A system administrator with Platte River Networks, the company that took over hosting Hillary Clinton's mail server after it was moved out of her basement in Chappaqua, has been the target of a crowdsourced investigation on Reddit into whether he took part in a conspiracy to cover up Clinton's e-mails. Paul Combetta, an employee of Platte River Networks who was granted immunity from prosecution by the Justice Department in exchange for cooperation with the FBI's investigation of Clinton's e-mails, apparently went to Reddit for help with a sticky problem related to the e-mail investigation by the House Select Committee on Benghazi—scrubbing the e-mails of Clinton's personal address.
While the post doesn't provide evidence that Clinton herself instructed Combetta to erase her e-mails, it does suggest that his staff wanted to excise her private e-mail address from the archives to be turned over to the State Department—and, in turn, to the House Select Committee. The later destruction of the e-mails during the continuing investigation was apparently, as Combetta told investigators, an "oh shit moment."
On July 24, 2014, a reddit user with the screen name "stonetear" posted to r/exchangeserver looking for advice on a vexing problem:
Hello all- I may be facing a very interesting situation where I need to strip out a VIP's (VERY VIP) email address from a bunch of archived email that I have both in a live Exchange mailbox, as well as a PST file. Basically, they don't want the VIP's email address exposed to anyone, and want to be able to either strip out or replace the email address in the to/from fields in all of the emails we want to send out.
I am not sure if something like this is possible with PowerShell, or exporting all of the emails to MSG and doing find/replaces with a batch processing program of some sort.
Does anyone have experience with something like this, and/or suggestions on how this might be accomplished?
...The issue is that these emails involve the private email address of someone you'd recognize, and we're trying to replace it with a placeholder address as to not expose it.
Based on other social media profiles and a Google e-mail address, "stonetear" appears to have been Paul Combetta, according to the work of members of Reddit's r/conspiracy and others. The account and posts were quickly deleted after they were discovered, but they were preserved in Internet archives. [A reader notes that "stonetear@gmail.com" is connected with Combetta's name on Google Hangouts.]
The date of the post is interesting because it is the day after the State Department and the House Select Committee on Benghazi reached an agreement on producing records related to the Benghazi investigation—but months before the State Department actually requested private e-mails related to work from Clinton and former Secretaries of State Colin Powell and Madeline Albright.
That is also the timeframe during which Clinton's chief of staff, Cheryl Mills, told Platte River Networks to export all of the e-mails sent by Clinton to ".gov" e-mail addresses into a separate .PST mailbox file in preparation for the investigation, according to FBI interviews (PDF) with Mills and a redacted Platte River Networks employee—Combetta. The report does not say whether Mills requested Combetta do anything else with the e-mails before turning them over—such as scrubbing the incriminating personal domain name from the e-mails before they were passed to Congress to avoid revealing Clinton was using a personal domain for her e-mail or allowing her e-mail address to become public record.
In any case, Combetta could not easily erase that information without directly editing the contents of the e-mail files. A number of tools were suggested by reddit posters as a way to perform some fixes or to correct the problem in the future, but none of the suggestions would have easily stripped e-mail addresses from within a .PST file of the size he was dealing with.
In the end, the .PST archive file was passed to Clinton's lawyers. Clinton's use of a private e-mail domain was exposed before by The New York Times in March of 2015—though it had previously been exposed by the Romanian hacker Marcel Lazar Lehel (aka "Guccifer") two years earlier without being widely investigated.
Captain BleachBit
In December of 2014, after the e-mails were provided, Mills apparently requested a change to the retention policy for e-mails on the private server, telling Combetta that Clinton didn't want any of her e-mails going forward to be retained for more than 60 days. But as had happened with many requests from Clinton's staff—including the request to encrypt the contents of the mail repositories to protect them—the Platte River Networks technicians never implemented the policy.
Combetta gave conflicting information several times about Clinton's e-mails on the server. But in a final follow-up interview this May, Combetta came clean to the FBI and "indicated he believed he had an 'oh shit' moment" when he realized he had not implemented the 60-day policy for Clinton's post-State Department e-mails.
Instead of purging e-mails in her current mailbox, "sometime between March 25-31, 2014 [Combetta] deleted the Clinton archive mailbox from the [Platte River Networks] server and used BleachBit to delete the exported .PST files he created on the server system containing Clinton's e-mails," the FBI report on the investigation recounted. He then realized that he had deleted e-mails he was supposed to retain because of the investigation's preservation request, even though he was aware that "he should not disturb Clinton’s email data," the FBI noted.
reader comments
183