Vice President Mike Pence reportedly used a private email account to conduct public business, including homeland security matters, while he was governor of Indiana. Records of the emails were obtained by IndyStar through a public records request. Dwight Adams/IndyStar
Vice President-elect Mike Pence speaks to members of the media while meeting with House Speaker Paul Ryan of Wis., on Capitol Hill in Washington, Wednesday, Nov. 30, 2016.(Photo: Andrew Harnik/AP)
Vice President Mike Pence routinely used a private email account to conduct public business as governor of Indiana, at timesdiscussing sensitive matters and homeland security issues.
Emails released to IndyStar in response to a public records request show Pencecommunicated via his personal AOL accountwith top advisers on topics ranging from security gates at the governors residence to the states response to terror attacks across the globe. In one email, Pences top state homeland security adviser relayed an update from the FBI regarding the arrests of several men on federal terror-related charges.
Cyber-security experts say the emails raise concerns about whether such sensitive information was adequately protected from hackers, given thatpersonal accounts like Pence's are typically less secure than government email accounts. In fact, Pence's personal account was hacked last summer.
Furthermore, advocates for open governmentexpressed concernsabout transparency because personal emails aren't immediately captured on state servers that are searched in response to public records requests.
FRIDAY UPDATE: Pence turns over 13 boxes of emails
Pence's office in Washington said in a written statement Thursday: "Similar to previous governors, during his time as Governor of Indiana, Mike Pence maintained a state email account and a personal email account. As Governor, Mr. Pence fully complied with Indiana law regarding email use and retention. Government emails involving his state and personal accounts are being archived by the state consistent with Indiana law, and are being managed according to Indianas Access to Public Records Act.
Indiana Gov. Eric Holcomb's office released 29pages of emails from Pence's AOL account, but declined to release an unspecified number of othersbecause thestate considers themconfidential and too sensitive to release to the public.
That's of particular concernto Justin Cappos, a computer security professor at New York University's Tandon School of Engineering. Its one thing to have an AOL account and use it to send birthday cards to grandkids," he said. "But its another thing to use it to send and receive messages that are sensitive and could negatively impact people if that information is public.
Indiana law does not prohibit public officials from using personal email accounts, although the law is generally interpreted to mean that official business conducted on private email must be retained for public record purposes.
PENCE RESPONDS:Mike Pence: 'No comparison' between his, Hillary Clinton's use of emails
Pence's office saidhis campaignhired outside counsel as he was departing as governorto review his AOL emails and transfer any involving public business to the state.
Concerns also surrounded Hillary Clintons use of a private server and email account during her tenure as secretary of state. Pence as governor would not have dealt with national security issues as sensitive or as broad as those handled by Clinton in her position or with classified matters.
Pence fiercely criticized Clinton throughout the 2016 presidential campaign, accusing her of trying to keep her emails out of public reach and exposing classified information to potential hackers.
Pence spokesman Marc Lotter called any comparisons between Pence and Clinton "absurd," noting that Pence didn't deal with federally classified informationas governor. While Pence used a well-known consumer email provider, Clinton had a private server installed in her home, he said.
Cybersecurity experts say Pences emails were likely just as insecureas Clintons. While there has been speculation about whether Clinton's emails were hacked, Pences account was actually compromised last summer by a scammer who sent an email to his contacts claiming Penceand hiswife were stranded in the Philippines and in urgent need of money.
Gov. Mike Pence's personal AOL account was recently hacked. Wochit
Corey Nachreiner, chief technology officer at computer security company WatchGuard Technologies, said theemail accounts of Pence and Clinton were probably about equally vulnerable to attacks.
"In this case, you know the email address has been hacked, he said. It would be hypocritical to consider this issue any different than a private email server.
He and other experts say personal accounts such as the one Pence used are typically less secure than government email accounts, which often receive additional layers of monitoring and security, and are linked to servers under government control.
Indiana law requires all records dealing with state business to be retained and available for public information requests. Emails exchanged on state accounts are captured on state servers, which can be searched in response to suchrequests. But any emails Pence sent from his AOL account to another private account likely would have beenhidden from public record searches unless he took steps to make them available.
BEHIND THE STORY: IndyStar's long-running effort to obtain the Pence emails
Indiana Public Access Counselor Luke Britt, who was appointed by Pence in 2013, said he advises state officials to copy or forward their emails involvingstate business to their government accounts to ensure the record is preserved on state servers.
But there is no indication that Pence took any such steps to preserve his AOL emails until he was leavingthe governor's office.
When public officials fail to retain their private-account emails pertaining to public business, "they'rerunning the risk of violating the law, Britt said. A good steward of those messages and best practice is going to dictate they preserve those."
All of the emails provided to IndyStar, part of the USA TODAY Network, were ones captured on state servers.
The emails were obtainedafter a series of public records requests that the Pence administration did notfulfill for nearly four months before Pence leftoffice.
The administration of Pences successor, Gov. Eric Holcomb, released29pages of emails late this past week. But it withheld others, sayingthey are deliberative or advisory, confidential under rules adopted by the Indiana Supreme Court or the work product of an attorney.
Holcombs officedeclined todisclose how many emails werewithheld.
SELECTED PENCE EMAILS:Here are some of Vice President Mike Pence's AOL emails
Cyber-security experts and government transparency advocates saidPence's use of a personal email account for matters of state business including confidential ones is surprising given his attacks onClinton'sexclusiveuse of a private email server.
On NBC's "Meet the Press" inSeptember, for example, Pence called Clinton "the most dishonest candidate for president of the United States since Richard Nixon."
