If you’ve followed Ars over the last year, you’re likely aware of the potential for scandal with government officials misusing outside e-mail systems. Former Secretary of State Hillary Clinton was politically damaged by inquiries into her use of a private e-mail server and a personal BlackBerry device for official business. And President George W. Bush’s Chief of Staff Karl Rove resigned partly because of a scandal that arose over the deletion of over two million White House e-mails on a private server run by the Republican Party.

With that sort of history—and particularly after President Donald Trump’s campaign frequently used Clinton’s e-mail woes against her last fall—one might imagine that the White House and Republican Party would be eager to show that it knows how to do IT security properly. But early on, it seems like such assumptions may be quite wrong.

In addition to a New York Times report saying that President Trump is still using his unsecured Android phone to continue posting missives to Twitter, Newsweek claims that members of the White House staff are using e-mail accounts hosted by the Republican National Committee through its rnchq.org mail server. And it appears that Press Secretary Sean Spicer has at least twice so far posted his password to his official White House Twitter account.









With any luck, @PressSec has two-factor authentication and President Trump’s use of his Android phone is limited to Twitter posts (though a staffer still occasionally posts for him from an iPhone). Unfortunately, it does not appear that the new Trump @POTUS account is thus secured—as recently as last night, the account was only tied to the Gmail account of Trump’s social media chief Dan Scavino (dscavino@gmail.com) for password reset links. The same goes for Spicer’s @PressSec handle. The account for Vice President Michael Pence was separately tied to vicepresident2017@gmail.com, according to the hacker known as WauchulaGhost. (WauchulaGhost has previously claimed responsibility for taking over a number of ISIS accounts, and he told CNN about Pence's situation on January 24.)

All those accounts were moved over to official White House accounts by this morning, but so far only Trump’s personal Twitter is apparently protected by two-factor authentication. Even in the case of Trump’s personal Twitter account, there’s still a substantial information security risk involved. Using insecure devices to post messages from the White House leaves open the possibility of a malicious actor gaining access to the account through the phone itself. And given the impact on things like national security or the economy that Trump's intentional posts have made, such access could be a real weapon.

On top of all this, there’s the potential violations of federal law and regulations associated with Trump’s use of Twitter on an unmanaged device. While Twitter didn’t exist at the time, it could be argued that every White House tweet is now a presidential record, meaning each post requires retention—even the ones he deletes because of typos. As precedent, every tweet made by the Obama administration was archived.

The use of rnchq.org e-mail addresses is not yet a breach of federal records law, and it will likely end up being required in order for many of the White House’s staffers to avoid violation of the Hatch Act. Newsweek reported that Trump advisers Kellyanne Conway, Jared Kushner, Sean Spicer, and Steve Bannon all had active RNC e-mail accounts (though Conway’s, Kushner’s, and Bannon’s accounts have apparently now been either deleted or changed). The news outlet uncovered these addresses by simply sending SMTP requests to the RNC’s e-mail gateway.

To comply with federal records retention law, any official business conducted using outside accounts needs to be moved to the official White House e-mail system—either by forwarding it or copying it—within 20 days. This requirement is in part to preserve presidential records and in part to ensure that records are available through Freedom of Information Act requests

As far as what using outside e-mail means from a security standpoint, there are potential issues. The RNC’s e-mail system and the rest of its data center infrastructure is run internally at its headquarters, except for the RNC’s mail exchange—a Barracuda anti-spam server run by the provider Airnet. While the external interfaces to most of the RNC’s network is relatively secure—only allowing secure HTTPS traffic to connect—the party does run a publicly accessible communications server hosting XMPP instant messaging and SIP voice and video communications (it's likely a Microsoft Lync server). There’s also a public Internet facing Outlook Web App (OWA) server (owa.rnchq.org). Ars did not attempt to survey which White House staffers still had accounts on the system.