The scandal over Hillary Clinton's use of a private email server while secretary of state returned on Wednesday to dog her presidential campaign. A starkly critical report by the State Department's inspector general found she had not sought permission to conduct official business on her personal account.
Had she asked, she would not have been allowed to carry out government correspondence on her home-made set-up, for fear that state secrets could be hacked, the report said.
Clinton is still the frontrunner to secure the Democratic nomination in November's election to succeed Barack Obama in the White House.
But the email scandal continues to tarnish her main selling points as she prepares to take on Republican firebrand Donald Trump: experience and competence.
And there may yet be more revelations to come, as the FBI is conducting a separate investigation into whether state secrets were stolen or put at risk.
As the report was made public, Clinton's camp pushed back hard, insisting it had found she had acted as previous secretaries of state had done before her.
"Hillary Clinton's use of personal email was not unique," campaign spokesman Brian Fallon said.
"And she took steps that went much further than others to appropriately preserve and release her records."
The inspector general report does indeed note that Clinton's Republican predecessor Colin Powell also used a private email account. But it makes it clear that when Clinton joined the State Department in 2009, official guidelines had been updated and that she should have known about them.
"Secretary Clinton's cybersecurity practices accordingly must be evaluated in light of these more comprehensive directives," the report said.