details about the second call are murky because the FBI only discovered it took place due to discovering a PRN work ticket about it. The ticket mentions PRN employees talking to Clinton’s personal lawyer David Kendall as well as her lawyer Mills. But when Combetta was asked about it, according to the FBI, “PRN’s attorney advised [him] not to comment on the conversation with Kendall, based upon the assertion of the attorney-client privilege.”

In 2016, Mills will be interviewed by the FBI. She will state that she was unaware that Combetta made such deletions and modifications in March 2015. This presumably would mean they were not discussed in the second conference call, or any time after that. Clinton will also be interviewed in 2016, and she will also claim she was unaware of the March 2015 email deletions. (Federal Bureau of Investigation, 9/2/2016)