Hillary Clinton, former secretary of state and presumptive Democratic nominee for the presidency, is facing a massive backlash after an FBI investigation found her to have been "extremely careless" in the handling of classified information. The scandal surrounding her use of a private e-mail server has only grown since the Justice Department's decision not to pursue criminal charges. Polls show that a majority of Americans believe she should have been indicted, and more recent polls place Clinton in a dead heat with the presumptive Republican nominee Donald Trump. Clinton led by a significant margin just weeks ago.

Regardless of the political games being played, the facts of Clinton's use of a private e-mail server and the related potential exposure of Top Secret information—including the names of covert intelligence personnel overseas and at home—are worth knowing and nailing down. At the core, these details raise a much broader question surrounding how national secrets are kept and shared and how broken the information infrastructure of the United States government really is.

In order to have an intelligent conversation about Clinton’s e-mails, here is a technical analysis of the evidence as it has been presented (think of it like a print version of Congressional hearings, minus screaming, finger-pointing, and grandstanding). A clearer picture has started emerging based on the testimony given by FBI Director James Comey and the Inspectors General of the State Department and the Intelligence Community (OIG), plus a portion of the 30,000-plus e-mails released thus far through FOIA requests by the State Department and other agencies. That picture, based on our assessment, is not a very pretty one.

Plenty of blame to go around

The evidence reviewed by Ars, including a portion of the 30,000 e-mails sent or received by Clinton, other e-mails obtained by the conservative action group Judicial Watch, and the information cited in the State Department OIG report, appears to support Comey's statement that Clinton lacked the "sophistication" to understand the impact of her own actions. The report and e-mails give the impression that Clinton simply did not know she was mishandling sensitive information because she did not recognize it to be classified, and she assumed what she was doing was within her purview as Secretary of State based on precedent set by previous occupants of her office.

Additionally, the OIG report and the e-mails themselves show not just carelessness by Clinton but a general indifference and even willful ignorance toward information security and document retention laws and rules at the State Department by both political appointees and career staffers. There was simply a culture where no one said "no" to the Secretary—no evidence exists that anyone ever directly contradicted her view or told Clinton not to use her private e-mail for reasons other than getting past State’s e-mail security filters. (The only documented time someone said "no" to her was when she asked for a Blackberry like President Barack Obama's, and the NSA refused her.) Clinton’s appointed staff, career professionals at State, and others failed to tell her what she was doing was wrong. In some cases, staffers actively told IT people at State who did question Clinton's private e-mail use to shut up.

This kind of culture absolutely pre-dates Clinton’s tenure at State. However, it failed during her watch on an entirely new level.

There are mitigating circumstances that clearly influenced investigators' decision not to pursue a case against Clinton. First, the vast majority of Clinton's more than 30,000 emails during her four years at State were unclassified. At worst, these contained sensitive-but-unclassified (SBU) content that would normally be restricted to State's internal e-mail system. Clinton could have been granted permission to get and send this information under State Department regulations at the time. The small amount of e-mail traffic that was later to be determined to be of a classified nature was almost entirely not marked as such.

For the most part, such messages were sent to Clinton by people within the State Department from State's unclassified mail system. There are also significant questions about the classification applied to many of the e-mails after the fact—some of the messages redacted by the State Department and marked as having contained "Secret" information were from sources outside government. Clinton would have reasonably assumed communications with such individuals were unclassified.

Still, a small fraction of the messages sent or received by Clinton containing classified information during her four years at State—especially eight message threads containing extremely sensitive information classified above Top Secret by reviewers—were major breaches of both State Department regulations and federal laws regarding handling of classified data. Some of the data was even beyond the security clearance levels of Intelligence Community OIG investigators.

These messages should have never been on State's internal unclassified e-mail system, let alone on a server sitting in the basement of the Clintons' home in New York. And by sending that information in the clear over the Internet between the State Department's e-mail gateway and Clinton's home mail server, vital national security secrets were exposed to potential espionage. Additionally, the information was potentially exposed through attacks on both Clinton's and the State Department's mail systems.

It's true that highly classified information may have similarly been passed over the Internet by previous Secretaries of State, their staff, and political appointees and career executives in the Foreign Service at State. And it's true that such breaches of protocol have likely happened before, during, and after Clinton's time at State. None of that changes the facts—it only magnifies how poorly the United States' diplomatic service handles information systems and security. And due to inadequate resources at State and outright resistance from the NSA to provide a solution, the State Department and the National Security Agency failed to provide the kind of support for Clinton early on that would have prevented such a situation from continuing.

