Hillary Clinton hasn't said anything about 'active defense' - and that's a problem
The fact that these government servers were infiltrated - despite being monitored day and night for signs of hacker activity by teams of cybersecurity experts from various agencies - shows how easy it is for sophisticated cybercriminals to compromise even the most well-protected systems.
"There is no way to be truly secure," Alex McGeorge, senior security researcher at Immunity Inc., told Business Insider. "But the State Department at least has teams whose job it is to detect a hack as soon as it happens - there is no indication so far that Hillary had this kind of active defense."
Consequently, there may have been an opportunity for a nation-state level hackers to compromise Hillary Clinton's "homebrew" email server. Whereas the State Department formed a team "to develop and implement a response plan, in coordination with cybersecurity experts from DHS and other agencies" to better detect and respond to cyberattacks, it is unknown if Clinton took similar precautions.
What level of security did Clinton have?
At a press conference on Tuesday, Clinton did not provide details about her cyber security team, saying only that the private computer server had not been breached and was hosted "on property protected by the Secret Service."
Experts were quick to point out that hackers, especially sophisticated state-sponsored ones, could remain undetectable while they sift through inboxes and collect information.
Clinton added that the system was established during Bill Clinton's presidential administration (1993-2001). If Clinton had a technical security team to monitor her server for suspicious activity, Clinton might have had an advantage over the State Department in terms of security.
"In many ways, Hillary's private system would have been safer purely because it's a smaller target," cybersecurity expert Joe Loomis of CyberSponse told Business Insider. "Only she and a few other people are using it, compared to hundreds at the State Department, and she's cyber-savvy enough to know not to click on suspicious emails."
While it is true that Clinton's email account was smaller and more private than a '.gov' email address, it still would have been fairly simple for nation-state level hackers to intercept her messages to foreign heads of state. "An amateur hacker might not know how to infiltrate Clinton's email," McGeorge said. "But she's emailing her colleagues in other countries, and they keep it all on record."
Unclassified information is valuable
When the US Navy discovered that their unclassified network had been breached by Iranian attackers in 2013, it took technicians four months to evict the hackers from their system, according to the Wall Street Journal.
The fact that hackers still find it worthwhile to infiltrate unclassified networks - and remain embedded within them for months on end - shows that hackers value whatever intelligence they can get their hands on. Thus, Clinton's insistence that she never sent nor received classified information on her homebrew server, and the government's claim that hackers appear to have access only to unclassified emails, is largely irrelevant.
"Even if there is no classified information in the conversation, hackers still have access to the content of emails," McGeorge said. "If whistleblowers could extract so much information from the NSA using only metadata (which reveals when conversations occurred and who they were between), imagine what hackers could do with the actual text of these conversations."
The question now is not whether Clinton's private server was as safe as the State Department's, but if it was even safer. If the State Department is "a constant target of cyber attacks," as State Department spokesman Jeff Rathke said in a statement last November - and if hackers are constantly probing government servers for security holes (and finding them) - then we can only assume that they jumped at the chance to find vulnerabilities in the private domain of a high-ranking White House official.