Today, the Office of the US State Department Inspector General (OIG) released a report [PDF] that is heavily critical of former Secretary of State Hillary Clinton’s use of a private email server to conduct state business.

Among the findings was that “At a minimum, Secretary Clinton should have surrendered all emails dealing with Department business before leaving government service and, because she did not do so, she did not comply with the Department’s policies that were implemented in accordance with the Federal Records Act.” The Federal Records Act requires officials to preserve records of their actions and communications while in office.

The National Archives and Records Administration (NARA) told OIG that this violation of the Federal Records Act was mitigated when Hillary Clinton released 55,000 pages of her private email correspondence. The OIG agreed in principle, but not with regard to Clinton’s case, as the former secretary withheld emails that OIG later discovered during the course of their investigation into Clinton’s private server:

OIG discovered multiple instances in which Secretary Clinton’s personal email account sent and received official business email during this period. For instance, the Department of Defense provided to OIG in September 2015 copies of 19 emails between Secretary Clinton and General David Petraeus on his official Department of Defense email account; these 19 emails were not in the Secretary’s 55,000-page production.

Former Secretary Clinton and some members of her staff refused to cooperate with OIG’s investigation. One Clinton staff member, Huma Abedin, was involved with Clinton in exploring the possibility of getting on the State Department’s email system. According to the OIG report, Clinton expressed concerns that her personal information could be compromised—arguably evidence that Clinton knew the rules and chose to disobeyed them.

Whether former Secretary Clinton’s private server was compromised remains an open question. Marcel Lehel Lazar, a Romania hacker who went by the alias Gufficer, has publicly stated that he hacked into Clinton’s server—a boast that should not be taken lightly, as it was the same hacker who successfully breached the email account of close Clinton confidante Sidney Blumenthal. Some of the emails in the breached account included messages to Hillary Clinton while she was serving as secretary of state.

If Guccifer was able to breach Clinton’s private server, it stands to reason foreign intelligence services had similar success.

The backdrop for all this is an ongoing FBI criminal investigation into former Secretary Clinton related to the private email server. If, based on that investigation, the FBI makes a criminal referral to the Justice Department, it could cripple or decidedly end Hillary Clinton’s presidential aspirations.

Given the conclusions of the OIG report, it looks like the FBI might have a case.