A paper trail DOES exist!
Look at the OIG report from May 2016, specifically pages 33-34
https://fas.org/sgp/othergov/state-oig-email.pdf
In March 2009, after unsuccessful efforts to supply Secretary Clinton with a secure government smartphone, DS was informed that Secretary Clinton’s staff had been asking to use BlackBerry devices inside classified areas.
The Assistant Secretary of DS then sent a classified memorandum to Secretary Clinton’s Chief of Staff that described the vulnerabilities associated with the use of BlackBerry devices and also noted the prohibition on the use of Blackberry devices in sensitive areas.
According to a DS official, shortly after the memorandum was delivered, Secretary Clinton approached the Assistant Secretary and told him she “gets it.”
The use of personal email accounts to conduct official business has been a particular concern over the past several years. For example, on March 11, 2011, the Assistant Secretary for Diplomatic Security sent a memorandum on cybersecurity threats directly to Secretary Clinton.139 A portion of the unclassified version of this memorandum states: Threat analysis by the DS cyber security team and related incident reports indicate a dramatic increase since January 2011 in attempts by [redacted] cyber actors to compromise the private home e-mail accounts of senior Department officials. …
Although the targets are unclassified, personal e-mail accounts, the likely objective is to compromise user accounts and thereby gain access to policy documents and personal information that could enable technical surveillance and possible blackmail. The personal e-mail of family members also is at risk.
The memorandum included as an attachment “a snapshot of affected Department personnel,” noting that many of the email account owners play major roles in forming diplomatic and economic policy.140 It concluded by noting, “We also urge Department users to minimize the use of personal web email for business, as some compromised home systems have been reconfigured by these actors to automatically forward copies of all composed emails to an undisclosed recipient.”
Following the March 2011 memorandum, DS cybersecurity staff conducted two cybersecurity briefings of S/ES staff, the Secretary’s immediate staff, and Bureau of Public Affairs staff in April and May 2011. OIG discovered in Secretary Clinton’s retired paper files a copy of the classified presentation used during the briefing. It contains material similar to the type provided in the March 11, 2011, memorandum.
On June 28, 2011, the Department, in a cable entitled “Securing Personal E-mail Accounts” that was approved by the Assistant Secretary for Diplomatic Security and sent over Secretary Clinton’s name to all diplomatic and consular posts, encouraged Department users “to check the security settings and change passwords of their home e-mail accounts because of recent targeting of personal email accounts by online adversaries.”141 The cable further elaborated that “recently, Google asserted that online adversaries are targeting the personal Gmail accounts of U.S. government employees.
Although the company believes it has taken appropriate steps to remediate identified activity, users should exercise caution and follow best practices in order to protect personal e-mail and prevent the compromise of government and personal information.” It then recommended best practices for Department users and their family members to follow, including “avoid conducting official Department business from your personal e-mail accounts.