White House E-mails: Gone, But Not Forgotten?

By Justin Rood

Apr 12, 2007 2:17pm

The White House set off a miniature firestorm Wednesday when it revealed that years of e-mails belonging to White House political aides were deleted, apparently in violation of federal law requiring presidential documents to be preserved. But "deleted" doesn’t mean what it used to, according to computer forensic experts. Indeed, deleted e-mails and files, even years-old ones, are recovered all the time. "We do it every day of the week," said Beryl Howell of Stroz Freidburg LLC, a Washington, D.C.-based firm that specializes in recovering lost data for businesses complying with court orders, criminal investigators and others. Companies turn to Howell’s firm when they "have a duty to preserve certain e-mails," not unlike the White House in this scenario. "Companies are sanctioned when they do not preserve electronic data," even if it means putting technicians to work extracting bits and bytes of "deleted" data that has not yet disappeared from hard drives. "They look at their backup systems and backup tapes," Howell said, adding that "with any electronic storage media, you can do forensic recovery and find deleted data." In an 80-minute conference call with a select group of print reporters yesterday, White House spokesman Scott Stanzel said that e-mails from 2004 and earlier sent and received by 22 White House employees, including chief political aide Karl Rove, had been deleted. The e-mails — sent through private servers belonging to the Republican National Committee, not the White House — had been erased as part of an "automatic deletion policy" by the political organization, Stanzel said, and that the White House was "aggressively working to fix" the mistake.  In a press briefing this afternoon, White House spokeswoman Dana Perino said the White House was considering hiring a forensics expert.  "I will admit it," she said. "We screwed up and we’re trying to fix it." House Oversight and Government Reform Committee Chairman Henry Waxman, D-Calif., two weeks ago sent a letter to the RNC directing the group to preserve e-mails from White House staff but not the hardware on which they were once stored.  Steven Aftergood, an information and government expert with the Federation of American Scientists, said he wasn’t sure who had the authority to order the drives preserved and analyzed, if the White House didn’t voluntarily ensure it was done. "I think it’s uncharted territory." Without knowing the technical details of how the e-mails were deleted, computer forensics expert Rob Lee said he couldn’t say with certainty if any of the communications are recoverable.  But from his experience working with the FBI and other criminal investigators, he knows one thing: Unless the hard drives containing the e-mails were physically destroyed or lost, "the only way someone could claim something has been destroyed is if the e-mails themselves have been wiped" from a hard drive or tape backup, he said, "overwriting every piece of data." That requires special software designed explicitly to cover any trace of deleted information. The RNC did not immediately respond to a request for more information on their e-mail deletion policy and practices.  The Presidential Records Act of 1978 requires all White House documents be preserved if they "relate to or have and effect upon the carrying out of the constitutional, statutory, or other official or ceremonial duties of the President." This post has been updated.

You are using an outdated version of Internet Explorer. Please click here to upgrade your browser in order to comment.
blog comments powered by Disqus