In the corporate world, if there were a legal requirement for compliance, the auditor would verify that all work email is going over work servers, and then review the policies in place on those servers. You could technically let a special employee run their own server, but then that server would need to be audited, and the policies in place there reviewed. "Nah, you can trust Joe" wouldn't cut it.
Otherwise the entire point of compliance laws just goes out the window.
Legal compliance audits that I have been involved in tend to go beyond what is unquestionably prohibited by the law and also seek to identify and eliminate activities which might arguably violate the law (and thus create legal risk) including, but not limited to, those which violate organizations internal guidelines which are based on the applicable law but whose requirements may be (generally, should be) more strict than the law itself.
There are three different, but related, categories into which this might fall, in decreasing order of breadth:
1) Behavior that would be of concern to a compliance audit focused on the law in question,
2) Behavior that would violate administration guidance related to achieving compliance with the law in question,
3) Behavior that actually violates the law in question.
You are arguing, and I agree, that it is #1. There are reports that administration sources have indicated that it is #2 (I see no reason to doubt them, though I haven't seen the actual guidance, so I don't have an informed opinion.)
Neither of those, however, is the same thing as it being #3.
> agencies that allow employees to send and receive official electronic mail messages using a system not operated by the agency must ensure that federal records sent or received on such systems are preserved in the appropriate agency record-keeping system.
How did they ensure this? As a few news stories, including the linked article, have reported, they would have been immune from FOIA requests.
Here's another from http://www.politico.com/story/2015/03/hillary-clinton-used-p...
> The fact that Clinton’s emails were not a part of official State Department records until recently means many of them would not have been located in response to Freedom of Information Act requests, subpoenas or other document searches conducted over the past six years
Yes, that's exactly the question this raises.
> As a few news stories, including the linked article, have reported, they would have been immune from FOIA requests.
They would not have been immune. They may have been overlooked in the course of handling such requests, although assuming anyone in the State Department offices responsible for conducting document searches in response to FOIA requests (or subpoenas, etc.) was aware of the practice, they quite probably wouldn't have been, there just would have been an extra step involved in handling the requests.
"Former secretary of state Hillary Rodham Clinton appears to have operated in violation of what the White House said Tuesday was “very specific guidance” that members of the Obama administration use government e-mail accounts to carry out official business."
I don't know, I see other relevant questions. For instance, nothing in the quoted law says anything about how they shall "make and preserve" the records, only what purposes those records must be adequate to serve. So, using private email alone doesn't seem to be a violation, it seems to be something that might be the starting point for an inquiry as to whether she made and preserved "ontaining adequate and proper documentation of the organization, functions, policies, decisions, procedures, and essential transactions of the agency and designed to furnish the information necessary to protect the legal and financial rights of the Government and of persons directly affected by the agency’s activities", but it doesn't alone provide an answer to that question whether or not you consider emails as records.