Late June 2013—October 2013: During this time, it appears that Clinton’s private server is wide open to hacking attempts.

On May 31, 2013, maintenance of the server was taken over by a small Colorado-based company called Platte River Networks (PRN), and the server is sent to a data center in New Jersey. PRN then pays to use threat monitoring software called CloudJacket SMB made by a company named SECNAP. SECNAP claims the software can foil “even the most determined hackers.”

Around June 30, 2013, PRN transfers all the email accounts from the old server to the new one. However, the new software doesn’t begin working until October 2013, apparently leaving the server vulnerable. It is known that the server is repeatedly attacked by hackers in the months from October 2013 on, but it is unknown if any attacks occur when the software is not yet installed. (The Associated Press, 10/7/2015) 

An FBI report will later obliquely confirm this by mentioning that when the new server is set up in June 2013, all the hardware is built up at the time, except for an “intrusion detection device” which has to be added later after it gets shipped to the server location. (Federal Bureau of Investigation, 9/2/2016)

Justin Harvey (Credit: Third Certainty)

Justin Harvey (Credit: Third Certainty)

Justin Harvey, chief security officer of a cybersecurity company, will later comment that Clinton “essentially circumvented millions of dollars’ worth of cybersecurity investment that the federal government puts within the State Department. […] She wouldn’t have had the infrastructure to detect or respond to cyber attacks from a nation-state. Those attacks are incredibly sophisticated, and very hard to detect and contain. And if you have a private server, it’s very likely that you would be compromised.” (The Associated Press, 10/7/2015) 

In March 2013, a Romanian hacker nicknamed Guccifer discovered Clinton’s private email address and the exact address was published in the media, which would have left the server especially vulnerable in the months after.

October 2013: Clinton’s server gets anti-hacking protection after going several months without any.

The CloudJacket Logo (Credit: public domain)

The CloudJacket Logo (Credit: public domain)

From late June 2013 until October 2013, Platte River Networks (PRN) is managing the server, apparently without any anti-hacking software. In October 2013, the software they have been waiting for arrives and is installed. This is an intrusion detection and prevention system called CloudJacket from SECNAP Network Security.

According to a later FBI report, it “had pre-configured settings that blocked or blacklisted certain email traffic identified as potentially harmful and provided real-time monitoring, alerting, and incident response services. SECNAP personnel would receive notifications when certain activity on the network triggered an alert. These notifications were reviewed by SECNAP personnel and, at times, additional follow-up was conducted with PRN in order to ascertain whether specific activity on the network was normal or anomalous. Occasionally, SECNAP would send email notifications to [an unnamed PRN employee], prompting him to block certain IP addresses. [This employee] described these notifications as normal and did not recall any serious security incident or intrusion attempt.”

Additionally, “PRN also implemented two firewalls for additional protection of the network. [This PRN employee] stated that he put two firewalls in place for redundancy in case one went down.”

The FBI report will also conclude, “Forensic analysis of alert email records automatically generated by CloudJacket revealed multiple instances of potential malicious actors attempting to exploit vulnerabilities on the PRN Server. FBI determined none of the activity, however, was successful against the server.” (Federal Bureau of Investigation, 9/2/2016)

 

October 2013—February 2014: Clinton’s private email server is the subject of repeated attempted cyber attacks, originating from China, South Korea, and Germany.

The attempts are foiled due to threat monitoring software installed in October 2013. However, from June to October 2013, her server is not protected by this software, and there is no way of knowing if there are successful attacks during that time.

A 2014 email from an employee of SECNAP, the company that makes the threat monitoring software, describes four attacks. But investigators will later find evidence of a fifth attack from around this time. Three are linked to China, one to South Korea, and one to Germany. It is not known if foreign governments are involved or how sophisticated the attacks are.

Clinton had ended her term as secretary of state in February 2013, but more than 60,000 of her emails remained on her server. (The Associated Press, 10/7/2015) 

In March 2013, a Romanian hacker nicknamed Guccifer discovered Clinton’s private email address and the exact address was published in the media.

November 13, 2015: The computer companies that worked on Clinton’s private server refuse interview and document requests from Congressional investigators.

The Platte River Networks Logo (Credit: PRN)

The Platte River Networks Logo (Credit: PRN)

Platte River Networks (PRN) is the computer company that has been managing Clinton’s private server since June 2013. Politico reports that it has declined requests by the Senate Homeland Security Committee to interview five employees about the security of Clinton’s server.

