WASHINGTON - The U.S. government, it seems, has a major security problem. Cybersecurity, specifically.
Within the past year, unclassified computer and email systems from the smallest federal agencies to the largest departments have all been compromised by activist hackers, government spies and organized criminals.
The . The . The . The . Even the and the have had their systems breached and, in most cases, millions of private files and emails stolen.
In response to these attacks, U.S. officials and cybersecurity experts have mostly pointed the finger at Russian and Chinese state-sanctioned groups, although officials admit that hacks come from all over the world — even within the United States. For their part, Moscow and Beijing consistently deny any involvement, saying that they are, in fact, frequent targets of U.S.-sponsored hacking.
The number of successful hacks indicates Washington is doing a poor job securing its computer systems. Secretary of State John Kerry acknowledged as much in a recent TV interview it was "very likely" some of his emails sent while in office have been read by the Russians and Chinese.
The basics of what we’ve come to think of as email — services like Gmail or Yahoo Mail, for example — are decades old and out of date, says Birger Christiansen, chief operating officer at the privacy platform.
"That’s the crazy part; it’s such old technology," he told VOA. "POP3, SMTP — this stuff is 30, 40 years old. Everything else is new and super advanced, but not email."
Email servers pass data pass data back and forth with other servers, and then store it for specific account holders. Servers come in all shapes and sizes, from the mammoth operations of Google to Hillary Clinton’s that was housed in her home in Chappaqua, New York, while she was secretary of state.
Messages that users send may have privacy protection, such as SSL encryption, Christiansen said. However, once that email leaves the sender’s server to find the recipient’s server — say from Gmail to Yahoo Mail — or "sniffed" without the sender or recipient having any indication that someone was eavesdropping.
"Whatever happens between those two providers, nobody really knows," he said. "And if nobody knows, then nobody knows how many routers and hubs this is being passed through and who is sniffing that data. That really makes it not like a letter at all but a postcard, because at that point anyone could actually look at it and read it."
Clearly, this and other flaws in email design can be fixed. For years, information classified by the U.S. government has been routinely sent from and to specific accounts using trusted hardware and secure lines — keeping communications away from prying eyes. And a of firms, such as Christiansen’s GhostMail, now offer consumers end-to-end encryption and other measures that fix email’s fundamental insecurities.
But that security only exists when both sender and receiver are using the same secure platforms and servers — meaning once a user sends data to anyone outside that platform, the insecurities return.
"That we just haven’t figured out yet," said Christiansen.
It isn’t just the structure of email that’s old and insecure; it’s often the network systems connected to the email servers themselves.
"I don’t think there’s a lot of examples of email servers truly being compromised," Christiansen said. "I think most hacks are actually within a network." And once a network is breached, so too is its email server.
Martin McKeay, a longtime cybersecurity analyst and editor of the , agrees.
"Securing an end point, whether it’s the email server or system you’re using to connect to that, is difficult," McKeay said. "It can be done, but it requires not only configuring every single piece of equipment properly, but also maintaining it against hidden vulnerabilities you might not know about."
McKeay said it’s "impossible" to build a perfectly secure system, so businesses and governments run cost/benefit analyses to determine how much risk they’re willing to live with compared to the costs of security.
"Businesses have to analyze the risks in order to mitigate them," McKeay said. "But they still have to be aware [that] no matter how much they do, there’s still a certain amount of risk that will always remain, so that hackers will have access to that email."
While McKeay said there will always be vulnerabilities that remain unknown until hackers find and use them — often called "zero-day exploits." But cyber analysts say there's a much larger network vulnerability: people opening email they shouldn’t.