FBI Director James Comey describes how Hillary Clinton's personal email setup used multiple servers and devices that hostile actors may have accessed. Cybersecurity expert Robert Siciliano warns that the redundant servers expanded the attack surface, making social engineering and unprotected Wi-Fi major risks, and suggests sensitive data could already be in adversaries' hands.
Chapters
We do assess that hostile actors gained access to the private commercial email accounts of people with whom Secretary Clinton was in regular contact from her personal account. We also assess that Secretary Clinton's use of a personal email domain was both known by a large number of people and readily apparent. She also used her personal email extensively while outside the United States including sending and receiving work-related emails in the territory of sophisticated adversaries. Given that combination of factors, we assess it is possible that hostile actors gained access to Secretary Clinton's personal email account.
FBI Director James Comey says it is possible that Hillary Clinton's server was hacked, but says there is no evidence of it. With me now is cybersecurity expert Robert Siciliano. Robert, welcome back to the program. As a cybersecurity expert, what is your reaction when you hear the details that Comey gave on the levels of security on Clinton's server and then the multiple devices that were used?
Well, obviously, uh, she has, uh, everything to lose and nothing to gain by getting hacked. My guess is that she absolutely has the resources to prevent a hack from occurring. However, with social engineering, you know, the ability to con someone into clicking a link, and then even using any free unprotected Wi-Fi, her getting hacked is almost inevitable.
So, Robert, in your opinion, then, it sounds like sensitive data could already be in the hands of adversaries of the U.S.
Well, it's been said in multiple sources that that is the case. She's certainly a big enough target. It is likely that that is actually the case, and it's just a matter of time until we find out. You know, the fact that we haven't found anything out yet, meaning that nothing's been exposed, is interesting, because usually someone would brag that they had that information.
Or try to sell it.
Exactly.
So FBI Director Comey says, just to repeat, there wasn't just one server or mobile device, but multiple. So here's his comment on that, and then I have a follow-up question.
I have so far used the singular term email server in describing the referral that began our investigation. It turns out to have been more complicated than that. Secretary Clinton used several different servers and administrators of those servers during her 4 years at the State Department. And she also used numerous mobile devices to send and to read email on that personal domain.
So Robert, what is the significance, again, from your point of view as a security expert, of Comey's statement?
So the fact that they mentioned multiple servers means that she had redundancy set up so that if one server failed, meaning it crashed or it bricked, that she had something to back all that up. And she might have had them sporadically spread throughout the country or even, you know, the world for faster service and, again, redundancy. And then multiple devices— laptops, tablets, mobile phones— and having multiple people manage them. It's not unheard of. Business is done. But if the devices weren't properly protected, not properly encrypted, if those that were accessing them—you know, people, the admins—didn't have proper background checks, which you would think that they would, you just never know what could have been done with the data.
Robert, thank you very much for your perspective. Robert Siciliano— Thank you. —with me there.
