Clinton’s private e-mail was blocked by spam filters—so State IT turned them off

Documents recently obtained by the conservative advocacy group Judicial Watch show that in December 2010, then-US Secretary of State Hillary Clinton and her staff were having difficulty communicating with State Department officials by e-mail because spam filters were blocking their messages. To fix the problem, State Department IT turned the filters off—potentially exposing State's employees to phishing attacks and other malicious e-mails.

The mail problems prompted Clinton Chief of Staff Huma Abedin to suggest to Clinton, "We should talk about putting you on State e-mail or releasing your e-mail address to the department so you are not going to spam." Clinton replied, "Let's get [a] separate address or device but I don't want any risk of the personal [e-mail] being accessible."

The mail filter system—Trend Micro's ScanMail for Exchange 8—was apparently causing some messages from Clinton's private server (Clintonemail.com) to not be delivered. Some were "bounced;" others were accepted by the server but were quarantined and never delivered to the recipient. According to the e-mail thread published yesterday by Judicial Watch, State's IT team turned off both spam and antivirus filters on two "bridgehead" mail relay servers while waiting for a fix from Trend Micro.

There was some doubt about whether Trend Micro would address the issue before State performed an upgrade to the latest version of the mail filtering software. "I am not confident Trend Micro will provide an update for SMEX 8," wrote one member of State's IT team, Trey Jammes. "That is two revs behind their current offering, SMEX 10, and they are pushing us to go to that (currently in pilot), and they have never not yet been able to deliver a fool-proof solution for a problem that has been around for at least 2 years. Unfortunately, we have seen similar problems with SMEX 10… I don't think we have seen that problem with SMEX 10 when running without the anti-spam piece."

A State Department contractor support tech confirmed that two filters needed to be shut off in order to temporarily fix the problem—a measure that State's IT team took with some trepidation, because the filters had "blocked malicious content in the recent past."

It's not clear from the thread that the issue was ever satisfactorily resolved, either with SMEX 8 or SMEX 10. But State's unclassified e-mail system has been repeatedly breached by attackers. An attack purported to have been staged by Russian hackers caused the department to briefly shut down all its unclassified e-mail systems in 2014 but persisted within State's network for more than a year afterward. Then Iranians spear-phished State employees in 2015, breaching the e-mail system again.

The latest batch of documents obtained by Judicial Watch also includes an e-mail from Justin Cooper, the former aide to President Bill Clinton who set up the private mail server for Clinton and her staff at State, to Abedin, explaining that the server had been shut down briefly because "we were attacked again." He explained further in a follow-up e-mail, "I had to shut down the server…Someone was trying to hack us and while they did not get in I didn't want to let them have the chance. I will restart it in the morning."

 

Listing image by Lorie Shaull