Clinton’s e-mail scandal another case of the entitled executive syndrome

On Wednesday, the inspector general of the Department of State issued a scathing report on former Secretary of State Hillary Clinton's use of a private mail server during her tenure there, further securing the episode's legacy as perhaps the most historic case of "shadow IT" ever. Paying a State Department employee on the side to set up and administer her personal mail server, Clinton claims she just was doing what her predecessors did—but you'd be hard-pressed to find any government executive who ignored rules, regulations, and federal law so audaciously just to get mobile e-mail access.

If you've worked in IT for any amount of time, you've run across the shadow IT syndrome—employees using outside services to fix a problem rather than using internally supported tools. Sometimes (but rarely), using a work-around is actually mission-essential. For example, at a previous employer, when half the company lost access to e-mail and the content management system because a network card was stolen in a smash-and-grab at the telco's co-location facility, I set up a password-secured Wiki on my personal Web server to handle workflow and communications for a day. (The CIO was not happy, particularly when my boss wanted me to write an article about it. The corporate counsel had the story spiked because it exposed a Sarbanes-Oxley breach—not exposed by me, but by the company's failure to have a backup system.)

Often, people use shadow IT at work because of a lack of official IT resources to support a need. But they also use shadow IT for personal convenience—especially the personal convenience of executives and managers who want what they want and will twist the arm of someone in IT to support it whether it's within policy or not (or find someone else to do it for them and then tell IT they have to support it).

Just make it happen

A certain class of executives wants a specific phone supported or special IT support for their chosen staff, and they want it now, rules and regulations be damned. "Yes" is the only answer they ever hear, and they will keep asking until they hear it—either from the IT department or from someone who will do it for them on the side. When I worked in IT, particularly when I moved up to a role as a "director of IT strategy" at a previous employer, these requests for special treatment happened so frequently we started calling it the "entitled executive syndrome." No matter how many times I explained the laws of physics and the limits of our budget and capabilities, I was told to find a way to make it happen… or come up with a creative workaround.

Sure, there's often a reason for dissatisfaction with the organizational norm. But skirting the norm can create all sorts of regulatory and legal headaches—Sarbanes-Oxley-related ones are the most common in the corporate IT world. Looking at the government sector, shadow IT has constantly gotten people in trouble for a host of other reasons: federal records laws, Federal Information Security Management Act (FISMA) violations, and privacy violations. For example, in 2010, doctors at a Department of Veterans Affairs got caught using Google and Yahoo cloud calendar services to schedule surgeries, breaching the security of health care data. They used it because it was more convenient than the VA's internal shared calendar system.

And lest we forget, well before Clinton came to the State Department, members of the George W. Bush administration used a private e-mail server (at gwb43.com) run and paid for by the Republican National Committee—at least 88 accounts were set up for Bush administration officials in order to bypass the official White House e-mail system and avoid the regulations around presidential record retention, the Federal Records Act, and the Hatch Act (which bans the use of government e-mail accounts for political purposes, among other things). In the process of using that system, more than 5 million e-mail messages were "lost," which led to the resignation of a number of White House officials, including Deputy Chief of Staff Karl Rove. None of the e-mails for 51 of the 88 accounts was preserved by the RNC.

Clinton was well aware of the Bush administration e-mail fiasco before she was nominated and confirmed as Secretary of State. She even told the State Department's assistant secretary for diplomatic security that she "gets it" after being briefed on why there were problems with her using a BlackBerry.

As previous e-mails obtained through Freedom of Information Act requests have shown, Clinton pushed hard to get the State Department's information security officers to approve her use of a mobile device for e-mail and do it from inside the State Department's secure executive suite—largely on the grounds that she was uncomfortable using a PC. The National Security Agency suggested she use an approved secure device capable of doing Secret-level classified e-mail as well as official unclassified e-mail. But the State Department was unprepared for the cost of supporting such a device, and its IT department didn't have the resources (nor, likely, the skills) in-house to support it.

Sure, the State Department's IT support is not exactly customer-centric. But its IT department has supported BlackBerry devices for unclassified e-mail in the past, and if Clinton could have dealt with sticking to using a computer while inside the State Department secure compartmented information facility (SCIF) and using a BlackBerry for unclassified e-mail, the State Department could have probably accommodated her. It was purely about Clinton's discomfort about using a PC for e-mail and her desire to use e-mail just like she did while running for office.

So, as the State Department Office of the Inspector General reported, she paid a State Department staffer (who had worked for her directly in the past) off the books to create a shadow e-mail service of her own, and she used a personal BlackBerry not configured to State Department security standards to carry out official business. Having had a BlackBerry and the full control offered by private e-mail service during her presidential campaign in 2008, Clinton knew what she wanted, and she was going to have it whether it was approved or not. And she provided the same shadow e-mail service to her core staff as well—taking all of their communications off the grid and out of federal oversight.

Clinton's excuse for her decision, which she now calls a mistake, was:

• Previous secretaries of state (specifically Colin Powell) used personal e-mail accounts.
• Condoleezza Rice got to use a BlackBerry, so she (and her staff) should be allowed to, too.

But no other secretary of state before her used e-mail as heavily, and the regulations regarding preserving e-mail records have changed over the past two decades. Condoleezza Rice did not use a personal e-mail account, according to the OIG report; she used a BlackBerry, but it was State Department issued. Madeline Albright never even sent e-mails. And while Colin Powell did use a personal e-mail account, the State Department was just getting Internet-connected e-mail at the time (on a system called OpenNet).

Besides, Clinton's excuse basically boils down to this: other people broke the rules, so she should have been allowed to as well. It's the entitled executive syndrome writ large.