This headline, from Bloomberg, says it all: “Clinton’s E-Mail System Built for Privacy Though Not Security.”

Of course it was. You don’t do what Clinton did unless you want to keep full control of your conversations:

“What we know is that she cared about that communication channel so much that she went out of her way,” and likely hired an expert to configure it for her, [an expert] said in a phone interview.

That, naturally, is why the system was strong on this:

“You erase it and everything’s gone,” Matt Devost, a security expert who has had his own private e-mail for years. Commercial services like those from Google Inc. and Yahoo! Inc. retain copies even after users erase them from their in-box.

And weak on this:

Although Clinton worked hard to secure the private system, her consultants appear to have set it up with a misconfigured encryption system, something that left it vulnerable to hacking, said Alex McGeorge, head of threat intelligence at Immunity Inc., a Miami Beach–based digital security firm.

That’s fine if you’re Bono. But not if you’re the top diplomat in the United States:

In order to ensure her e-mails were private, Clinton’s system appeared to use a commercial encryption product from Fortinet — a good step, McGeorge said.
However, when McGeorge examined the set-up this week he found it used a default encryption “certificate,” instead of one purchased specifically for Clinton’s service. Encryption certificates are like digital security badges, which websites use to signal to incoming browsers that they are legitimate.
“It’s bewildering to me,” he said. “We should have a much better standard of security for the secretary of state.”

No, we should have had a much better standard of secretary of state.