A White House contractor's email appears to have been hacked, leaking material ranging from Michelle Obama's passport to the number of stairs the Secret Service anticipated Joe Biden would be climbing during a trip to Cleveland.
The emails were sent from the Gmail account of Ian Mellul, who is a contractor employed as an advance associate at the White House, and include correspondences with other White House employees as well as with Mellul's friends and professors. In one, the staffer references still being in college.
A senior U.S. intelligence official called the hack "the most damaging compromise of the security of the President of the United States that I've seen in decades, all caused by a careless staffer who compromised information outside government systems merely for convenience."
The emails include:
- Detailed lists of names of Secret Service and White House Military Office staffers who were to travel and manage specific site security for the President and First Lady's trip to Havana, Cuba in March.
- The White House Travel Manual which includes IT security guidelines for staffers travelling abroad.
- The detailed routes for movements of the Vice President on trips in the United States (i.e. his route through hotel corridors at an event in Cleveland).
- The detailed schedules and movements of the First Lady on a trip in the U.S.
- The detailed schedules and movements of trips for Democratic presidential nominee Hillary Clinton and former president Bill Clinton.
- Names, social security numbers, and dates of birth of some White House staff.
- Names, social security numbers, and dates of birth for guests to vice presidential events that were to be cleared by Secret Service (these are regular citizens or staff such as caterers etc. who were to meet with the vice president).
It's a stunning breach of highly sensitive information and the latest in a series of leaks for the Obama administration over the past year, starting with documents from CIA Director John Brennan's personal AOL email account, which were published by WikiLeaks last October.
The White House contractor's emails were made public by DC Leaks, the group that last week also printed emails from former Secretary of State Colin Powell. In the emails, the retired four-star general called Donald Trump a "national disgrace." DC Leaks is believed to have ties to Russian intelligence services, a federal law official told NBC News.
The emails and documents are presented and archived in the exact same manner as Powell's emails.
The hack was first reported Thursday by the Daily Mail and confirmed by NBC News.
One leaked email has 24 scanned passports attached to it, including Michelle Obama's. It was transmitted by a staffer in her office to Mellul, who then in turn forwarded that email to his personal account. The quality of the scan is high, and shows all of her personal details.
The First Lady's office at the White House declined to comment.
White House press secretary Josh Earnest told reporters Thursday that "administration officials are taking a look at the information that’s been disclosed" and added that the White House could not speak to the leaked information's authenticity. He also said there wasn't "any conclusion" on who was responsible.
Earnest said often contractors who are private citizens not employed by the administration on a long-term basis are used to do logistical planning ahead of visits by the president and other White House officials.
He added that this "should be a wake up call for all of us," to safeguard electronic information.
White House contractors are often assigned “associate” email accounts on the secure White House domain (who.eop.gov), but accessing that domain means they need to have a secure smartphone handy. Sometimes, some of these contractors also use personal email accounts to do some of their work.
The Secret Service on Thursday told NBC News it's "aware of the alleged email hacking of a White House employee" and would not, as a matter of policy, provide information about an investigation.
"The Secret Service is concerned any time unauthorized information that might pertain to one of the individuals we protect, or our operations, is allegedly disclosed," a Secret Service official said.
Not only do the emails contain specifics about the first lady and vice president — such as meticulous schedules intended for their Secret Service protection — they also reveal details about Hillary Clinton's campaign events, which the staffer was also apparently involved with.
The emails describe where and with whom Clinton would be in such events, listing who would be riding in which cars in her convoy and the manifest for her private plane. The Clinton campaign did not comment on the email leak.
They also show a presentation for a trip to the Intercontinental Hotel in Cleveland that Biden took in June. The Power Point outlines how many stairs Biden would walk up as he arrived at the hotel loading dock and laid out the rooms he would visit once inside.
The use of personal email accounts in the course of working on government-related issues or even at federal facilities has come up before.
For more than a year, Clinton has been embroiled in a controversy over her use of a private email server.
Last year, Homeland Security Secretary Jeh Johnson said he banned the practice of issuing homeland security officials waivers to use personal email on government computers. He said he did this after a Bloomberg View article found that he and 28 other senior officials were using their personal emails at work.
"When I read the story I said, 'You know whoops this is not a good practice so I should discontinue it'," Johnson said at a Politico breakfast hosted by Politico's Mike Allen.
Johnson said at the time that he only used his Gmail at work for personal use and his government email for all homeland security purposes.