
(credit: CSPAN)
On Wednesday, the inspector general of the Department of State issued a scathing report on former Secretary of State Hillary Clinton's use of a private mail server during her tenure there, further securing the episode's legacy as perhaps the most historic case of "shadow IT" ever. Paying a State Department employee on the side to set up and administer her personal mail server, Clinton claims she just was doing what her predecessors did—but you'd be hard-pressed to find any government executive who ignored rules, regulations, and federal law so audaciously just to get mobile e-mail access.
If you've worked in IT for any amount of time, you've run across the shadow IT syndrome—employees using outside services to fix a problem rather than using internally supported tools. Sometimes (but rarely), it's actually mission-essential. For example, at a previous employer, when half the company lost access to e-mail and the content management system because a network card was stolen in a smash-and-grab at the telco's co-location facility, I set up a password-secured Wiki on my personal Web server to handle workflow and communications for a day. (The CIO was not happy, particularly when my boss wanted me to write an article about it. The corporate counsel had the story spiked because it exposed a Sarbanes-Oxley breach—not exposed by me, but by the company's failure to have a backup system.)
Often, people use shadow IT at work because of a lack of official IT resources to support a need. But they also use shadow IT for personal convenience—especially the personal convenience of executives and managers who want what they want and will twist the arm of someone in IT to support it whether it's within policy or not (or find someone else to do it for them and then tell IT they have to support it).