Government work, generally speaking, is and was required to be done using systems approved by the government for the purpose. That is why I and others who had to work remotely on occasion were issued government owned and configured laptops with provision for VPN connectivity to the agency. Ms. Clinton almost certainly would have been issued such a laptop, and probably of considerably higher spec than mine.
There were exceptions, but it was understood that they were to be rare. Toward 2010 and forward, live Linux images tailored for specific agencies were available that could run securely on private hardware and be certified for connection to DoD networks and mitigate the need to issue laptops. It was not possible to access the agency's Exchange server except from government issued computer or Blackberry. While this was in a DoD agency, none of the data was classified higher than Personally Identifiable Information and the standards for the Department of State should have been at least as strict.
Use of a private system, as against a private commercial email account, raises a large number of security and compliance issues completely aside from the Federal Records Act. Much more is required in this case than simply Bcc to a government department account.
Biting the hand that feeds IT