Stretching the precedent

As detailed in the State Department's Inspector General report, Hillary Clinton is not the first Secretary of State to use a private e-mail address for work. For instance, former Secretary Colin Powell brought a private phone line into the State Department so that he could send e-mail through his AOL account. The report says:

Secretary Powell has publicly stated that, during his tenure as Secretary, he installed a laptop computer on a 'private line' and that he used the laptop to send e-mails via his personal e-mail account to his 'principal assistants, individual ambassadors, and foreign minister colleagues.' Secretary Powell's representative advised the Department in 2015 that he did not retain those e-mails or make printed copies. Secretary Powell has also publicly stated that he generally sent e-mails to his staff via their State Department e-mail addresses but that he personally does not know whether the Department captured those e-mails on its servers.

While Powell was at State, the Office of the Secretary/Executive Secretariat (S/ES) issued a memo reminding departing officials to forward printed copies of all of their correspondence—including e-mail—to the State Department for retention. Powell failed to do so. At a minimum, Powell's oversight was possibly a violation of federal records retention law at the time. But there's no way to know whether there was classified information in the e-mails, because they have not been recovered.

Powell's e-mail usage was a workaround for a very fundamental problem at State: prior to his arrival, there was no effective enterprise e-mail system with Internet access. Additionally, Powell would not have been permitted to access personal e-mail from a State Department owned computer, so he needed a private line to access his account. Powell explained to State Department OIG investigators that upon his arrival at State, the official e-mail system only connected to others at State. "He therefore requested that information technology staff install the private line so that he could use his personal account to communicate with people outside the Department," State OIG investigators reported. (Ironically, Scott Gration, an ambassador to Kenya, was forced to resign for doing essentially the same thing in 2012, while Clinton was using her own personal server.)

By the time Condoleezza Rice became Secretary of State, the OpenNet system was in place at the department to provide Internet mail access. Rice's staff used State-issued Blackberry devices with access to State's secure ClassNet e-mail servers, and Rice used only her State.gov e-mail. But Rice herself never had a State.gov e-mail address, and she "did not use either personal or Department e-mail accounts for official business," Margaret P. Grafeld, Deputy Assistant Secretary for Global Information Systems at the State Department told State OIG investigators.

That aligns with the practice of most senior government officials over the past decade. E-mail was correspondence typically handled by staff, and it was generally only handled and marked up by senior executives in printed form, according to numerous people within government who spoke to Ars.

Clinton did most of her work in this way—having staff send e-mails or printed memoranda, then managing through face-to-face meetings and phone calls. But she was not an e-mail avoider. Clinton had developed an affinity for her Blackberry and e-mail during her term-and-a-half in the US Senate and on the campaign trail during the 2008 presidential primaries. At some point following the campaign as she was losing access to her Senate e-mail, Clinton became frustrated with technical issues related to her AT&T Blackberry e-mail and device, according to aide Huma Abedin. Clinton had a new e-mail account configured for her on a personal mail server running in the Clinton home at Chappaqua, New York. The server was set up for former President Bill Clinton by his own staff.

On January 19, 2009—the day before President Obama's inauguration—someone working for the Clintons registered ClintonEmail.com on her behalf and configured the domain on the Exchange mail server. Clinton gave Abedin and others accounts. On her first day at State, Clinton became the first Secretary of State (and likely the last) to use a private e-mail server. She would routinely use it for official business communications with her core staff at State as well as for personal communications with friends and relatives. Over the next four years, Clinton sent and received over 30,000 e-mails.

Based on the e-mails released under FOIA request by the State Department and State's OIG report, no one in State's legal department ever authorized Clinton to use the private server. However, no one told her not to. "A March 17, 2009 memorandum prepared by S/ES-IRM staff regarding communications equipment in the Secretary’s New York residence identified a server located in the basement," the OIG report notes. So from the very beginning, State officials were aware Clinton was using the server. According to State OIG testimony to the House Oversight Committee, questions were raised about Clinton's e-mail by State IT team members. But State OIG was then told by the head of the Office of Information Resources Management for the Executive Secretariat (S/ES-IRM) that the system had been cleared by State attorneys and to never bring it up again.

Listing image by Kevin Lamarque / Getty Images