Whats evident from all of the revelations over the last several weeks is that Hillary Clinton operated in such a way to keep her emails, and particularly her interactions while Secretary of State with the Clinton Foundation, out of the public reach, out of public accountability, Pence said. And with regard to classified information she either knew or should have known that she was placing classified information in a way that exposed it to being hacked and being made available in the public domain even to enemies of this country.
The expertstold IndyStarthat similar arguments about a lack of transparency could be made about Pences use of a personal email account.
There is an issue of double standard here, said Gerry Lanosga, a professor at Indiana University and past president of the Indiana Coalition for Open Government.He has been far from forthcoming about his own private email account on which its clear he has conducted state business. So there is a disconnect there that cannot be avoided.
PENCE'S RESPONSE:Mike Pence: 'No comparison' between his, Hillary Clinton's use of emails
As governor, Pence oversawIndiana's state police, national guard and department of homeland security, all of which collaborate with federal authorities and handle sensitive information.
The emails provided to IndyStar show that Pence corresponded with his then-chief of staff, Jim Atterholt, and his top public safety and homeland security adviser John Hill, on subjects includingPences efforts to prevent the resettlement of Syrian refugees and the states response to a shooting at Canadas national parliament building.
I just received an update from the FBI regarding the individuals arrested for support of ISIS, Hill wrote to Pence in a Jan. 8, 2016 email with the subject, Arrests of Refugees.
At that time, the Pence administration was embroiled in a lawsuit over the governors effort to block the resettlement of Syrian refugees in Indiana.
Hill went on to explain how many people were arrested, on what charges and in which cities before adding in underlined type: Both of the earlier referenced refugees are reported now as Iraqi not Syrian.
PENCE'S OTHER EMAIL ISSUE:Mike Pence asks Indiana Supreme Court to stay out of his redacted emails
Much if not all of that information appears to have been reported in the media at the time. But questions remain about the more sensitive information contained inPences AOL account that the Holcomb administrationdeclined to release.
Experts say there have been high-profile security lapsesinvolving AOL email accounts in the past.The company reported a major breach of its email in 2014 affecting hundreds of thousands of users. The following year, messages hackers obtained from then-CIA Director John Brennans personal AOL account were posted on WikiLeaks.
Pences own account was compromised in June when a hacker sent a counterfeit email to his contacts claiming Pence he and his wife had been attacked on their way back to their hotel in the Philippines, losing their money, bank cards and mobile phone.
Autoplay
Show Thumbnails
Show Captions
In response, Pence sent an email to those who had received the fake communication apologizing for any inconvenience. He also set up a new AOL account.
Because the hacker appears to have gained access to Pences contacts, experts say it is likely that the account was actually penetrated, giving the hackeraccess to Pences inbox and sent messages.
The nature of that hack suggests it was part of a broad, impersonal attack not one carefully crafted to target Pence in particular, Cappos said.
Its particularly concerning that someone who didnt do a very particular, very specific attack was able to hack this account, he said.
That's especially true given that at least some of the emails Pence sent or received have been deemedconfidential or exempt from public disclosure.
The fact that these emails are stored in a private AOL account is crazy to me, Cappos said.This account was used to handle these messages that are so sensitive they cant be turned over in a records request.
As governor, Pence was less likely than the U.S. secretary of state to encounter national security secrets, said Adam Segal, director of the digital and cyberspace policy program at the Council on Foreign Relations.
But much of the rationale behind the criticism of Clinton's emails would apply to Pence, too, he said.
A large part of the criticism of (Hillary Clintons) personal server by the GOP that it was unsafe or that it was to circumvent oversight would be misplaced if Pence was using an AOL account, he said. The Secretary of State would be in possession of secrets that had more of a national impact, but at a lower level, a private email account has the same implications.
In addition to security issues, Pence's personal email account also raises new concerns about transparency, according to ethics experts and government accountability advocates.
Pence is already fighting in state court to conceal the contentsof emails involving his decision to join a 2014 lawsuit challenging then-President Barack Obama's executive order on immigration. The emails are being sought by William Groth, a Democrat and labor lawyerwho says he wants to expose waste in the Republican administration.
It all started with a joint lawsuit the Indiana governor filled against the U.S. government. Nate Chute/IndyStar
Richard Painter, former chief ethics lawyer to President George W. Bush, said it'sbothersomethat Pence is only now transferring his AOL emails to the state. It raises questions about whether those emails were included in previous responses to public records requests. "Thats a problem that should have been dealt with back then," he said."The existence of the private email account should have been dealt with at the time the record requests were made."
The use of personal email accounts by public officials including governors is nothing new. But the increased risk thathackers, including foreign actors, could break into the account of someone as high-ranking as the vice president of the United States is disconcerting, Painter said.
"Clinton did it. The Bush White House was doing it. Its nothing new. But its a bad idea," he said, noting thatPence'saccount was vulnerable to a low-level hacker. "If they can get in there, ex-KGB agents can get in there.Its a bad idea because of the hacking thing and the potential destruction of records."
Lanosga of the Indiana Coalition for Open Government said it's a problem that seems to cross partylines.
"Officials are eager to point the finger at a lack of transparency when it happens on the other side," he said,"but they dodge those issues when it comes to their own side."
Reporter Maureen Groppe contributed to this story.
Call IndyStar reporter Tony Cook at (317) 444-6081. Follow him on Twitterand Facebook.
Mike Pence's redacted emails could head to Indiana Supreme Court
Mike Pence's choice of AOL earns laughs
INDIANAPOLIS STAR
What's Mike Pence hiding in his emails?
With Pence gone, fellow Republicans undo his work in Indiana
Read or Share this story: http://indy.st/2lFe0ij
Go here to read the rest:
Mike Pence used private email for state business