Last Friday, the Federal Bureau of Investigations published a 58-page redacted memorandum on the investigation of the mishandling of classified information by former Secretary of State Hillary Clinton. The memo includes details from Clinton's interview with the FBI and a summary of other interviews the FBI conducted during the yearlong investigation.

During her three-and-a-half-hour interview with FBI investigators, Hillary Clinton said that she had used a personal e-mail account "out of convenience" because she only wanted to carry a single mobile device—and the State Department would not allow her to connect a work device to her personal e-mail. She said she had no recollection of anyone voicing concerns over the arrangement. But the FBI investigation found records of an exchange with former Secretary of State Colin Powell on the topic, where he warned her of the risks and told her how he had "gotten around it."

The FBI report shows that Clinton generally allowed others to make decisions about how to support her Blackberry habit and that the private mail server she used was run largely at the direction of former President Bill Clinton's staff. And while the FBI did not find that Clinton did anything criminal, the investigation revealed a generally lax approach to security overall by the State Department, Clinton's staff, and Clinton herself.

Clinton told the FBI that she "did not pay attention to the level of classification of information and took all classified information seriously," the FBI memo reports. But she was unable to identify the meaning of "(C)" (Confidential) content markings in an e-mail, speculating in the interview that it had something to do with paragraphs that were supposed to be in alphabetical order. She demonstrated a limited understanding of procedures for classification of information—even though she was designated as an Original Classification Authority, someone authorized to set the level of classification on information.

The blind leading the blind?

Clinton's name was signed to a memo in 2011 that warned State Department employees not to use personal e-mail or devices for work—a directive that ran entirely opposite to her own practices. That policy was sent out via an Office of the Secretary of State e-mail account, signed by Clinton. But Clinton herself did not send it, as she never used an official e-mail account at State. Upon her arrival at the State Department, Clinton was offered an official department e-mail address by the State Department's director of information technology—an offer she refused. But several e-mail accounts were configured on her behalf to broadcast messages from her office and to allow Outlook calendar appointments to be set with her—accounts that were maintained by her staff.

As far as what found its way into her e-mail, Clinton said that she depended heavily on her staff to determine whether information was appropriate to transmit via unclassified e-mail. Almost all of the classified information that was in Clinton's e-mails came from either official State Department accounts or from the accounts her personal staff used on her server. The most extreme cases—in which Top Secret/Special Access Program (TS/SAP) information was exchanged—were initiated by her deputy chief of staff, Jake Sullivan. Sullivan forwarded official State Department e-mails from others (the e-mails lacked classification markings and should not have been on the unclassified State e-mail system in the first place).

Sullivan told the FBI that State Department officials widely used the unclassified-for official use only (U/FOUO) e-mail system to send classified information. One told the FBI that "the right method of communication" regardless of classification "was whatever method allowed for the fastest possible dissemination of the message." The official also told FBI investigators that he frequently received e-mails from other agencies that were "technically probably classified." Other State employees said that they often tried to work around classification levels by "talking around" sensitive details in e-mails.

The other Clinton

The FBI investigation showed Clinton had little or no involvement in how her personal e-mail service was run. Most of the decisions about how the clintonemail.com domain and mail server were set up were made by members of former President Bill Clinton's staff. In many respects, it seems there was little division between the former president's staff and the secretary of state's. President Clinton was even sent documents to print out for Hillary Clinton at their Chappaqua home by her staff, including her deputy chief of staff, Huma Abedin.

While not on the same domain, former President Clinton's staff used the same e-mail server as Secretary Clinton and her staff. The original server for Clintonemail.com was, as Ars reported last Friday, a Power Mac G4 or G5 tower (the FBI isn't clear which), originally intended to provide mail for two domains used by Bill Clinton, though not by the former president himself. Mr. Clinton's aide, Justin Cooper, set up Secretary Clinton's personal domain and oversaw the move to newer servers in the Clintons' home in Chappaqua; former President Clinton's staff initiated the move to shift the server from the basement to a data center and the outsourcing of its management to Platte River Networks. Secretary Clinton was only vaguely aware of any of this.

How secure was Clinton's private server? There were a number of missteps by those administering the system—but there was no evidence that any of the accounts associated with her private domain were ever compromised. The FBI did find that the e-mail account of an unidentified woman on President Clinton's staff—hosted on the same server— was accessed via the Tor anonymization service, apparently by someone other than the staffer.

Brian Pagliano, the former IT staffer from Hillary Clinton's 2008 presidential campaign who was hired to manage the Clintonemail.com server, told the FBI that he had recommended configuring TLS encryption for all traffic between the State Department's e-mail and the Clintons' server because he suspected there was classified information passing between the two. But that protection was never configured, nor was a virtual private network connection he considered implementing. And he and Cooper remotely administered the server using Remote Desktop Protocol without using two-factor authentication (which he also told the FBI he had considered but had never gotten around to setting up). Platte River Networks would also use an RDP connection to administer the server once it was moved to a data center.

"While the availability of RDP on a server is convenient for remote access," the FBI investigators noted, "the FBI is aware of known vulnerabilities."

A lack of foresight

If anything, the FBI report adds proof to the argument that Secretary Clinton operated within a bubble created for her by her own staff and that of her husband. She operated in a fashion similar to many corporate executives, detached from the details of daily business operations, depending on her faithful staff to keep her out of trouble while at the same time making things as convenient for her as possible. And as someone given the authority to set the classification level of information and enforce it, she appeared to have a fairly casual acquaintance with what the levels of sensitive information classification were.

In the end, the excuses for all of the loose handling of classified information and her use of a private server came down to convenience and expedience. The FBI report reinforces the State Department's own findings on Clinton's practices and the conclusion that everyone who could have said "no" to her at any point in her tenure at the State Department failed to do so. And Clinton herself, despite being warned by her predecessor Powell, lacked the foresight to avoid the issue completely by sticking to official systems—or simply not using e-mail at all.