Rarely enforced. Executives in regulated industries do it all the time. Or (more commonly) when hordes of contractors use their own email systems to discuss client matters -- which is perfectly normal because they are covered by NDA. If someone is fired for using personal email, it's likely because a higher up was looking for an excuse.
Of course a contract doesn't cover classified or FOIA material which is where the questions regarding Clinton's setup will go.
Most corporate hardware should be presumed "insecure" from the perspective of personal communication, and similarly so shoud any account that is used to co-mingle work and personal communication.
In other words, it is with great risk[1] that you don't use company hardware. Unless you have duplicate systems, of course. And if you have a duplicate system that you pay for in lieu of the company, only to for the purpose of subverting company policy, you have an ethics problem.
If that makes sense.
In any event, the technical issues here about how this was setup are legitimately interesting. It might very well be that the NSA/secret service or whomever set up this system to very secure indeed. I think the jury is out on that, frankly, and I'm not sure I would jump to the conclusion that SOS would be so wreckless as to not have her system vetted. (Or that the secret service or NSA or whomever would be so wreckless to not do it for them). Obviously it was a very carefully considered and pre-meditated decision to set up this system.
But then again people do stupid stuff all the time.
[1] To your personal life and privacy, not to the corporations per-se.
Yes ... towards things like Google Mail for Corporations. If you make your corporate email better than your personal email, people will use it. If not, they just won't, if they have enough political power within the organization.
I speak from close exposure to white glove CxO level IT service where we do everything from ensure the biometric reader on the CEO's laptop works, to helping wire the CFO's home theatre system, getting the board chairman's vacation photos printed, and setting up all their personal devices.
If these sorts of folks don't like a system, they won't use it. They chucked the Blackberry for an iPhone. One of the reasons I've seen biometrics on a laptop is that a particular leader refused to remember a password longer than 4 digits. That alone made them prefer the corporate Lenovo vs. their personal Macbook Air.
"Most corporate hardware should be presumed "insecure" from the perspective of personal communication, and similarly so shoud any account that is used to co-mingle work and personal communication."
Bring Your Own Device is becoming popular. Every company I've worked for in the past 8 years (2/3 in the Fortune 100) allows BYOD in some form for executives, where they mix their personal and corporate communication. And sometimes for all employees.
The latest thinking in corporate security is not to lock down devices but rather to assume that ALL devices are vulnerable, with no special status for corporate assets. The solution there is to isolate in depth at the service level, with appropriate policy and device management installed for enforcing minimum standards and for emergency remote wipe. Modern apps - email, HR, reporting, order management, etc. are on the Internet, not behind the firewall... unless there's a need for NAT. Legacy can be accessed through VDI.
I admit the future here is not evenly distributed yet. But this is the trend that I see.
"In other words, it is with great risk[1] that you don't use company hardware. Unless you have duplicate systems, of course. And if you have a duplicate system that you pay for in lieu of the company, only to for the purpose of subverting company policy, you have an ethics problem."
I would say corporate IT has a usability problem.
The State Department might want to read the rules, $DIETY knows the Interior Department sure had problems with them.
>The State Department is still reportedly trying to block hacker access to its unclassified e-mail system more than three months after the intruders were first detected.
http://www.enterprise-security-today.com/story.xhtml?story_i...
Yes, "unclassified", but, really? Three months? Really??
Edit: I suppose there are other options. She could have used a staffer's email to send messages on the classified networks.
> Agencies that allow employees to send and receive official electronic mail messages using a system not operated by the agency must ensure that Federal records sent or received on such systems are preserved in the appropriate agency recordkeeping system.
Also, I've rarely encountered a company that cared about whether C-level employees followed the company rules. A "fireable offense" for a fry cook is another day at work for the COO.
If I were her, I would want to personally vet my IT department. I don't know how many Snowdens work at the state department.
As an attorney, a former Senator, and finally a Secretary of States, she and her staff had to known proper security protocols & transparency laws were not applied.
regardless, it was against the law and public officials should always be held to the highest standard, they are not royalty.
When i think about the email requirements of any corporation, every real job I've had, the use of personal email for company business is against policy and would be a fireable offense.
Also interesting to consider the FOIA is more fearful to a politician, than having this private email service hacked by a foreign intelligence service. state department is essentially an adjunct to the CIA at the highest levels, so this is a real risk.