From January 2009 through January 2013, then-Secretary of State Hillary Clinton conducted official communications through a privately administered server rather than a state.gov account. The system was initially operated by aide Justin Cooper, who lacked security clearance and specialized security expertise, and later maintained by Bryan Pagliano, the IT director for Clinton’s 2008 campaign. For roughly the first two months of Clinton’s tenure, the server’s webmail connection reportedly lacked a TLS certificate, leaving transmissions unencrypted in transit. State Department security personnel warned Clinton that her BlackBerry and email setup created hacking risks, but she continued using them.
In May 2016, Inspector General Steve A. Linick found that Clinton had not sought required approval, violated department policies implementing the Federal Records Act, and used an inappropriate document-preservation system; investigators also said Clinton and senior aides declined interviews. Of roughly 30,000 work-related emails returned to the department, agencies identified 110 emails in 52 chains containing classified information when sent or received, including eight Top Secret chains, 36 Secret chains, and eight Confidential chains. The FBI concluded in July 2016 that Clinton had been “extremely careless” but recommended no prosecution because it found no criminal intent. A September 2019 State Department review found 38 individuals culpable in 91 instances involving classified information, but no systemic, deliberate mishandling. DOJ’s Inspector General reported in June 2018 that it found no evidence of political bias in the FBI’s handling of the investigation.
