Wearing a green jumpsuit, Lazar was relaxed and polite in the monitored secure visitor center, separated by thick security glass. In describing the process, Lazar said he did extensive research on the web and then guessed Blumenthal’s security question. Once inside Blumenthal's account, Lazar said he saw dozens of messages from the Clinton email address.

Asked if he was curious about the address, Lazar merely smiled. Asked if he used the same security question approach to access the Clinton emails, he said no — then described how he allegedly got inside.

“For example, when Sidney Blumenthal got an email, I checked the email pattern from Hillary Clinton, from Colin Powell from anyone else to find out the originating IP. … When they send a letter, the email header is the originating IP usually,” Lazar explained.

He said, “then I scanned with an IP scanner." Lazar emphasized that he used readily available web programs to see if the server was “alive” and which ports were open. Lazar identified programs like netscan, Netmap, Wireshark and Angry IP, though it was not possible to confirm independently which, if any, he used.

In the process of mining data from the Blumenthal account, Lazar said he came across evidence that others were on the Clinton server. "As far as I remember, yes, there were … up to 10, like, IPs from other parts of the world,” he said.