Are the classification codes stored/transmitted in the SMTP headers? Is that a known fact, or an opinion?
When they say 'messages were marked classified' or 'weren't marked classified' or 'had the classification stripped' ... is that equal to saying 'in/from the SMPT headers'?
I ask out of curiosity ... I'm a software developer so matters to me ... if that's a true/complete/accurate thing to say. Thanks!
Don’t interpret that too broadly, it was very hypothetical and based on the denials we’ve heard from the Clinton camp. They’re digging in on the “nothing marked classified in the email” stance, and technically you could make that happen by manipulating the SMTP gateway to strip certain content (classification markings) from emails before it was delivered to the recipient.
That’s not to say you couldn’t also run a program against the inbox - past the delivery point - that could also strip the markings. You could, and it would be easier. But it would also be much much easier to detect plus there could be evidence that the material was delivered with those markings. If it was done on the SMTP level instead where the markings were stripped as part of the same process where spam rejection is done, there would be much less evidence to follow up on and no chance of a pre-stripped message being archived at any point.
To give an example of what I was suggesting, another type of process that works the same way is SMTP antivirus. You may have seen messages that get stamped on the way in that they’ve been scanned with an AV program. The original message doesn’t contain that stamp, it’s added as part of the intake process when the mail is received. A sophisticated programmer could write custom code that acted in a similar way to strip classification markings.
I do not believe Bryan Pagliano was capable of that. From what I have gleaned he was more of a mid-level admin who could do things like install and configure a server, and probably also write simple agents to process messages at the application level, after messages were already delivered with classification markings. The risk there is that such an agent is going to be less reliable and there is a chance that a backup process could archive a message that was received just before the backup but also before the client agent had a chance to run. That I’d believe he was capable of; gateway programming would be something beyond his skillset.