The White House has responded to a judge’s order asking it to explain why it shouldn’t be required to make copies of all of its hard drives to ensure the recovery of missing emails by claiming that many of the relevant hard drives have been destroyed. You read that correctly: the White House position is “We don’t have to preserve hard drives containing missing email because we already destroyed them.”
“[T]he vast majority of computer workstations used during the relevant time period would have been replaced approximately every three years in connection with this refresh program,” writes Theresa Payton, the Chief Information Officer of the White House Office of Administration (OA) in her declaration to the court.
This latest revelation appears to present a major obstacle to the efforts of two non-profits, the National Security Archive (NSA) and Citizens for Responsibility and Ethics in Washington (CREW), which are suing to recover what may be up to 10 million missing emails and to ensure no more are lost. (Need to catch up? Read our full coverage of the missing White House emails story.) If the original hard drives exist, even deleted emails can probably be recovered from “slack space” on each hard drive, although the passage of time makes that process harder. But according to Payton’s declaration, when the White House removes old machines, it usually only copies “active data” to the new machine. Any previously deleted emails or archive files would then be unrecoverable. This means it may be virtually impossible to dig up emails from March to October 2003, a period that is not covered by White House backup tapes.
Given the dictates of the Federal Records Act, which governs the preservation of White House email, the administration’s destruction of the hard drives is curious. Of course, all IT departments regularly replace hardware. This “is necessary in order to run updated software, reduce ongoing maintenance, and enhance security assurance,” Payton says in her declaration.
When computers are replaced, it is fairly standard practice to destroy the hard drives of the old computers, particularly if they contain confidential information (as the White House hard drives almost certainly did). But it is almost unheard of for a hard drive to be destroyed if no backup of the data it contains exists. The White House is required by law to preserve all federal records, a category that includes much of its internal email correspondence.
This is an important point: destroying hard drives is common practice; permanently destroying data is another matter. It’s highly unusual. If the White House knew there was even a chance that the hard drives were the last repositories of the missing emails, it must have realized it might be irrevocably destroying data it was compelled to preserve.
It’s likely the White House knew of problems with its archiving system while it engaged in its normal practice of replacing computers. As Mother Jones reported last month, the National Archives and Records Administration (NARA) told the White House on January 6, 2004 that it was “operating at risk by not capturing and storing messages outside the email system.” Documents released at a House oversight committee hearing last month reveal that the White House knew of a “critical security issue” with the archiving system in 2005. And a 15-person team of administration employees created a report in 2005 that pointed to some 700 days for which there was a suspiciously low amount of archived email (for about 400 of those days there was no archived email at all). On April 13, 2007, Dana Perino, the White House Press Secretary, said “I wouldn’t rule out that there were a potential 5 million e-mails lost.”
It’s pretty clear White House officials knew there might be a problem with missing emails as early as 2004. But the “refresh” program continued. (A similar program to “recycle” backup tapes was stopped in October 2003—but only after the backup tapes for March-October 2003 had already been overwritten). Since it would be obvious to any IT professional (of which the White House has many) that the hard drives being erased were a potential source for recovering missing emails, any good faith effort to recover that information and ensure no more was lost would include a temporary halt to the “refresh” program. That didn’t happen.
It now seems that the plaintiffs’ concern that data contained in the slack space of White House hard drives would be overwritten was the wrong worry. If the administration is telling the truth, these drives have likely already been destroyed. The NSA plans to respond to the White House’s filing by close of business on Tuesday. The NSA’s General Counsel, Meredith Fuchs, told me she doesn’t see “how it’s possible” for the White House to have been running a computer refresh program for years but not, as Payton claims, know which computers it replaced and when. But given the twists and turns of this tale, well, any incompetence (or cover story) is possible.