The Datto Logo (Credit: Datto)

The Datto Logo (Credit: Datto)

Additionally, Datto, Inc. was employed by PRN to back up data from the server. On October 6, 2015, McClatchy Newspapers quoted Datto’s attorney who said the company had permission from representatives of Clinton and Platte River to cooperate with the FBI investigation. But on October 19, 2015, Datto told the committee that it can’t answer questions from the committee because it has a confidentiality agreement with its client PRN and can only answer questions about that account with their permission. PRN gave permission initially but then changed its mind.

PRN spokesperson Andy Boian says that the interview requests from Congress weren’t “formal” inquiries, even though request letters were delivered on official Senate letterhead. He adds, “We as a company have felt like we have done everything we can to comply with every request by both the FBI and the Homeland Security Committee, and we really have nothing left to give.”

The Infograte Logo (Credit: Infograte)

The Infograte Logo (Credit: Infograte)

Tania Neild, CEO of the technology broker company InfoGrate, helped Clinton select PRN to run their server. She declined to be interviewed by Congressional investigators, invoking a nondisclosure agreement she had with her client.

The SECNAP Logo (Credit: SECNAP)

The SECNAP Logo (Credit: SECNAP)

Another computer company, SECNAP, was involved in the security of the server. They apparently aren’t cooperating with Republican investigators either, because Dennis Nowak, a lawyer for SECNAP, says that communications technology companies are governed by a law that imposes criminal and civil penalties for disclosing customer information, and that can only be waived by subpoena, search warrant, court order, or consent of the client.

These four companies apparently have fully cooperated with the FBI. But Politico reports, “While the firms have voluntarily produced some information for Congressional Republicans in the past, now it seems they’re not willing to go beyond their legal obligations when it comes to responding to committee inquiries.”

In September 2015, Clinton publicly said regarding the FBI’s Clinton investigation that she “would very much urge anybody who is asked to cooperate to do so.” However, Politico asked the Clinton campaign if it had encouraged these computer companies to cooperate with Congressional investigators, and the campaign had no comment. (Politico, 11/13/2015)

These companies will continue to refuse to cooperate with Congress. In August 2016, Congressional Republicans will issue subpoenas to PRN, Datto, and SECNAP to finally force their cooperation.

August 22, 2016: A Congressperson issues subpoenas to three companies that helped manage Clinton’s private email server.

160822LamarSmithpublicdomain

Representative Lamar Smith (Credit: public domain)

Representative Lamar Smith (R), chair of the Committee on Science, Space and Technology, issues subpoenas for Platte River Networks, which managed Clinton’s server from May 2013 until August 2015; Datto, Inc., which made back-up copies of the server; and SECNAP, which carried out threat monitoring of the network connected to Clinton’s server. Smith wants documents from the companies by September 9, 2016, after they declined to voluntarily produce them. Congressional committees requested information since August and November 2015, to no avail. The companies had been threatened with subpoenas on July 12, 2016.

Smith comments, “Companies providing services to Secretary Hillary Clinton’s private email account and server are not above the law.” He claims the information he is seeking is “critical to… informing policy changes in how to prevent similar email arrangements in the future.”

Smith is working with Senator Ron Johnson (R), chair of the Senate Homeland Security and Governmental Affairs Committee. They are looking for information about breaches or potential breaches, and documents that detail the scope of the work of each company. (The Washington Post, 8/22/2016)

September 13, 2016: A Congressperson alleges that Clinton is responsible for a computer company not complying with a Congressional subpoena related to Clinton’s private server.

On September 12, 2016, a deadline to respond to a subpoena issued by a Congressional committee passed. Three companies involved in the management of Clinton’s private server had been given the subpoena, and one – Datto, Inc. – responded in time with documents, while the other two – Platte River Networks (PRN) and SECNAP, Inc.  – did not.

The next day, Representative Lamar Smith (R) comments in a related Congressional hearing, “just this morning… SECNAP’s [legal] counsel confirmed to my staff that the Clinton’s private LLC [Clinton Executive Service Corp.] is actively engaged in directing their obstructionist responses to Congressional subpoenas.” (US Congress, 9/13/2016)

Clinton’s lawyer will later confirm that he is prohibiting SECNAP from fully complying with a subpoena.