Most business use private email servers in they own or rent them. Most businesses dont have employees setup their own private email servers and conduct business related communication.
Well yes, most employees aren't millionaires or public figures or C suite executive types such as Hillary Clinton. And no, I would guess based on my experience a good portion (maybe 15%-20%) of C suite execs use their own homebrew servers.
I dont know for who you build email servers. But I would like to know which companies have you build servers for individual employees and then let those employees manage said servers and pass business sensitive information through them. And yes I am in IT. And yes I have built email servers among many other duties required of me. And I have gone through several legal retention and communication policy projects. I am somewhat versed in legal requirements of containing and capturing business related email.
As am I, having clients in all the highly regulated industries such as legal services, healthcare, accounting and financial services. All smaller firms 10-500 users. And yes, most entry level employees are of course not going to set up their own servers, but if a C suite exec did so without IT permission, in many businesses it would merely be accepted, frowned upon or both. And yes in some businesses it would be firable, especially if it were a rogue employee who set it up without regard for security. Which is why I said it depends on the context. So if the private server were properly patched, encrypted at rest with a modern suite and encrypted in transit via digital certs, and has various litigation hold and retention software (dirt cheap now, included for free with Office 365), most businesses would either let it go or have IT come in and start managing it. To say it's a blanket firing is absolutely inaccurate. Depends who you are (unfortunately).
And yes many companies would fire if somebody sent business sensitive content. Or what they would deem classified. They would have to just for liability reasons. An HR director sending employees SS numbers via their private email account? What could go wrong?
If the private email met the conditions above, literally nothing would go wrong. It would comply with all statuary data obligations and would be defensible in court. I'm not an attorney so I'll defer to those who are here, but securing data ain't rocket science, there are a ton of free, built-in tools available and other very inexpensive solutions for IDS/IPS, AV, etc.
Which companies exempt their executives from company wide electronic communication policies?
Um, a lot of them. Well for one, and like I keep saying, context matters. If the private server follows the electronic communication policies of the internal systems mandated by IT, not only has the exec not broken the law they haven't even necessarily broken their own firm's policies, depending on said firm. I'm not even sure how you think that's debatable, C suite folks constantly use their own homebrew setup. There's nothing inherently risky about it unless you've contracted it out to an utterly incompetent person (I have no idea whether
Pagliano was competent or not). Seems like he had some decent experience though he subcontracted retention to some other firm I believe.
It is a legitimate question of our media to ask a presidential nominee about sending state department email communication through her own email server. Communication which happened to include classified information. To think the media should just move on is quite frankly insane.
They shouldn't move on, but they should better inform themselves. They certainly shouldn't project any potential technical flaw in her email server as some sort of indictment of her competence or something, that's just ignorant nonsense. So far, as is typical in all media left or right, much of the coverage has been entirely non-specific regarding the actually security implemented on the private server. That's a giant omission, as hypothetically you would agree there is literally nothing controversial about a private email server that mimics a state sanctioned government email server, if that were the case. And we still don't really know much about the homebrew server, other than it used Windows Server and Exchange, had OWA access, was encrypted properly (except for I think the first few weeks of her term in Feb. 2009), etc.